Cookies, for Non-Techy Website Owners
20 January 2026
A Digital Dispatch by Mads Mitchell, CiviCRM & Data Privacy Specialist
When most people hear “cookie policy”, or “cookie banner”, their eyes glaze over. It sounds like legal admin. Compliance or box-ticking, something you’re told you have to do, but no one really explains why.
And that’s part of the problem.
Everybody’s encountered a cookie banner, most organisations are aware that they should probably have one on their website, and quite a few are learning of the consequences of poor implementation.
TL;DR Blog Highlights
- Cookies aren’t just a legal annoyance they’re how websites recognise users, remember actions, and track behaviour.
- Cookie banners exist because many cookies collect or share extra data beyond what’s strictly necessary for a site to work.
- Cookies are only one type of tracking technology; pixels, scripts, link tracking and device fingerprinting also affect user privacy.
- Third-party tools (like analytics, maps, videos, and social embeds) often collect data too, and your organisation is responsible for that choice.
- Ethical, lawful cookie use means explaining clearly what’s happening, why it’s needed, and giving people a genuine choice.
But what do Cookies actually do, and why are they so important?
Cookies are files that websites are able to store directly on your device, containing information that it can use to identify you whenever you’re on that site.
This is how you stay logged in as you move between pages, how items stay in your shopping basket, and even how the site knows to keep a cookie banner pop-up closed once you’ve dismissed it. Put simply, the internet wouldn’t work without cookies.
So when a website owner asks you for your consent to use cookies, it’s generally because they want to store, collect and/or share additional information about your visit to their site, and how you use it.
To complicate things further, cookies are only one type of what the Information Commissioner’s Office calls ‘storage and access technologies’, which store and access information directly from a user’s device. Other common examples include:
- Tracking pixels – an image too small to see, but when present in a website or even an email, it can communicate to its owner where, when and how it is being loaded
- Link decoration – adding extra information to the end of an otherwise regular link, in order to trace the source or even the identity of the person clicking on it
- Scripts and tags – bits of code added to a website that will be run by the user’s browser. Typically used for initialising analytics tools, or sending requests and information to external services
- Device fingerprinting – accessing, storing or combining information about a user’s device in order to uniquely identify it.
With so many different ways to track what people are doing online, it’s no surprise that they come with some serious privacy implications.
What Actually Happens When Someone Visits Your Website
Modern websites commonly make use of tools that leverage cookies and other technologies to collect and analyse information about how visitors navigate and use a site. Often this is not just informed by user behaviour on your site, but across many other websites too.
Furthermore, it’s not just platforms like Google Analytics soaking up user information in the course of providing its services. Ever heard the saying, “if the product is free, you are the product”?
Any third party service used on a site will likely be collecting some sort of information about how it’s being used and by whom – including embedded videos hosted on YouTube or Vimeo, Google Maps, and any sort of handy widget or feed provided by a social media platform.
This doesn’t just give big tech companies the ability to collect, combine and infer huge amounts of information about pretty much everybody using the internet, it places the compliance burden on the organisations through whom they’re receiving the data.
Ethics Is About Intentional Digital Design
At Pooka, we work with charities, public bodies, and good-cause organisations who care deeply about people in the real world. For us, digital ethics isn’t about perfection or purity. It’s about intentionality. Asking questions like:
- Do we really need to use this service?
- Is there a less intrusive alternative?
- Are we defaulting to convenience, or choosing care?
Sometimes the answer is to use a third-party service but to do so transparently, thoughtfully, and with consent. Sometimes it’s to choose privacy-first tools that collect less data by design. Both are valid, as long as the decision is informed and honest.
How do we do that, and what happens if we don’t?
Unless your reason for storing or accessing information falls under one of five clearly defined exceptions, the Privacy and Electronic Communications Regulations (PECR) states that you must have consent before doing so.
Visitors to your website can’t meaningfully give this if they don’t actually know what it is that they’re consenting to. It’s not enough to simply state that your site is using cookies. You need to tell visitors in clear and plain language:
- What sort of technologies you’re using (cookies, tracking pixels, scripts etc)
- What you’re using them for (analytics, marketing etc)
- About any third parties setting cookies (such as Google or Facebook)
- The duration of the access or storage.
And that means that you need to have a clear understanding of the different cookies, tracking pixels, and scripts that are being used on your site, by whom, and why.
That’s why Pooka & Co provides a cookie banner implementation service to its clients. This involves a full review of storage and access technologies used on your site to create a comprehensive cookie policy that gives your visitors all of the information they need to make an informed decision about what happens when they visit your site.
“But Everyone Does It” Isn’t a Moral, or Legal Defence
A common response is: “This is just how the web works.” But normal doesn’t automatically mean ethical. It certainly doesn’t mean lawful.
The fact that surveillance-based advertising has become widespread doesn’t mean organisations have no responsibility for the choices they make, especially when alternatives exist.
Embedding third-party tools is a decision. So is explaining them clearly. So is giving people a genuine choice.
Get in touch if you’d like to learn more about Pooka’s Data Privacy services.
FAQs: Cookies, Explained
Cookies allow a website to recognise a user’s device and remember things like logins, preferences, or what’s in a shopping basket. They’re a core part of how modern websites function. The issue isn’t that cookies exist, it’s what extra data they’re used to collect, store, or share beyond what’s strictly necessary.
Consent is needed when a website wants to use cookies or similar technologies to collect additional information about visitors, such as analytics, marketing data, or behaviour across multiple sites. This includes tools run by third parties like Google, social media platforms, or embedded video services.
Because design choices affect real people. Using tracking technologies without clear explanation or genuine choice can undermine trust and privacy. Ethical digital design means being intentional: understanding what tools you’re using, why you’re using them, and explaining that honestly so visitors can make informed decisions.
