Somewhere along the way, "add a cookie banner" turned into its own little industry. You see a pop-up asking you to accept cookies on basically every site now, and somewhere a SaaS company is charging $30 to $50 a month to bolt one onto yours. Before you sign up for that, it's worth asking the real question: do you need one?
The answer depends on which law you're worried about, because two different ones get lumped together and they don't work the same way. GDPR, the European rule, has no revenue floor at all. If your site sets non-essential cookies (Google Analytics, a Facebook pixel, an embedded YouTube video) and any visitor is in the EU or EEA, you're supposed to get consent before those cookies fire. Doesn't matter if you're a one-person shop in Ohio. A single visitor from Germany counts.
CCPA, California's law, is a different animal. It doesn't require a cookie banner at all, that's a GDPR habit people copied everywhere. What CCPA requires is a "Do Not Sell or Share My Personal Information" link, and only if you're selling or sharing data for targeted ads. It also only applies to businesses that clear a size bar: annual revenue just over $28 million in 2026 (it adjusts every year), or a business handling a large volume of Californians' data, or one that makes most of its money selling personal information. Most small business sites clear none of that.
Honest opinion: a lot of small businesses get sold cookie compliance software using CCPA as the scare, when GDPR is usually the one that touches them, if anything does. If your site is a local plumber's page that never sees European traffic and doesn't sell anyone's data, there's a real chance you don't need a banner at all. That's worth fifteen minutes of checking before you pay monthly for it.
The check itself is simple. Look at what's actually running on your site beyond the page content: analytics, an ad pixel, an embedded map or video pulling from someone else's server. Those are the non-essential cookies the rules care about. A contact form that emails you directly isn't one of them.
If you land on "yes, I need this," Cantrip has a cookie consent banner built into your website settings: your own text, your own button labels, a link to your privacy policy, a choice of banner or popup, top or bottom. It won't load tracking scripts until a visitor consents. Flip it on instead of adding another monthly subscription for something that's one setting away.
One honest limit: this isn't legal advice, and a banner isn't a substitute for a real privacy policy if your situation is more complicated than "small local business, a handful of tracking scripts." If you're genuinely unsure where you stand, that's a real conversation with a lawyer, not a guess from a blog post.