What is a consent banner, and does your website need one?

What is a consent banner?

A consent banner is the pop-up, bar or box that appears when someone lands on your website, asking them to accept, reject or manage cookies and tracking before your site gets on with using them. For an Australian small business, it is often the first (and sometimes the only) moment you get to ask permission before analytics tools, ad pixels or other third-party scripts start collecting data about that visitor.

Does the Privacy Act actually require a consent banner?

Not in so many words. The Privacy Act 1988 (Cth) does not name "cookie banners" as a legal requirement. What it does require, if your business is covered by the Act, is that you collect personal information fairly and transparently, and that you have genuine consent before you rely on consent to justify collecting or using someone's data.

The OAIC's own guidance on tracking pixels sets out what that looks like in practice. It says organisations should take reasonable steps to notify people about the use of tracking pixels, and gives a banner or pop-up when someone visits a website as an example of a reasonable step, alongside a link to further privacy information. In other words, a banner is not the legal requirement itself. It is one of the more practical ways to meet the requirement that actually sits behind it: telling people what is happening and giving them a real choice.

What makes consent valid, according to the OAIC

This is the part most banners get wrong. Under the Australian Privacy Principles, consent has four elements. The person needs the capacity to understand what they are agreeing to. The choice has to be voluntary, with a genuine option to refuse and no default set to "yes". Consent has to be current and specific to the purpose at hand, not a general tick years ago for something unrelated. And the person has to be informed, meaning they understood what they were agreeing to before they agreed to it.

Consent can be express (an explicit click, tick or statement) or implied (reasonably inferred from someone's conduct). The OAIC is clear that implied consent should not be assumed from silence or from someone simply not objecting, which rules out banners that treat scrolling past or continuing to browse as agreement.

There is also a specific warning worth knowing about: bundled consent. That is where a business rolls several different requests into one yes or no, for example lumping "essential cookies," "analytics," and "marketing" into a single accept button with no way to choose between them. The OAIC's guidance flags this as something that can undermine whether consent was really voluntary, because the person never had the option to agree to one thing and not another.

Common mistakes that make a banner meaningless

• Making "accept all" the only easy option. If accepting takes one click and rejecting takes three, that is not a genuine choice, it is a nudge.

• Pre-ticked boxes. A box someone has to actively untick is not consent they gave. It is consent you assumed.

• Vague wording. "We use cookies to improve your experience" tells a visitor nothing about what is actually being collected or why.

• Bundling everything together. One switch for cookies, tracking pixels and marketing emails means nobody can say yes to one and no to another.

• No way to change your mind later. Consent should be as easy to withdraw as it was to give, not buried three settings menus deep.

What to check on your own site

• Open your site in a private browser window and see what the banner actually says and does.

• Check whether rejecting or managing preferences takes the same number of clicks as accepting everything.

• Look for any box that is ticked by default. If there is one, untick it.

• Read the wording as a customer would. Does it say what is being collected and why, in plain language?

• Confirm your privacy policy matches what the banner promises. If your privacy policy does not mention the tools your banner is asking consent for, one of the two is out of date.

• Make sure there is an easy way for someone to withdraw consent later, not just give it.

FAQ

Do I need a cookie banner for a small business website?

It depends on what your website does. If it only uses cookies that are strictly necessary to make the site work, a banner is not always required. If it runs analytics, advertising pixels or anything that collects personal information for a secondary purpose, you need a lawful basis for that, and a clear, honest banner is the most common way businesses provide it. If you are not sure which category your website falls into, it is worth getting advice specific to your setup.

What is the difference between a cookie banner and a privacy policy?

A consent banner is the moment-of-collection notice, the quick heads up a visitor gets when they land on your site. Your privacy policy is the standing, detailed explanation of how your business handles personal information generally. Most businesses need both, and they should say the same thing.

What happens if I do not have a consent banner?

If your website is collecting personal information without a fair and transparent process, and without genuine consent where you are relying on consent, that can put you offside with the Australian Privacy Principles. What that means in practice depends on what your business collects and why, so treat this as a prompt to check your setup rather than a reason to panic.

This is general information, not legal advice. Every business handles information a bit differently, so if you're not sure how this applies to yours, it's worth checking with a lawyer or privacy adviser.

Read the OAIC's guidance on tracking pixels and privacy obligations and on what counts as valid consent for the full detail. If you would rather not build your consent set up from scratch, Savira's consent tools are built to make this straightforward for small businesses.