Whether you need a cookie banner has nothing to do with how the site was built. It depends on what the site stores on, or reads from, your visitors’ devices, and why. A site you made in an afternoon with Lovable, Bolt, v0 or Cursor is held to the same rules as one a team built over a year.
The tricky part with AI-built sites is that they change fast. A site can launch clean and pick up an analytics snippet, a chat widget or an ad pixel three prompts later. Patch has seen plenty of sites with a cookie banner and no cookies, and rather more with cookies and no banner.
The short answer
| What your site does | What the rules usually ask for |
|---|---|
| Only strictly necessary storage (a login session, a basket, remembering a choice the visitor made) | No consent needed, but you still explain it in your privacy or cookie policy |
| Analytics | EU: usually consent first. UK: consent first, unless it meets the narrow “statistical purposes” exception described below |
| Advertising pixels, retargeting, cross-site tracking | Consent first, in the UK and the EU |
| Embedded third-party content that sets identifiers (some video players, chat widgets, social embeds) | Usually consent first, unless it’s strictly necessary for something the visitor asked for |
In the US there’s no general “ask before you set a cookie” rule. California works differently, as an opt-out. More on that below.
It isn’t only cookies
The rules cover more than the files your browser calls cookies. The ICO’s guidance on storage and access technologies lists cookies, tracking pixels, link decoration, device fingerprinting, web storage (local storage) and scripts and tags. The EDPB’s Guidelines 2/2023 say the same for the EU, with sections on URL and pixel tracking.
So “we don’t use cookies” isn’t the end of the question if your site writes an ID to local storage or loads a tracking pixel.
What AI-built sites tend to load
Some of this comes from the platform and some of it you add:
- Built-in platform analytics. Lovable’s visitor analytics are on by default once you publish. Its docs say it “does not build profiles of your visitors or follow them across separate visits”. They don’t say how a session is recognised, so check what it stores in a visitor’s browser and mention it in your policy either way. You can turn it off in project settings. Bolt offers built-in analytics on paid hosting plans, and its docs say you can also paste in tracking code for tools like Google Analytics or Matomo.
- Analytics and session replay you add. Pasting a snippet into the page head is easy. It also usually means the script runs on every page load, before anyone has clicked anything.
- Auth sessions. Login is strictly necessary for a logged-in user. The ICO gives authentication as an example of the strictly necessary exception.
- Embeds and widgets. Video players, maps, chat bubbles and booking widgets can set their own identifiers. Check each one.
The UK rules after the Data (Use and Access) Act
The Data (Use and Access) Act 2025 rewrote the UK cookie rule. The new text of PECR regulation 6 and a new Schedule A1 of exceptions came into force on 5 February 2026. The ICO finalised its updated guidance in April 2026.
Consent is still the default. The exceptions include:
- Strictly necessary. Storage that is essential to provide the service the visitor asked for, judged from the visitor’s side. Logins, baskets and security count. The ICO says no advertising purpose meets this exception.
- Statistical purposes. Analytics whose sole purpose is to understand how your service is used so you can improve it. The results must be aggregate. It’s not for tracking or profiling individual visitors, and the ICO says it “does not apply to purposes related to online advertising”.
- Appearance. Adapting how the site looks or works to the visitor’s preferences, such as a chosen language or a dark theme.
The statistical and appearance exceptions come with conditions. You must give clear information about the purpose and a simple, free way to object. A third-party analytics provider can be used, but only if it acts on your behalf and doesn’t link the data with other information or use it for its own purposes. If you’ve switched on advertising features, or the provider uses the data for itself, you’re back to needing consent.
So the UK change is real, but it’s narrow. It doesn’t mean “analytics no longer needs a banner”. It means some carefully set-up, first-party-style analytics can run with a clear notice and an opt-out instead of up-front consent.
The EU rules
The UK change doesn’t apply to EU visitors. Under Article 5(3) of the ePrivacy Directive, storing or reading information on a device is only allowed with consent or where it’s necessary for specific purposes. The EDPB notes that the exemptions depend on each country’s national law and its regulator’s guidance. If you have EU visitors, plan to ask for consent before analytics, unless you’ve confirmed an exemption applies in the countries you serve.
The EDPB’s Cookie Banner Taskforce report shows what EU regulators look for:
- Most authorities in the taskforce treated a banner that has an accept button but no way to refuse on any layer as an infringement.
- Pre-ticked boxes don’t give valid consent.
- A “refuse” link buried in a paragraph, with no visual weight, isn’t good enough.
- Calling a cookie “essential” doesn’t make it so.
- People must be able to withdraw consent as easily as they gave it.
What a banner actually has to do
A banner is only useful if the site obeys it. The ICO’s guidance on managing consent is clear:
- Don’t set anything that needs consent until the visitor has taken a positive action.
- Make it as easy to refuse as to accept. Offering “accept all” with no “reject all” at the same level is given as bad practice.
- Optional categories should be off by default.
- “By continuing to use our website, you consent” doesn’t count. Silence isn’t consent.
- Let people withdraw consent with the same ease they gave it.
The most common failure on AI-built sites is simple. The banner appears, but the analytics script in the page head has already fired. A banner that shows up after the tracker has run is decoration. ShipPatrol’s trackers that fire before consent check looks for exactly this, and the cookie banner check looks at whether there’s a banner at all when one seems to be needed.
The US, and California in particular
There’s no US federal rule that says “ask before setting a cookie”. The CCPA works as an opt-out. According to the California Attorney General, it applies to for-profit businesses that do business in California and cross revenue or data-volume thresholds. If you’re covered and you sell or share personal information (which can include some advertising tracking), you need a clear “Do Not Sell or Share My Personal Information” link. You also need to honour the Global Privacy Control browser signal as a valid opt-out. Many small sites will be under the thresholds, but check rather than assume.
A five-minute self-check
- Open your site in a private window. Don’t click anything.
- Open the browser’s developer tools. Look at the Network tab for requests to analytics or ad domains, and at Application (or Storage) for cookies and local storage.
- Click “reject”. Reload. Check again.
- Click “accept” and see what changes.
- Compare what you saw with what your privacy policy says. If they disagree, the privacy policy checklist can help.
This isn’t legal advice
This guide explains what the official guidance says as of 21 October 2026. It isn’t legal advice, and your situation depends on where your business and your visitors are. If you’re unsure, ask a qualified adviser.
Check yours
A free scan loads your site the way a first-time visitor would and shows what fires before anyone clicks. It takes a couple of minutes, and Patch is up anyway.