Cookie Banner Panic

A friendly warning

A while back I got an email from a reader in Germany. It was kind, not angry. She’d found my design blog, enjoyed a post about colour palettes, and then asked whether my site used cookies and, if so, where the notice was. She couldn’t find anything about privacy.

I didn’t know. I honestly didn’t know whether my own site used cookies at all. My stomach dropped a little. I build websites for other people, and here I was unable to answer a simple question about my own.

I’d built my portfolio and blog myself, with a theme I’d tweaked and plenty of hand-written code. Over two years I’d clicked Add on quite a few helpful-looking extras. Each one took seconds. Nothing ever asked me a question back.

I’m telling you this because I was a person who had to find out the hard way, and I remember exactly how the not-knowing felt.

The first evening I did nothing but read, and the second I made a list. By the third I was less frightened and more curious, which I recommend as a sequence for anyone in the same spot.

What was actually happening

I decided to find out, not guess. I opened my site in a fresh browser window and used the built-in developer tools to look at what loaded. I also made a list of everything I’d ever added.

The list was longer than I expected. Analytics, because I’d wanted to see which posts people read. An embedded video player. A social sharing button. A newsletter form from an email service. A font loaded from an outside library. A chat widget I’d tried once and forgotten.

Each of those could set cookies or send information to another company. I’d never thought of my plain little site as a place where data travelled. But it was. Every embed was a small door to somewhere else.

I’d also grabbed a free banner plugin months earlier. It showed a pretty message saying “We use cookies” with an Accept button. When I tested it, the analytics ran anyway, before anyone clicked anything. The banner looked right and did nothing. As a designer, that one stung, because I’d chosen it for how it looked.

There’s a particular kind of dread that comes from discovering your own website knows things you don’t. I sat there with my tea going cold, wondering whether I’d been doing something wrong for years.

I reminded myself that I hadn’t set out to collect anything. I’d simply added useful things one at a time, and none of them came with a label that said, this sends information elsewhere.

What surprised me most was how ordinary all of it was. None of these tools were sinister. They were the same helpful extras I’d recommended to clients, and I’d never stopped to ask what they did once the page loaded.

Cleaning up

I started by removing things I didn’t need. The chat widget went. The sharing buttons went. I swapped the embedded video for a simple link. That alone shrank the list by half.

For what remained, I wrote a privacy page in plain words. What I collect, why, who else gets it, and how to contact me. I chose an analytics tool that’s built to work without tracking individuals, which let me simplify the notice. And I replaced the decorative banner with one that actually blocks the optional tools until a visitor agrees.

I’m not a lawyer, and I know where my knowledge stops. For the legal details I booked a short session with someone who does this for a living, who checked my page and my setup. It cost less than I feared and let me sleep.

I learned that an honest banner is really a small switch panel. Necessary things run all the time. Optional things, such as analytics and marketing tools, wait until someone says yes. If the banner doesn’t do that, it’s decoration.

I also decided to keep my choices simple from then on, and I pass the habit on to every client now. Before I add anything new to a site, I ask three questions. Do I really need it? What does it send, and to whom? Could I do without it? Half the time, the answer to the last one is yes.

I wrote back to my reader in Germany and thanked her. She’s now one of my regulars.

A few things I’d tell you

• List what your site uses. Analytics, embeds, forms, fonts and widgets all count.
• Test your banner. Check that optional tools really wait for a yes.
• Remove what you don’t need. Less collected means less to explain.
• Write a plain privacy page. Say what you collect, why and how to reach you.
• Ask a professional for legal specifics. Rules differ by place, and it’s worth getting it checked.

If you’ve just had your own polite email from a stranger, take a breath. It’s very fixable, and you’re not the first.