Cookie consent for UK and EU visitors: hold trackers back until people say yes

The rules in short

UK (PECR, guidance from the ICO):

• "Storage and access technologies are only set when valid consent is gathered, or when they meet an exception." "Silence or inactivity doesn't qualify" as consent.
• The ICO's checklist: "Our consent mechanism makes it as easy to refuse consent as it is to accept." A banner with "Accept all" and no "Reject all" is its bad-practice example.
• Good practice: toggles for non-exempt technologies "turned off by default".
• The statistical purposes exception covers analytics used only to improve your own site or service, with "clear and comprehensive information" and a "simple and free" way to object. A third-party analytics provider can be used if it acts only for you. It "does not apply to purposes related to online advertising."

EU (ePrivacy rules, summarized by the European Commission's Your Europe portal):

• "Some cookies require the consent of your users before you can use them."
• Strictly necessary cookies (logins, shopping baskets, load balancing) don't need consent.
• Advertising cookies and tracking used for analytics or market research do.
• Withdrawing consent must be as easy as giving it.

How to hold trackers back in a web app

The common mistake in AI-built apps is a banner component added alongside a Google Analytics or Meta Pixel snippet that still sits in index.html and runs on every load. Move the loading behind the choice:

<!-- index.html: no tracker snippets here -->

// consent.js
export function onConsent(choice) {
  localStorage.setItem("consent", JSON.stringify(choice));
  if (choice.analytics) loadScript("https://www.googletagmanager.com/gtag/js?id=G-XXXX");
  if (choice.ads) loadMetaPixel();
}

const saved = JSON.parse(localStorage.getItem("consent") || "null");
if (saved) onConsent(saved); else showBanner(); // nothing loads until a choice exists

Your banner then offers "Accept all", "Reject all" and "Settings" with equal weight, and a footer link such as "Cookie settings" reopens it so people can change their mind. Test this on a preview deployment before relying on it.

A consent management platform (CMP) can do the blocking and record each choice for you; the ICO notes a CMP "can enable you to accurately record what your users consent to".

These are plain-English starting points you can adapt; for anything specific to your business, a lawyer's quick review is worth it.

How to see it for yourself

Open your site in a private window, open the browser's developer tools on the Network tab, and load the homepage without clicking the banner. Requests to connect.facebook.net, analytics.tiktok.com or googletagmanager.com before your click mean the trackers aren't waiting.

What Pewterkit Check looks for

A free check reads your homepage's HTML and scripts for known trackers (Google Analytics, Google Tag Manager, Meta Pixel, TikTok, LinkedIn Insight, Hotjar, Microsoft Clarity, Segment, PostHog, Mixpanel) and for a consent tool. Advertising pixels with no consent tool in place are flagged first, because they need consent in both the UK and the EU. It doesn't click your banner, so when a consent tool is present it can't tell whether the trackers really wait; the Network-tab test above shows that.