Cookie Consent Banner Generator
Build a GDPR-ready cookie consent banner and get clean, copy-paste HTML, CSS, and JavaScript. Customize position, colors, text, and cookie categories (necessary, analytics, marketing, functional), preview it live, and pick from 4 languages. The generated code stores consent in the browser and fires a cookieconsent event you hook into to load your analytics or ads scripts only after opt-in. Free, no signup.
How to Use This Tool
- Customize colors and position — pick a position, set your brand colors, and choose the banner language.
- Set text and categories — edit the headline, body, and buttons, and toggle which cookie categories to offer.
- Preview the banner — see it live in the mock browser and open the preferences dialog.
- Copy HTML, CSS, JS and add to your site — paste the code before </body> and load your analytics/ads scripts only after consent.
About Cookie Consent Banners
A cookie consent banner is the small notice that appears when someone lands on your site, telling them which cookies and trackers you use and giving them a real choice. Under the EU GDPR and the ePrivacy rules, a compliant banner has to be clear, name the categories of cookies you set, and let visitors accept or reject non-essential ones with equal ease. Under California's CCPA and CPRA, the focus shifts to disclosure and an easy way to opt out of the sale or sharing of data. A workable banner usually offers accept, reject, and preferences options, plus a link to your full cookie or privacy policy.
Timing is where many banners go wrong. GDPR expects prior consent, which means non-essential cookies such as analytics and advertising should not load until the visitor has actively agreed. Implied consent, where you assume agreement because someone kept scrolling or simply saw the notice, is no longer accepted under EU guidance and rulings. Pre-ticked boxes and cookie walls that force acceptance are also treated as invalid. A compliant flow blocks non-essential scripts by default, records the choice only after a clear action, and makes rejecting as simple as accepting. Essential cookies that are strictly needed to run the site are the narrow exception and do not require consent.
Category toggles are how you turn consent into something granular and honest. Rather than a single accept button, you group cookies by purpose so visitors can switch each group on or off. The common categories are strictly necessary, which stays on because the site cannot function without it, then preferences or functional, analytics or statistics, and marketing or advertising. Each toggle should map to the scripts it controls, so turning off analytics actually stops the analytics tag from firing. This generator lets you label and enable the categories you use, then reflects those choices in the exported code. Clear categories help visitors decide quickly and give you a defensible record of what they agreed to.
Once a visitor makes a choice, you need to remember it so the banner does not reappear on every page and so your scripts know what is allowed. This generator saves the decision in the browser's localStorage, recording which categories were accepted and when. Because localStorage lives on the visitor's own device, nothing is sent to a server, and the banner reads it on the next visit to restore saved preferences. Storing a timestamp also lets you re-ask for consent after a sensible period rather than assuming it lasts forever. If a visitor changes their mind, a preferences link should let them reopen the banner and update or withdraw consent at any time.
Everything this tool produces is a starting template, not legal advice or a certified compliance solution. It runs entirely in your browser and gives you copy-paste HTML, CSS, and JavaScript with the position, colors, wording, and category toggles you chose, plus localStorage persistence and four UI languages. You still need to wire each toggle to your real scripts, confirm your cookie inventory, and match the text to how your site behaves, ideally with your own legal review. A banner is one piece of a healthy site, and it works best when the surrounding build is solid. Empro IT's Website Development team can implement your reviewed banner, connect it to your tags, and keep consent handling correct as rules change.
Pair this with our Privacy Policy Generator and Terms of Service Generator, and check your security response headers with the HTTP Header Checker.
Frequently Asked Questions
Do I actually need a cookie banner?
You likely need one if your site sets any cookies or trackers beyond the strictly necessary. In the EU and UK, the ePrivacy rules and GDPR mean that analytics, advertising, and most embedded content require consent before they run, which in practice calls for a banner. If your audience is only in the United States, the rules are lighter, but California's CCPA still expects clear disclosure and an opt-out for the sale or sharing of data. Even where the law is unsettled, ad and analytics platforms such as Google increasingly require a consent mechanism to keep using their tools. If in doubt, check which trackers your site loads and where your visitors are based.
