What actually happens if your site has no cookie banner?

Probably nothing dramatic, and probably not tomorrow. The honest risk is quieter: on most WordPress sites, the tracking starts before anyone is asked — and that, not the missing banner itself, is what the rules are written about.

The short answer

A cookie banner is not a legal requirement in its own right. What the rules require, in much of the world, is that you ask before your site starts measuring or marketing to a visitor — and that you can show what they answered. A banner is simply the usual way of doing both.

So the question is not really "do I have a banner?" It is "does anything on my site start tracking before a visitor has said yes?" On a typical WordPress site with analytics, an ad pixel, or embedded videos, the answer is yes. That is worth fixing, and it is also quick to fix.

The real problem: tracking before anyone is asked

Most tracking tools are built to load the moment a page opens:

• Google Analytics runs on page view and sets its cookies straight away.
• Meta Pixel fires its PageView event on load and sets the _fbp cookie, whether or not the visitor ever interacts with your site.
• A YouTube video embedded the standard way contacts YouTube and can set cookies as the page loads — before anyone presses play.

None of these wait for permission, because nobody told them to. If your site has no consent step, every visitor is measured from the first second. A visitor who would have said no never gets the chance, and you hold data you never actually asked for.

Check your own site in 60 seconds

You do not need a scanner or an account. Your browser will tell you:

1. Open your site in a private (incognito) window, so no earlier choice of yours is saved.
2. Before you click anything, open the browser's developer tools (F12, or right-click → Inspect) and go to the Application tab → Cookies → your site. (In Firefox this is under Storage.)
3. Reload the page. Still do not click anything.
4. Look at the cookies that are already there. Names like _ga (Google Analytics), _fbp (Meta), _gcl_au (Google Ads) or VISITOR_INFO1_LIVE (YouTube) mean those tools started before any visitor could agree or refuse.

If the list is empty apart from anything your site needs to function — a login or a shopping basket, for example — you are in good shape. If the marketing and analytics cookies are already set, that is the gap a proper consent setup closes.

What the rules are aimed at

This page is general information, not legal advice, and the detail varies by country. The broad picture:

Europe and the UK: ask first

Under the ePrivacy rules and the GDPR, cookies that are not strictly necessary — analytics and marketing included — need the visitor's consent before they are set. Tracking someone first and asking later is the thing itself, banner or no banner. Will a small site be fined? Large fines make the news and are aimed at large companies; for a small site, enforcement usually starts with a complaint — from a visitor, a competitor, or one of the privacy groups that have filed complaints against large numbers of ordinary websites over exactly this. A complaint still means letters, deadlines, and time you did not plan to spend.

The platforms have their own rules

The more immediate pressure is practical. Google requires consent signals (Consent Mode) from visitors in the European Economic Area for advertising features like personalised ads and remarketing, and Meta applies similar requirements to its tools. Send traffic from Europe without those signals and parts of your advertising quietly stop working as intended — no warning letter, just worse results.

The United States: an opt-out model

Most US state privacy laws, California's included, are built on notice and opt-out rather than asking first: visitors must be told what is collected and given a working way to refuse the sale or sharing of their data, and in several states you must honour the Global Privacy Control signal a visitor's browser sends. A consent banner is one reasonable way to cover this, and visitors increasingly expect one.

And the everyday risk: trust

Agencies are asked about consent by their clients; clients are asked by theirs. "Our site tracks people before asking" is an awkward sentence in any of those conversations. Being able to show a banner that genuinely blocks, plus a log of what visitors chose, ends the discussion.

What "good" looks like

A consent setup that actually does the job has five parts:

• It blocks first. Analytics, pixels and embeds stay off until the visitor answers — not merely greyed out, off.
• The choice is fair. Reject is as easy to find and press as Accept, and both look the same.
• It is written in plain language. Visitors can tell what each category does without a law degree.
• It keeps a record. When each choice was made and what was allowed, so you can show it later.
• Minds can change. A visitor can reopen their preferences at any time, and tools switch off again if they do.

The five-minute fix

On WordPress, closing the gap is mostly a matter of installing a plugin that does the blocking for you:

1. Download the free TidyConsent plugin and install it under Plugins → Add New → Upload Plugin.
2. From the first page view, the tools it recognises are held back until each visitor chooses. Style the banner to match your site, with a live preview.
3. Publish the cookie policy page it drafts from the tools found on your site, and keep the consent log as your record.

The free plugin includes the banner, the blocking, Google Consent Mode v2, the policy page and the log. Pro is a flat $49/year — no pageview meter — and adds a weekly re-scan that emails you when a new tracker appears on your site, plus a hosted backup of your consent log.

Nothing on this page is legal advice. If your situation is complicated — health, finance, children, or large-scale advertising — a short conversation with a lawyer who knows privacy law is money well spent.