In short. The banner is mandatory only if the site uses profiling cookies or other non-technical tracking tools (guidelines of the Italian Data Protection Authority — the Garante — of 10 June 2021). With technical cookies only — or with no cookies at all — a notice is enough: no banner, no consent. Where the banner is needed, it must follow precise rules: no tracking before the user has chosen, an “X” that closes the banner without accepting, controls of equal prominence, no pre-ticked boxes. Scrolling does not count as consent.
The cookie banner has become a conditioned reflex: sites have one because everyone has one. But consent — and with it the banner — is due only in specific cases. Putting a banner where it is not needed weighs the site down and trains the user to give a purely formal assent; leaving it out where it is required is an infringement. This guide answers two questions: when the banner is mandatory and how it must be built.
What the Authority’s guidelines provide
The reference text is the Guidelines on cookies and other tracking tools, adopted by the Italian Data Protection Authority (Garante) on 10 June 2021 (decision no. 231, web doc. no. 9677876, published in the Italian Official Gazette no. 163 of 9 July 2021). They are based on Article 122 of the Italian Privacy Code (Legislative Decree no. 196/2003), the Italian provision corresponding to Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive): storing information on the user’s device, or accessing information already stored there, requires consent, except for strictly necessary technical operations. The guidelines distinguish two categories:
- technical cookies — they serve to make the site work or to provide a service requested by the user: they do not require consent, a notice is enough;
- profiling cookies and other tracking tools — they reconstruct the user’s preferences and behaviour: they require free, informed and demonstrable consent. This is where the banner becomes mandatory.
The underlying rule: first reduce tracking, then think about the banner. Often, once tracking has been reduced, the banner is no longer needed.
Which case your site falls into
| What the site uses | Is a banner needed? | What to do |
|---|---|---|
| No cookies, or technical cookies only (session, shopping cart, chosen language) | No | Notice in the cookie policy or in the general privacy notice |
| Aggregated statistics on a single site, with masked IP address and no cross-referencing with other data | No | Notice; check how the tool is actually configured |
| Third-party statistics services without these safeguards | Yes | Activate them only after consent |
| Social-network pixels, remarketing, behavioural advertising | Yes | Prior blocking and specific consent |
| Embedded videos, maps and widgets that carry third-party tracking | Yes | Load the content only after consent, or choose a mode without tracking |
| Access to the site reserved for those who accept cookies (cookie wall) | The banner is not enough | Unlawful mechanism, unless equivalent content or an equivalent service is offered without consent |
The boundary between technical and non-technical cookies — statistics included — deserves a discussion of its own: it is covered in the separate insight on technical cookies and when the banner is not needed.
When the banner is not required
Where there are only technical cookies
A showcase site that uses only technical cookies — for example to remember the chosen language — can limit itself to the notice. The guidelines say so expressly: if only technical cookies are present, information about them can be given on the home page or in the general privacy notice, with no banner for the user to close.
Where there are no cookies
Then there is the more radical option: using no cookies at all. The site you are reading works this way — fonts hosted locally, no third-party analytics services, no pixels — which is why no banner has appeared.
When, instead, it is mandatory
Profiling and marketing purposes
Behavioural advertising, remarketing and social-network pixels require prior consent: without an explicit yes from the user, they must not be activated.
Third-party tools
Even apparently harmless services — embedded videos, maps, statistics systems — can carry third-party tracking with them. Analytics services are treated as technical cookies only under strict conditions: aggregated data, masked IP address, no cross-referencing with other information.
How the banner must be built
Where the banner is needed, the guidelines set its minimum content. The starting point is the default setting: on the first visit, no cookies or tools other than technical ones are to be placed on the user’s device. The banner must then be large enough to create a perceptible break in the browsing experience and must contain:
- an “X” control at the top right, which closes the banner leaving the default settings in place: browsing continues without cookies other than technical ones;
- the warning that closing with the “X” has precisely this effect;
- a short notice: the site uses technical cookies and, only with consent, profiling cookies or other tracking tools, with an indication of the purposes;
- the link to the privacy policy or to an extended notice;
- a control to accept all cookies;
- the link to a dedicated area where functionalities, third parties and cookies can be selected individually.
Three rules complete the picture. The “X” must have the same graphic prominence as the other controls and, more generally, controls and fonts of equal size, emphasis and colour must be used: no “Accept” in the foreground with the refusal hidden away. The user must be able to change their mind at any time, in a simple way, from an area reachable through a link in the site footer. Finally, access to the site cannot depend on the acceptance of cookies: the cookie wall is unlawful, except in the case — to be assessed case by case — where the controller offers equivalent content or an equivalent service without asking for consent.
The most common mistakes
- Scrolling as consent. Scrolling the page is not, by itself, valid consent.
- No way to refuse. Refusing, or continuing without accepting, must be possible and as easy as accepting.
- Pre-ticked boxes. Consent requires a positive action: boxes that are already ticked do not count.
- The banner that comes back on every visit. Once expressed, the choice must be recorded and not requested again shortly afterwards. The banner is shown again only if the conditions of the processing change significantly, if the site cannot know whether a cookie has already been stored on the device, or after at least six months.