What are the GDPR requirements for cookies?
Under GDPR and the ePrivacy Directive, consent for non-essential cookies must be freely given, specific, informed, and unambiguous. In practice that means telling visitors which categories of cookies you use and why, before those cookies load, and letting them accept or reject each non-essential category with equal ease. Pre-ticked boxes, cookie walls that force acceptance, and assuming consent from continued browsing are not valid. You must also make it as easy to withdraw consent later as it was to give it, and keep some record of what each visitor chose. Strictly necessary cookies that are essential to deliver the service are the exception and do not need consent.
How is CCPA different for cookies?
The CCPA, as amended by the CPRA, works differently from GDPR. It does not require opt-in consent before cookies load. Instead it focuses on transparency and giving California residents the right to opt out of the sale or sharing of their personal information, which can include data gathered through advertising and analytics cookies. Qualifying businesses are expected to disclose their data practices in a privacy notice and to offer a clear opt-out, often through a Do Not Sell or Share My Personal Information link and by honoring the Global Privacy Control browser signal. So a US-focused banner usually centers on notice and opt-out rather than blocking cookies up front.
What is the difference between implied and explicit consent?
Explicit consent means a visitor takes a clear, affirmative action to agree, such as clicking accept, before non-essential cookies run. Implied consent assumes agreement from something passive, like continuing to scroll, clicking into the site, or simply seeing a notice. Under GDPR and current EU guidance, implied consent is not valid for non-essential cookies, so the affirmative, explicit model is what you should build. That is why a compliant banner blocks tracking by default and waits for a real choice. Some US-focused approaches still rely on notice-and-continue models, but if any of your visitors are in the EU or UK, plan for explicit consent to stay on the safe side.
What do the cookie categories mean?
Cookies are usually grouped into four categories by purpose. Strictly necessary cookies keep the site working, handling things like logins, carts, and security, and they do not need consent. Preferences or functional cookies remember choices such as language or region. Analytics or statistics cookies measure how people use the site, often through tools like Google Analytics. Marketing or advertising cookies track visitors to build profiles and show targeted ads, and these are the most sensitive. A good banner lets visitors accept or reject each non-essential category on its own. Sorting your cookies into these groups before you publish makes both your banner and your cookie policy clearer and more accurate.
How do third-party cookies and consent work?
Third-party cookies are set by domains other than the one a visitor is on, typically by advertising networks, social widgets, embedded videos, and some analytics tools. Because they often follow users across sites, they carry more privacy risk and, under EU rules, generally need consent before they load. The practical challenge is that a third-party script can set its cookies the moment it runs, so real consent means holding that script back until the visitor agrees, not just hiding a banner. When you wire category toggles to your tags, make sure third-party scripts are gated behind the matching category. Listing these providers in your cookie policy is also expected.
Should I store consent in localStorage or a cookie?
Both localStorage and a first-party cookie can remember a visitor's choice, and each has trade-offs. localStorage is simple, holds more data, and is not sent with every network request, which makes it a clean fit for a client-side banner like the one this tool generates. A cookie, by contrast, is sent to your server automatically, so it is useful when the server itself needs to know the consent state, for example to decide what to render. localStorage is limited to one origin and is not shared across subdomains, while a cookie can be scoped to a whole domain. For many static sites, localStorage is enough; server-driven setups often prefer a consent cookie.
How long should cookie consent last before I re-ask?
Consent does not last forever, and re-asking periodically is good practice. There is no single legal number, but several EU regulators suggest revisiting consent around every six to twelve months, and many sites settle on a six-month or one-year window. Storing a timestamp alongside the choice, as this tool does, lets your banner check the age of the consent and prompt again once it has expired. You should also re-ask sooner if your cookies change materially, such as adding a new advertising partner. Between expiries, always give visitors a way to reopen the banner and change or withdraw consent, since the right to withdraw must stay available at any time.