What are cookies, and why does my site need a banner?

A cookie is a small note a website leaves in the visitor's browser so it can recognise them later. That's it. It isn't a program, it can't read your visitor's files, and most of the time it's doing something dull and useful — remembering that someone is signed in, or that they already chose about cookies and don't want asking again.

The reason cookies come with rules is that some of those notes are used to watch people rather than serve them. The law doesn't try to separate good notes from bad ones by intent — it separates them by whether the site could work without them.

The three kinds, in plain words

• Essential. The site can't do its job without them: staying signed in, keeping a basket together, remembering someone's cookie choice. Nobody has to be asked about these, because the visitor asked for the thing they make possible.
• Analytics. Counting and understanding visits — how many people came, which pages they read, roughly where they came from. Useful to you, invisible to them, and entirely optional as far as they're concerned. So they get to choose.
• Advertising. Following people around other sites to show them ads later. This is the kind everyone actually resents, and the kind that needs the clearest yes. Most small sites have none of it, and yours has none unless you deliberately add it.

Essential runs. Optional gets asked. That single line is the whole of cookie law as it touches a small business.

Why the asking has to be a real choice

The rule underneath the banner isn't "show a banner" — it's the visitor decides, and saying no has to be as easy as saying yes. That's why your site's banner puts refusing and accepting side by side, in the same size and weight, rather than burying "no" behind a settings link. It's also why nothing optional starts running while the visitor is still deciding: a choice you've already overridden isn't a choice.

How that plays out on your own site — when it appears, what visitors see, how long their answer is remembered — is in How does the cookie banner on my site work?.

What this means for you, honestly

Nobody is coming for you. The banner is not a legal shield you're buying; it's the ordinary courtesy of telling people what's happening on your site and letting them decline. It costs you a small slice of your visitor numbers and buys you a site you never have to feel shifty about.

The practical version is short:

• If nothing optional runs on your site, there's no banner and nothing to think about.
• If something does, the banner appears by itself and handles the asking.
• If you want to know exactly what's running, that's What's tracking my visitors on my site?.
• If you want the direct answer to "do I actually need this", it's Do I need a cookie banner (and a privacy policy)?.

One thing that trips people up: asking visitors about cookies is a different question from having permission to email someone. Same word, different law, different record — email permission is covered in When do I need someone's permission to email them?.

And for what bernard itself does with your data, rather than your visitors', see What does bernard do with my data, and is it GDPR-compliant?.