The cookie banner has become a sort of conditioned reflex: it is adopted because everyone adopts it. Consent — and with it the banner — is, however, due only in specific cases. Setting it up where it isn’t needed needlessly weighs down the site and trains the user to give a purely formal assent; omitting it where it is required, conversely, amounts to a breach. It is therefore worth clarifying in which cases the banner is actually necessary.
What the Authority’s guidelines provide
The guidelines on cookies and other tracking tools, adopted by the Italian Data Protection Authority on 10 June 2021, distinguish two categories:
- technical cookies — intended for the operation of the site or the provision of a service requested by the user: they do not require consent, a notice being sufficient;
- profiling cookies and other tracking tools — aimed at reconstructing the user’s preferences and behaviour: they require free, informed and demonstrable consent. It is here that the banner becomes mandatory.
The basic rule: first reduce tracking and only then set up the banner. Often, after the reduction, the banner is no longer necessary.
When the banner is not required
Where there are only technical cookies
A showcase site that uses only technical cookies — for example to store the chosen language — can limit itself to the notice, without a banner or collection of consent.
Where there are no cookies
There is also the more radical option: not using any cookies at all. The site you are reading works this way — fonts hosted locally, no third-party analytics services, no pixels — which is why no banner has appeared.
When, instead, it is mandatory
Profiling and marketing purposes
Behavioural advertising, remarketing and social-network pixels are tools that presuppose prior consent: without the user’s explicit assent, they must not be activated.
Third-party tools
Even apparently harmless services — embedded videos, maps, statistics-gathering systems — can carry third-party tracking. Analytics services are treated as equivalent to technical cookies only under strict conditions: aggregated data, masked IP address, no cross-referencing with further information.
The most common mistakes
- Scrolling as a form of consent. A mere page scroll does not amount to valid consent.
- The absence of a way to refuse. Refusing consent or continuing without giving it must be possible and just as easy as accepting.
- Pre-ticked boxes. Consent is expressed through a positive action: boxes already ticked have no effect.
- Re-showing the banner on every visit. Once the choice has been expressed, it should not be requested again shortly afterwards: re-presenting it is justified only when the conditions change or after a reasonable interval (usually no less than six months).
Practical guidance
- Take stock of the cookies and scripts actually present on the site.
- Remove what is not used: less tracking means fewer obligations.
- Where only technical cookies remain, take care of the notice and stop there.
- Where profiling remains, set up a compliant banner: acceptance and refusal on an equal footing, granular choices, a record of consents.
The rules on cookies, ultimately, do not come down to placing a banner, but to a conscious choice about the data to process and the tools to use. It is the same approach that governs the site’s other privacy obligations — from the privacy policy to the record of processing activities — and that is the heart of the GDPR compliance of a website.
Frequently asked questions
Does every website need a cookie banner? No: a banner is required only where the site uses non-technical cookies or tracking tools — non-anonymised analytics, profiling, third-party components. A site with only technical cookies just needs the notice, with no banner.
Does Google Analytics require a banner? As a rule yes: it can be treated as a technical tool only where the measures indicated by the Italian Authority are in place (including IP masking and no cross-referencing with other data), and the assessment must be made case by case.
Does scrolling count as consent to cookies? No: under the Italian Authority’s guidelines, scrolling alone is not valid consent; clear and equivalent accept and refuse buttons are required.
This article is for information purposes and reflects the rules in force at the date of publication; it does not replace an assessment of the specific case.
This article is for general information only and is not legal advice on any specific case. Content reviewed by Giuseppe Foti, legal consultant — last checked on June 11, 2026.