yodai Academy Build your website

Academy › Build › Create your website

The cookie notice you don't need, and the one that doesn't do its job

You'll know whether your website sets cookies that need permission or not, and if it does, whether the notice has a button to accept and an equally easy one to decline.

By Yodai · Published on September 6, 2026 · Updated on October 12, 2026

4 min read

There's something your website stores without anyone asking for it: what we call cookies. If you have an embedded YouTube video, a Google map, a chat widget from an outside provider, or Google Analytics installed because you figure you should be measuring something, your website is already leaving marks in your visitor's browser before they do anything.

And if you copied the cookie notice from another template and pasted it in at the bottom without looking at it, one of two things can happen: you didn't need it and now you have one anyway, or you did need it and got it wrong, with a big button to accept and nothing as easy to decline. Both problems get fixed by spending ten minutes looking at your own website.

What your website stores without asking permission

There are cookies your website sets on its own that don't need a notice: the one that keeps a customer's session open while they browse, the one that remembers the language they picked, or the one that holds their booking while they fill out a multi-step form. They only exist to make the website do what the customer is asking for, and Spain's data protection authority, the AEPD, excludes them from the duty to inform and ask for permission. If you want, you can just mention them in a line of your cookie policy.

A WhatsApp button that links straight to your number isn't a tracker either: it's just a link, it doesn't set a cookie. What does set one is a chat widget from an outside provider that loads its own script to follow the conversation across pages.

What does require a notice

The problem starts when something from outside gets loaded into your website: an embedded YouTube video, a Google Maps widget, an Instagram share button, an outside chat tool, or the Meta pixel for tracking ads. All of that sets cookies your website doesn't need to function, many from a domain that isn't yours and built to recognize that visitor on other sites too. Those are the ones that need permission, along with any cookies on your own domain used for analytics or ads: the AEPD requires notice and consent for any cookie that isn't strictly needed to run the website, whether it's yours or a third party's. You have to ask for permission before those cookies load, not after they've already done their job.

Check it on your own website, in three steps
  1. 1Open your website in a new tab, without being logged in
    That way you see what a stranger sees, without anything of yours already stuck in the mix.
  2. 2Look for an embedded video, map, chat, or social buttons
    If the video is a YouTube player, the map is a Google Maps iframe, or the chat comes from an outside provider, that's third-party tracking.
  3. 3Check whether you track visits or run an ad pixel
    If you installed Google Analytics or the Meta or TikTok pixel for your campaigns, that counts as tracking too, and it also requires a notice.
Drop the outside stuff, or keep it and post a proper notice
Your website doesn't carry anything from outside
  • Video you recorded yourself and uploaded as a file, not embedded from YouTube
  • Address as plain text or your own map graphic, no Google Maps iframe
  • Chat through a direct link to your WhatsApp number, no outside widget
Your website tracks visits or carries embedded content
  • Analytics to know how many people visit and where they come from
  • Meta or TikTok pixel because you run ads
  • Video or map loaded directly from the provider

Which to choose: If you can live without those extras, remove them: you skip the notice entirely and your website loads faster. Install Analytics or a pixel the day you start spending on ads and need to know if they're working. That's the day you add the notice, not before.

The notice that's worthless
The costly mistake isn't skipping a cookie notice, it's getting one wrong. A big "Accept" button, and to decline, forcing people into "Settings," unchecking boxes one by one, and confirming. That's not a valid notice, it's an obstacle: the AEPD's cookie guidance requires the decline option to sit on the same layer and at the same level as accept, with a similar mechanism. The rule is simple: declining should take the same one click as accepting, button next to button, with the same visibility.
The notice, exactly as it should appear on your website
We use our own and third-party cookies to measure visits and show content from other services (video, map). [ Decline ] [ Settings ] [ Accept ] More information, and you can change your choice anytime, in the "Cookie Policy" link at the bottom of the page.
What you'll walk away with
  • You know whether your website sets cookies that need permission, or only the ones that make it run.
  • If you don't use them, you don't need a notice, at most a line in your cookie policy.
  • If you use them, the notice has a button to accept and another just as easy to decline
  • The next lesson nails down what happens if a customer cancels
NextWhat happens if they cancel, already decided