KG-SCRIPTS / BLOG
25 July 2026
4 min read
A practical guide for small and medium businesses: how to collect cookie consent in compliance with GDPR without compromising user experience.
Almost every modern website uses cookies – for basic functionality, analytics, marketing, or personalisation. If you have visitors from the European Union, the GDPR requires active and informed consent before non-essential cookies are loaded. For small and medium business owners this might sound like more red tape, but proper implementation not only avoids fines but also shows respect for customer data.
The regulation doesn’t ban cookies, but sets clear conditions:
This means that a passive “By using this site you agree to cookies” is no longer enough.
Before picking a technical solution, you need to know exactly what your site loads. Check:
Group them into categories:
This step gives you a clear picture of what to block before consent and what information to display in the banner.
You have two main approaches:
For most small and medium businesses, a CMP is the safer and more practical choice.
If you choose a CMP, integration typically involves adding a code snippet to the <head> of your site. Make sure to configure:
If you go custom, you must build the same elements with your own code, storing the user’s choice in a cookie.
This is the critical part. Once the user makes a choice, third-party scripts should load only if consent was granted for the relevant category. Common techniques include:
<script> elements after consent.type attribute from "text/plain" to "text/javascript".Ensure that strictly necessary cookies (e.g. session cookies) are set without waiting – the law allows this as long as you inform users correctly.
A link to it is often placed in the footer. From there, users can change their decision, review their current consent, and withdraw categories. The panel should work without a page reload and reflect changes immediately.
To demonstrate compliance, the system must record at least:
CMP platforms provide such an audit log. With a custom solution you must organise secure storage – for example in a database with regular backups.
After implementation, verify:
You can use browser developer tools or external cookie scanning services.
This isn’t a one-time task. Every time you add a new marketing tool or plugin, update the inventory and the banner configuration. Periodically check for regulation changes and update your cookie policy.
Proper consent management requires attention to detail, but it builds customer trust and avoids regulatory risk. If you need technical help with the implementation, KG-SCRIPTS can assist with development and integration of a solution tailored to your business.