A cookie banner on your flower shop website doesn't always mean tracking waits for the visitor's answer. If tracking that needs consent starts the moment your homepage opens, the banner may not be holding it back. This guide explains what that means in plain English, what to ask your website provider to change, and where to get proper advice.
This is a plain explanation, not legal advice. Cookie rules sit inside privacy law, and how they apply to your shop depends on what your site runs and why. For a decision about your own website, use the regulator guidance linked below or speak to a data protection adviser or solicitor.
What A Cookie Banner Is For
A cookie is a small file a website stores on a visitor's phone or computer. Some are needed for the site to work: the one that remembers what's in the basket, for example. Others are there to measure visitors or to target adverts.
The rules in the UK and Ireland treat those two groups differently. Cookies the site needs to deliver what the customer asked for can usually run without asking. Most others need the visitor's agreement first. The banner is how you ask, and the important word is first. Regulators in both countries expect cookies that need agreement to wait until the visitor has given it.
What "Tracking Before A Visitor Chooses" Looks Like
Picture a customer on their phone at 8am, looking for a sympathy arrangement. They land on your homepage. The banner slides up asking whether they accept cookies. Before they've tapped anything, a few things have already happened in the background:
- A Google Analytics cookie (usually named
_ga) has been stored on their phone - The Meta pixel has loaded and set its own cookie (usually
_fbp) - A request has gone off to Google Ads to note the visit
The customer hasn't said yes or no. They might tap Reject a second later, and the cookies are already there.
One common cause is a tag added when the site was built (or when someone set up a Facebook ad campaign one February before Valentine's), with the banner added later and not set up to hold that tag back.
Analytics And Advertising Are Treated Differently
In The UK
The ICO's current guidance includes a narrow exception for statistics used to improve your website. It is not permission to turn on every analytics tool without asking.
To rely on it, explain the measurement clearly, give visitors a free way to object, and use combined statistics that do not identify people. Any analytics company must act on your behalf and use the information only to improve your service. Keeping individual visitor histories or using the information for advertising falls outside that exception.
Ask your adviser whether your particular set-up meets the conditions. Advertising cookies need consent; changing the name of a tag or switching off one cookie does not settle that question.
In Ireland
The Irish Data Protection Commission's guidance on cookies and other tracking technologies says analytics cookies require consent. Cookies needing consent must wait for it.
The guidance distinguishes this obligation from enforcement priorities. Its lower priority for some first-party statistical analytics is not an exemption. Do not apply the UK's statistics exception to an Irish shop.
What A Fair Banner Looks Like
Both regulators expect saying no to be as easy as saying yes. The ICO's consent guidance includes the checklist line "Our consent mechanism makes it as easy to refuse consent as it is to accept" in its guidance on managing consent in practice. The DPC says a banner with an Accept button must give "equal prominence" to a way to reject or manage cookies.
The two regulators put the first screen slightly differently. The ICO's good-practice example has Accept all and Reject all buttons of equal prominence. The DPC accepts an equally prominent Reject button, or a Manage option of equal prominence that takes the visitor to the choices. A few things on the banner itself follow from that:
- Put Reject next to Accept on the first screen. It's the clearest way to make saying no as easy as saying yes, and it fits both regulators' guidance
- Make Reject look like a button too. A bright Accept beside a grey text link reading "manage preferences" steers people towards yes
- Leave marketing and advertising switches off to start with. In Ireland the same goes for analytics. In the UK, analytics that genuinely falls under the statistics exception can be on by default with a simple way to switch it off, so check that with your adviser
- Carrying on browsing doesn't count as agreement. Both regulators reject banners that say "by using this site you accept cookies"
The DPC also suggests asking visitors to confirm their choice again after no more than six months.
How To Check Your Own Site
You can see the banner side of this in a couple of minutes. Checking the cookies takes one extra, slightly technical step.
- Open a private or incognito window on your computer.
- Type your shop's web address and let the homepage load.
- Don't touch the cookie banner.
- Look at whether a Reject button sits next to Accept, and whether it's as easy to see.
To see whether tracking has already started, you need to look at the cookies the page has stored. That means opening the browser's developer tools on a computer, in Chrome, Edge or Firefox: right-click the page, choose Inspect, then look for Application or Storage, then Cookies. Phone browsers don't have this panel. If you see names starting _ga, _gcl, _fbp or _ttp before answering, ask your provider what set them and why. These names are clues, not a full privacy assessment.
If you'd rather not dig into developer tools, our free Florist Website Checker does this for you.
What To Ask Your Website Provider To Change
Most florists didn't install their own tracking, so the fix usually sits with whoever looks after the site. You don't need to understand the technical side. Send them something like this:
Our cookie check suggests tracking may start before visitors answer the banner. Please verify that finding. Please can you:
- Set the banner to block Google Analytics, Google Ads and the Meta pixel until a visitor accepts. Banner tools often call this prior consent or automatic blocking.
- Set Google's tags to use Consent Mode with analytics and ad storage set to denied by default, and tell us whether you've used basic or advanced mode.
- Put a Reject button next to Accept on the first screen, styled the same way.
