Why we wrote a cookie guide for companies entering Europe
Today we publish "Europe starts on your website", our guide to cookies and consent for companies based outside Europe that sell, or plan to sell, to European customers, whether their site runs on Shopify, Webflow, Wix, Squarespace or WordPress, or was custom-built.
Europe is often the first foreign market a growing company opens, and the website is the first thing it touches there. It is also where the first mistake happens. In most of the world, a site sets its cookies and lets the visitor object afterward. In Europe, the site has to ask first, for every cookie that is not needed to deliver the service, and the rule applies to your company even without an office in Europe, as soon as your site sells to Europeans, ships to them or speaks their language. The French regulator fined Google 100 million euros and Amazon 35 million euros in 2020 for cookies set without consent, and Google another 325 million euros in 2025. Those are very large companies, but the rule they broke is the same one your site meets on its first European order.
Most of what you can read on the subject comes from law firms, who explain the rule, or from banner vendors, who explain their product. Neither tells you what to do with the site you already have. We are a product engineering studio based in France, so we build sites under these rules every day, and this guide is the one we hand to clients arriving from abroad.
A banner is not compliance
Chances are your site already shows a cookie banner, because a plugin or your platform added one. In Europe, that banner is judged on one thing, whether optional cookies wait for the visitor's agreement. The most common failure we see is a banner that displays correctly and blocks nothing. It was configured at launch for the tools known at the time, then a campaign brought a pixel, a page gained a video and support added a chat widget, and none of them were connected to it. The banner records the visitor's choice while the tools set their cookies anyway, and the cookie policy written at launch describes a site that no longer exists. Nothing on the screen signals any of this, so the gap stays invisible until a regulator, a customer or a partner's due diligence points it out.
You can find it first, and three questions tell you where to look. Which tools run on your site, and which ones still earn their place? Does your banner hold them back until the visitor agrees? Does your cookie policy describe what the site actually does? The answers change with every tool you add, so the questions are worth asking again each time. The guide answers all three for a company whose visitors live inside and outside Europe, and it does so from your site rather than from the legal texts.
What you will be able to do after reading it
You will be able to check your own site in about ten minutes, without installing anything. Chrome already shows which cookies are set and which services your pages contact, and the guide tells you what to look at, at which moment, and what each finding means. If you would rather not open the developer tools, it gives you the same check as a prompt for your AI assistant. The screenshots come from a demo site we built to reproduce the gaps we find most often.
You will be able to decide, with your numbers in mind, whether to show the European banner to everyone or only to European visitors. The first option is simpler and leaves no gap, the second protects your home traffic but relies on geolocation and its errors, and several consent managers combine both, with consent first for Europe and your own market's rule elsewhere. The guide also compares six countries that companies usually enter first, France, Germany, the United Kingdom, the Netherlands, Ireland and Spain, on what each regulator expects of a banner, and it shows the single configuration that satisfies all six.
You will be able to choose a tool knowing what it actually does. Twelve consent managers, from the banners built into the platforms to subscription services and open-source tools, are placed on one matrix by installation effort and by their ability to block scripts and keep proof of consent, with prices in dollars and geotargeting flagged where it is offered. For each platform, the guide then separates what you can fix yourself from the admin interface from what calls for a developer.
The guide takes about an hour to read. It starts with what a cookie is and ends with the fixes available on your platform, with a plain summary of the European rule in between.
Frequently asked questions
Answers to the questions we hear most often on this topic.
Does the European cookie rule apply to my company if I have no office in Europe?
Yes, as soon as your site addresses European visitors, for example by selling to them, shipping to them or translating its pages for them. GDPR applies to companies outside the Union that offer goods or services to people in the Union or monitor their behavior, and some national cookie laws, such as Germany's, are just as broad. Enforcement against a small business with no European presence is harder in practice, but the rule itself applies.
Can I show the consent banner only to European visitors?
Yes. Most consent managers can show the European banner only to visitors located in Europe, usually in their paid plans, and Shopify offers it by default. Geolocation is an estimate, so a European visitor on a VPN or a company network can be placed outside Europe and tracked without consent. If you take this route, cover the whole European Economic Area, the United Kingdom and Switzerland rather than a short list of countries.
Is Google Analytics allowed without consent in Europe?
In its standard configuration, no. Google reuses the data for its own purposes, which rules out the exemption some countries grant to audience measurement. A tool set up for that exemption, such as Matomo or PostHog in cookieless mode, can measure traffic without consent in several countries, including France and the Netherlands. In Germany, Ireland and Spain, even analytics generally require consent.
Does Google Consent Mode make my site compliant?
No. Consent Mode passes the visitor's choice to Google's tools, but it does not stop them from loading. In its advanced mode, it even sends data to Google before any answer and after a refusal. Your banner still has to hold these tools back itself.
My US site already honors Global Privacy Control and has a "Do Not Sell or Share" link. Is that enough?
For your US visitors in the states that require it, that is what the law asks. For European visitors, it is not, because Europe requires consent before any optional cookie is set rather than a way to object afterward. A site that serves both markets either applies the European rule to everyone or runs two rules side by side in its consent manager.
Is the United Kingdom the same as the European Union?
Almost. The UK applies its own rules, which stay very close to the European ones. Since February 2026, cookies used only to produce statistics that improve a site no longer require consent there, as long as visitors are clearly informed and can easily object. Advertising cookies still require consent, as they do everywhere in Europe.
Which consent managers does the guide compare?
The banners built into Shopify, Wix and Squarespace, the subscription services Cookiebot, CookieYes, Termly, iubenda and Complianz, and the open-source tools tarteaucitron, vanilla-cookieconsent, Klaro and c15t. Each one is placed on a matrix by installation effort and by its ability to block scripts and keep proof of consent.
Is the guide free?
Yes. It is sent to you by email after the download form.
