The Cookie Banner That Does Nothing: Consent, Broken Data and Wasted Budget

The cookie banner on your site stands a good chance of being the worst of both worlds: it protects you from nothing, because the cookies fire before the guest clicks, and meanwhile it ruins the data you use to decide where to spend your budget. It is the typical result of a plugin installed in five minutes in 2022 and never looked at again — and we see it, in one form or another, on most accommodation websites that cross our desk.

This article explains what the Italian data protection authority actually requires, the three mistakes that recur every time, and why this is less a legal problem than a data quality problem. With a check you can run yourself in ten minutes.

The rules, briefly

The Italian reference is the Guidelines on cookies and other tracking tools issued by the Garante per la protezione dei dati personali, adopted by decision of 10 June 2021 and fully applicable from 10 January 2022. This is not a 2026 development: it is a four-year-old deadline that many sites never met.

Five points concern a tourism website.

1. No tracking before consent. Cookies and non-technical tracking tools — third-party analytics, advertising pixels, maps, embedded video, chat — cannot be activated until the user has made a choice.
2. Scrolling is not consent. Scrolling on its own is not a valid expression of will. It can form part of a more elaborate journey amounting to a positive action, but “they kept reading, so they accepted” is not a valid basis.
3. Refusing has to be as easy as accepting. The user must be able to refuse all non-essential cookies with one click, from the first layer of the banner — including by closing the window with the X, which counts as a refusal.
4. No cookie walls. Making access to the site conditional on acceptance is as a rule unlawful, unless equivalent content or services are also available without consent.
5. A no lasts six months. Somebody who has refused must not be asked again on every visit: the request may be repeated, save in specific cases, after at least six months.

The three mistakes that recur every time

1. The cookies fire before the click

This is the most frequent and the most serious, and it is invisible from the outside: the banner appears correctly, but Google Analytics, the Meta pixel and the embedded map have already loaded while the user was reading. In that case the banner has no effect whatsoever — it is a graphic element.

Why does it happen? Almost always because the tracking scripts were put into the theme, or added by a marketing plugin, or injected by an external service (an analytics connector, a booking system, a reviews widget) which the cookie plugin does not know about and therefore does not block. The banner manages only what has been connected to the banner.

2. “Accept” is a button, “Reject” is a grey link at the bottom

The second mistake is one of design. A big green “Accept all” button and, underneath, in light grey 11-point type, “manage preferences”, which opens a panel with six toggles to configure one by one. Formally the refusal exists; substantively it is not an equivalent choice.

The correct form is easier to build than the wrong one: two buttons of the same visual weight, “Accept” and “Reject”, plus a third link to customise. Three elements, first layer, done.

3. The banner reappears on every visit

This happens when the user’s choice is not stored, or is stored with an expiry of a few hours. Besides being wrong on the six-month point, it is the most effective way of teaching guests to click “Accept” without reading — and of irritating anyone coming back to finish an interrupted booking.

The real cost: your data is lying to you

Here is the part that matters most, and that nobody connects to the banner.

If consent is handled badly, the numbers you decide on are broken in one of two directions, and both cost money.

If you track before consent, the data is complete but collected in a non-compliant way. The risk is not only a penalty: it is that you are building your marketing on a baseline which, the day it gets put right, shifts on its own — and you find yourself comparing seasons that cannot be compared.

If you block everything without proper consent management, the opposite happens: you lose half the data and you do not know which half. Campaigns look less effective than they are, conversions from metasearch and Google Hotel Ads are not attributed, and you end up cutting the channel that was working best because “it doesn’t bring bookings”.

The good news is that well-managed consent recovers part of what is lost: with Consent Mode configured correctly, users who refused still produce aggregated signals with no identifiers, enough to estimate the trend. The work is the same work compliance requires. You do it once.

The check to run yourself, ten minutes

You do not need a consultant to know where you stand. You need a browser.

1. Open the site in a private window, so you start with no cookies already saved.
2. Open the developer tools (F12, or right-click → Inspect) and go to the Network tab.
3. Reload the page and do not touch the banner. In the filter box type google-analytics, then googletagmanager, then facebook, then doubleclick. If anything appears, that tracker fired without consent.
4. Look at the Application → Cookies tab. How many are there before you have clicked anything? There should only be the site’s own technical ones.
5. Then look at the banner the way a guest sees it. Can you refuse with one click, without opening panels? Does the X close it without accepting?
6. Finally close everything and reopen the site (not in private mode): does the banner come back? If it does, the choice is not being stored.