Practical guidance
- Take stock of the cookies and scripts actually present on the site, including those loaded by plugins, videos and maps.
- Remove what is not used: less tracking, fewer obligations.
- If only technical cookies remain, take care of the notice and stop there.
- If profiling remains, set up a compliant banner: “X” and controls of equal prominence, granular choices, tracking blocked until consent, a record of the choices made.
- Check the result: open the site in a private browsing window and verify that, before any click and after closing with the “X”, only technical cookies are present.
- Repeat the check at every change to the site: a new plugin, a pixel or an embedded video is enough to change the picture.
The rules on cookies, ultimately, do not come down to putting up a banner: they are a conscious choice about the data to process and the tools to use.
What the case law says
The essential reference remains the one already mentioned: the Guidelines on cookies and other tracking tools, adopted by the Italian Data Protection Authority (Garante) on 10 June 2021. That is where the rules seen so far have their basis: scrolling, by itself, is not valid consent; refusing must be possible and as easy as accepting; pre-ticked boxes do not count, because consent requires a positive action; once the choice has been recorded, the banner is not shown again before six months, unless the conditions of the processing change significantly or the site cannot know whether a cookie has already been stored on the device.
The “most common mistakes” are therefore not mere design flaws: they are departures from the Authority’s instructions. And the Garante raises them against small sites too. This is shown by two decisions of 2025, which originated from checks on e-commerce sites carried out by the Special Unit for Privacy Protection and Technological Fraud of the Guardia di Finanza (the Italian financial police):
- Decision no. 99 of 27 February 2025 (web doc. no. 10118246). The site of a sole proprietorship displayed a banner with only an “OK” button and a statement that closing the banner, scrolling the page or clicking on any element amounted to acceptance. There was no way to refuse and no granular choices, and the banner reappeared on every visit. Outcome: a reprimand, with no administrative fine, also because the controller had in the meantime corrected the banner.
- Decision no. 327 of 4 June 2025 (web doc. no. 10152729). A company’s banner had the controls “X”, “Find out more” and “Accept all”, but after a click on the “X” it reappeared on every subsequent visit: an insistence which, in the Garante’s view, may influence the data subject’s will. The cookie policy, moreover, referred to repealed provisions and did not indicate the recipients of the data. Outcome: an order to bring the banner and the notice into compliance and a reprimand, with no administrative fine.
In both cases the Garante found infringements of Articles 4(11), 5, 7, 12, 13, 24 and 25 of the GDPR and of Article 122 of the Italian Privacy Code. The mild outcome should not mislead: Article 166(2) of the Italian Privacy Code makes the infringement of Article 122 subject to the fine provided for in Article 83(5) of the GDPR, which goes up to EUR 20 million or, for undertakings, 4% of the total worldwide annual turnover.
For the judgments of the Court of Justice on consent, the other decisions of the Garante and the 2026 developments on tracking pixels in emails, we refer to the insight on technical cookies.
Verifying what a site actually installs and aligning the banner and the notice is documentary work that falls within GDPR and privacy advice. It is the same approach that guides the site’s other privacy obligations — from the privacy policy to the record of processing activities — and, more generally, GDPR compliance.
Frequently asked questions
Does every website need a cookie banner? No: the banner is needed only if the site uses non-technical cookies or tracking tools — non-anonymised analytics, profiling, third-party components. A site with technical cookies only just needs the notice, with no banner.
Does Google Analytics require a banner? As a rule, yes: it is treated as a technical tool only with the measures indicated by the Garante (including masking of the IP address and no cross-referencing with other data), and the assessment must be made case by case.
Does scrolling count as consent to cookies? No: under the Garante’s guidelines, scrolling the page is not, by itself, valid consent; clear and equivalent controls for accepting and for refusing are needed.
Is a “Reject” button strictly necessary? The guidelines require a control — the “X” at the top right, with the same graphic prominence as the others — that closes the banner while keeping the default settings, that is, without non-technical cookies. Many sites add a “Reject” button: that is fine, provided that refusal remains possible directly from the banner, without going through other pages, and is as easy as acceptance.
What are the risks of a non-compliant banner? The infringement of Article 122 of the Italian Privacy Code is punished with the fine provided for in Article 83(5) of the GDPR: up to EUR 20 million or, for undertakings, 4% of the total worldwide annual turnover. In the two 2025 decisions mentioned above the Garante stopped at a reprimand and an order to comply, but the outcome depends on the specific case.
Is a register of cookie preferences mandatory? Rather than a register in the formal sense, the guidelines require the user’s choice — including where the user refuses or accepts only in part — to be “duly recorded”, so that the banner is not shown again and consent can be documented. Keeping an orderly record of the choices is the practical way to do this: we discuss it in the insight on technical cookies.
This article is for information purposes and reflects the rules in force at the date of publication; it does not replace an assessment of the specific case.
This article is for general information only and is not legal advice on any specific case. Content reviewed by Giuseppe Foti, legal consultant — last checked on September 30, 2026.