Skip to main content
Back to Blog
5 min read

Cookie banners done right (and legally) — the Slovakia/EU minimum

Most cookie banners are either illegal (pre-checked boxes, no reject option) or overkill (enterprise consent platforms for a 5-page site). Here's the minimum legally compliant setup for small sites in the EU.

security

Cookie banners are one of those things where most implementations are wrong in one of two directions: either they're illegal (pre-checked consent, no reject button, dark patterns) or they're massive overkill (enterprise consent management platforms on a 5-page portfolio site).

Here's the minimum setup that's legally compliant for small sites operating in the EU (including Slovakia), based on what actually matters under GDPR and the ePrivacy Directive.

You need one if you set cookies that aren't strictly necessary for the site to function. The most common triggers:

You don't need one if you only use:

The simplest legal path: switch to cookie-free analytics and skip the banner entirely. Plausible and Fathom are GDPR-compliant without consent. This is what I recommend for most client sites — no banner, no consent management, no legal risk.

Under GDPR + ePrivacy Directive (as implemented in Slovak law and across the EU):

You must get consent before setting any non-essential cookie. This means: no Google Analytics tracking on page load. The script loads only after the user clicks "Accept."

Pre-checked boxes are explicitly illegal under GDPR (Planet49 ruling, CJEU 2019). The consent must be an affirmative action — clicking a button, not failing to uncheck a box.

2. Equal prominence for accept and reject

The "Accept" and "Reject" buttons must be equally easy to find and click. Dark patterns — making "Reject" a tiny link while "Accept" is a big green button — violate the GDPR's requirement for freely given consent.

The French CNIL fined Google €150M and Facebook €60M in 2022 specifically for this: making it one click to accept and multiple clicks to reject.

3. Granular category control

Users must be able to consent to specific categories (analytics, marketing, preferences) rather than all-or-nothing. In practice, for a small site with just analytics, two options are enough: "Accept analytics" and "Reject all."

4. Easy withdrawal

Users must be able to withdraw consent as easily as they gave it. A link in the footer ("Cookie Settings") that reopens the banner is the standard approach.

5. Documented proof

You must be able to prove that consent was given. Store a record: timestamp, what was consented to, and the version of the consent text shown. A simple database row or localStorage entry works.

The minimum implementation

For a small Next.js site that needs Google Analytics:

'use client'

import { useState, useEffect } from 'react'

const CONSENT_KEY = 'cookie-consent'

type Consent = 'accepted' | 'rejected' | null

export function CookieBanner() {
  const [consent, setConsent] = useState<Consent>(null)
  const [visible, setVisible] = useState(false)

  useEffect(() => {
    const stored = localStorage.getItem(CONSENT_KEY)
    if (stored === 'accepted' || stored === 'rejected') {
      setConsent(stored)
      if (stored === 'accepted') loadAnalytics()
    } else {
      setVisible(true)
    }
  }, [])

  function accept() {
    localStorage.setItem(CONSENT_KEY, 'accepted')
    setConsent('accepted')
    setVisible(false)
    loadAnalytics()
  }

  function reject() {
    localStorage.setItem(CONSENT_KEY, 'rejected')
    setConsent('rejected')
    setVisible(false)
  }

  if (!visible) return null

  return (
    <div role="dialog" aria-label="Cookie consent" className="...">
      <p>
        We use cookies for analytics to improve this site. See our{' '}
        <a href="/privacy">privacy policy</a>.
      </p>
      <div className="flex gap-3">
        <button onClick={reject} className="...">
          Reject
        </button>
        <button onClick={accept} className="...">
          Accept
        </button>
      </div>
    </div>
  )
}

function loadAnalytics() {
  // Load GA4 only after consent
  const script = document.createElement('script')
  script.src = `https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX`
  script.async = true
  document.head.appendChild(script)
}

Key points:

<button
  onClick={() => {
    localStorage.removeItem(CONSENT_KEY)
    window.location.reload()
  }}
  className="text-sm text-gray-400 hover:text-white"
>
  Cookie Settings
</button>

This clears the stored consent and reloads the page, showing the banner again. Simple, compliant, no enterprise consent platform needed.

Slovakia-specific notes

Slovakia implements the ePrivacy Directive through the Electronic Communications Act (zákon č. 452/2021). The requirements align with the EU standard — no Slovakia-specific gotchas. The regulatory authority is the Office for Personal Data Protection (Úrad na ochranu osobných údajov).

For a small service business, the risk of enforcement is low — regulators focus on large companies. But compliance is straightforward enough that there's no reason to skip it. The implementation above takes 30 minutes.

What not to use

The recommendation

For most small sites: switch to cookie-free analytics (Plausible, Fathom) and skip the banner entirely. No legal risk, no UX friction, no implementation cost.

If you need Google Analytics specifically: use the implementation above. 30 minutes of work, legally compliant, no third-party consent platform.

Either way, document it in your privacy policy — what cookies you set, why, and how users can opt out.

Want your site legally compliant without enterprise complexity? Let's talk — I ship GDPR-compliant setups on every EU-facing project.