Six checks. If they all pass, your banner works and you can stop reading here. In our experience, fewer than one site in five passes all of them.

What to do, in order

1. Inventory what the site loads. The list in the Network tab is your real inventory, and it almost never matches what you thought you had installed. We often find pixels from campaigns closed two years ago, still live.
2. Remove what you do not use. This is the step nobody takes and it solves half the problem: a tracker that has been removed needs neither blocking nor disclosing, and the site gets faster.
3. Connect everything else to consent, embedded services included — maps, video, review widgets, chat — which should load only after the choice. Until then, a clickable placeholder goes in their place.
4. Configure Consent Mode v2 if you advertise or measure with Google tools, with the defaults set to “denied” before the choice is made.
5. Fix the banner: two equivalent buttons, an X that refuses, the choice remembered, and a way to change your mind that is always reachable — a link in the footer is enough.
6. Update the cookie policy with the actual list, not the plugin’s generic one.
7. Run the six checks again once the work is done, and then once a season: every new plugin can reintroduce the problem without warning.

One side effect worth naming: fewer third-party trackers means lighter, faster pages, and a fast site converts better. Step 2 on this list pays for itself.

“But aren’t the European rules about to change?”

Yes, it is being discussed — and no, that is not a reason to wait.

The simplification package presented by the European Commission at the end of 2025 proposes, among other things, moving the cookie rules inside the GDPR, making consent signals set at browser level binding, and consolidating the six-month rule. At the date of this article it is still a proposal under negotiation: it has to pass through Parliament and Council, and full implementation is in any case expected years after any adoption.

Two things are reasonably clear already. The first is that banners will not disappear entirely: they will remain for disclosure, for the periodic request and for withdrawal. The second is that the useful work — knowing what your site loads, not tracking before the choice, storing the consent — is exactly what is needed in either scenario. There is nothing to throw away.

The questions we are asked most

I have a paid plugin — aren’t I covered already?

A good plugin is necessary and not sufficient. It blocks what it has been told to block: scripts added by hand to the theme, loaded by an external service, or added by another plugin remain invisible to it. The Network tab check exists precisely to show the difference between what the plugin thinks it manages and what the site actually does.

Can Google Analytics be used without consent if I anonymise the data?

That is an assessment to be made case by case and with caution: the conditions for treating an analytics system as a technical tool are narrow and concern minimisation, no cross-referencing with other data, and limits on sharing with third parties. When in doubt, the solid route is to ask for consent and configure Consent Mode — which is also the route that leaves you with usable data.

If I remove the advertising pixels, do I lose remarketing?

You lose pixel-based remarketing for the people who refuse, yes. But the most profitable audience for an accommodation business is not a pixel: it is the list of your past guests, which is first-party data. It is one of the reasons email marketing regained value exactly as third-party tracking was being narrowed.

Does the banner cost me bookings?

A well-made banner does not: two clear buttons, the choice remembered, no box covering the booking form on a phone. A badly made one does, and not because of the consent — because it covers half the screen, reappears on every page and is hard to close with a thumb. It is an interface problem before it is a privacy problem.

We are a small property — will anyone ever check?

Statistically, an inspection is not the likely scenario. The likely scenario is a different one: setting next season’s budget on the wrong numbers. That is where the real cost comes from, every year, without anyone ever challenging you.

In short

The cookie banner is a tedious obligation that almost everybody has solved in the way that produces maximum annoyance and minimum benefit. The Italian rules have been settled since January 2022 and they are not complicated: do not track before the choice, make refusing as easy as accepting, remember the answer.

The reason to fix it, though, is not the law. It is that without well-managed consent you do not know where your bookings come from — and that is a problem you pay for every season.

This article is for information only and does not constitute legal advice. The binding references are the cookie guidelines of the Italian data protection authority (Garante per la protezione dei dati personali, decision of 10 June 2021, no. 231) and the text of the GDPR; for your own situation, consult a qualified professional.