LEG-002
A cookie notice that is honest about what you set
No third-party consent script. A dismissible banner, a stored choice, and ad code that only loads once consent exists.
Most cookie banners are theatre: they set the tracking cookies before the visitor answers, and the button only hides the banner. That is worse than no banner, because it documents that you knew.
An honest version does two things. It does not load anything non-essential until a choice is made, and it stores that choice somewhere it can be changed later.
For a site whose only non-essential cookies come from ad networks, that means holding the ad code until consent, which has a real revenue cost. Whether you accept that cost depends on where your visitors are.
function cookie_consent_state(): string
{
$c = $_COOKIE['consent'] ?? '';
return in_array($c, ['all', 'essential'], true) ? $c : 'unset';
}
function may_load_ads(): bool
{
if (!setting_bool('consent_required', false)) {
return true; // operator's call, per jurisdiction
}
return cookie_consent_state() === 'all';
}
// consent.php — the endpoint the banner posts to
function store_consent(string $choice): void
{
$choice = $choice === 'all' ? 'all' : 'essential';
setcookie('consent', $choice, [
'expires' => time() + 180 * 86400,
'path' => '/',
'httponly' => false, // readable by the banner script
'secure' => ($_SERVER['HTTPS'] ?? '') !== '',
'samesite' => 'Lax',
]);
}
// In the template — the ad slot simply does not render without consent.
// <?php if (may_load_ads()) { echo ad('header'); } ?>
//
// <?php if (cookie_consent_state() === 'unset' && setting_bool('consent_required')): ?>
// <div class="consent">
// <p>This site sets cookies for advertising. Nothing on the site is gated either way.</p>
// <form method="post" action="/consent.php">
// <button name="choice" value="all">Accept</button>
// <button name="choice" value="essential">Essential only</button>
// </form>
// </div>
// <?php endif; ?>Using it
Make the reject button as easy to press as the accept button. A hidden reject is what regulators specifically object to.
Provide a way to change the choice later — a link in the footer is enough.
Keep the copy short and specific. "We set cookies for advertising" beats three paragraphs about your commitment to privacy.
What bites people
A banner that loads trackers before the click is worse than nothing. The whole value is in the ad code not running.
A session cookie for logins is essential and needs no consent. Do not gate your own site's function behind the banner.
Requirements differ by jurisdiction and change. Make it a setting rather than a decision baked into the code.