A cookie is, at its core, nothing more than a small text file that a website stores in a visitor's browser and reads back on every later visit. On its own, that's technically harmless — without this mechanism, no shopping cart would remember what's in it, and no login would survive from one page to the next. In that role, cookies are simply the web's memory.
The problem starts once a cookie stops carrying just your own session and instead makes you recognizable across time and across different websites. An ad network that sets the same cookie on hundreds of sites can build a movement profile from that alone — which pages someone visits, how often, when. This happens invisibly: nothing about the page itself reveals that a dozen such cookies are being set in the background.
That is exactly where the European rule that gave rise to cookie banners comes in: anyone who stores something on a user's device, or reads something from it, that isn't strictly necessary for the function the user actually asked for needs consent first. That holds regardless of whether personal data in the narrow sense is involved — merely accessing the device is enough to trigger the requirement. (Where this rule comes from — the so-called ePrivacy Directive — is the subject of the next post in this series.)
That leads to a distinction that runs through every properly built cookie banner: necessary cookies on one side — shopping cart, login session, security functions, without which a site simply wouldn't work — and everything else on the other: analytics, personalisation, advertising. The first group needs no consent, because lawmakers treat it as a precondition of the service actually requested. The second group does.
A cookie banner is, at bottom, nothing more than the practical implementation of that distinction: it shows a visitor what a site intends to do beyond the strictly necessary, and collects a conscious decision about that before any of it takes effect — not afterwards, beforehand. A banner that only appears on the second page load, while a tracking script has already fired in the background, doesn't fulfil its purpose no matter how polished it looks.
That also makes a cookie banner more than just a display. It has to be able to prove that consent was genuinely given — when, by whom (or by which browser), for exactly what, and that withdrawing it is just as easy as giving it in the first place. That burden of proof falls on the website operator, not the visitor: in a dispute, the operator has to show a valid consent existed, not the user prove they never gave one.
That's exactly why cookie banners look the way they do today: with a genuine reject option equal in weight to accepting, with a breakdown by category instead of a single blanket yes, and with a log running in the background that records precisely what happened. None of that is accidental or excessive formality — it's the direct consequence of a single underlying rule: access to someone else's device requires real, informed, active consent. Everything else builds on that one rule, and the rest of this series traces its origins through European and German law in detail.