- Make sure our privacy or cookie policy lists the tools the site runs.
Point 2 is the one most likely to come back with jargon. Google's Consent Mode comes in two versions. In basic mode, Google's tags don't load at all until the visitor answers the banner. In advanced mode, the tags load straight away and, while consent is refused, send measurements without cookies. Advanced mode stops the cookies, but it still sends something to Google before the visitor chooses. Whether that's acceptable for your shop is exactly the kind of question to put to an adviser, so ask your provider which one they've set up and pass the answer on.
If your site runs other tools, the same principle applies to each: a heatmap tool, a TikTok or Pinterest tag, an email sign-up pop-up that tracks visitors. Ask which tools need consent and which, if any, meet a specific exception. Hold tools needing consent back until the visitor agrees. While you're in touch with your provider, our guide to florist website fixes you can make yourself covers the layout of pop-ups and cookie notices on a phone, and which changes you can make without them.
A Worked Example
Take a fictional high-street florist in the north of England. Their homepage shows a banner with a teal Accept all button and a small grey link underneath reading "Cookie settings". When the page opens, it stores a _ga cookie and a _fbp cookie before anyone taps anything.
That's two separate issues. The tracking starts before the visitor chooses, and the banner doesn't offer a Reject choice that's as easy as Accept. The shop owner sends the four-point message above. Their provider switches on blocking in the banner tool, sets Consent Mode, and adds a Reject all button next to Accept all. When the owner opens the homepage in a private window again, no _ga or _fbp cookies appear until they tap Accept.
Your recorded analytics figures may drop after a change like this. By how much depends on how many visitors say no. Plan for your monthly visitor numbers to look lower than before, and compare like with like from the change onwards.
How The Florist Website Checker Looks At Cookies
Our Florist Website Checker starts with a free quick check of your homepage: you enter your web address and that's it. To see the full visual report across seven areas, with problems marked on screenshots of your own site, you sign in and confirm the site is yours. Cookies and tracking sit in the Trust & Security area.
What it does on cookies:
- It loads your homepage in an ordinary web browser, at computer and phone size, without touching the banner. Both the quick check and the full check do this. It notes the tracking cookies it recognises and any attempt to send tracking data before a choice. It blocks recognised analytics and advertising requests from its browser. Your own server may still record the visit. If it only sees tracking code load, with no cookies, it says that and treats it as a warning, not a failure.
- It treats a banner tool with no early cookies as a pass. When the page has a banner tool or Google Consent Mode set to denied, and no tracking cookies are stored before a choice, the checker passes it, even if Google's tags tried to send measurements without cookies. Whether that's acceptable for your shop is the adviser question from the Consent Mode section above.
- The quick check shows the headlines. You see your scores and the titles of the top problems. The explanation, the evidence and the marked screenshots open in the full report once you've confirmed the site is yours.
- If the page doesn't load fully for the checker, it reads your homepage code for tags and a banner tool instead, and says it could not confirm whether tracking starts first.
- It checks the banner's buttons. It looks for a Reject button next to Accept on the first screen, and whether Reject is set up as a faint button or a plain text link next to a main Accept button. It can't read every banner, so a banner it can't read gets no result here.
- It checks for a privacy policy link and flags references to data laws that were replaced years ago. A pass there doesn't mean the policy has been checked against current law.
These cookie results come from measurement, not from AI. Elsewhere in the full report, an AI reads your pages for a second opinion on things like wording and photos. Those findings are clearly labelled as AI and count for less than measured results. Where an AI finding disagrees with a measurement, the measurement wins.
Two limits are worth knowing. Some banners only show in certain countries, so the checker may not see the banner your customers see. If your shop is outside the UK (in Ireland, for example) and the checker doesn't see a banner, it asks you to check what your own customers see rather than marking it as a problem. For a UK shop, or one whose country the checker doesn't know, a missing banner is still marked. The second limit is that the checker describes what happened on your site. It doesn't tell you whether your shop is breaking the law, and a pass isn't a guarantee that your set-up meets the rules.
If you're getting the site ready for a busy spell, the florist website checklist before peak walks through the other checks worth doing at the same time.
Where To Get Proper Advice
- UK shops: The ICO's advice for small and medium organisations is written for businesses your size, and its contact page lists the ways to ask a question.
- Irish shops: The Data Protection Commission publishes guidance and takes queries from organisations.
- For your own site: A data protection adviser or solicitor can review what your site runs and tell you where you stand. Take the list of tools your provider gives you, and your checker report, to that conversation.
- For the technical change: Your website provider or web designer. They set up the tags, so they're the right people to hold them back.
Common Questions
Do I need a cookie banner if I only use Google Analytics?
It depends on where you trade and how the analytics is set up. In Ireland, the DPC's guidance says analytics cookies need consent. In the UK, a narrow exception can cover some simple visitor statistics, but only under the conditions in the ICO's guidance. Ask an adviser before you remove a banner.
Does a Meta pixel need consent?
The ICO says the UK statistics exception doesn't apply to advertising, and the DPC's guidance requires consent for cookies outside its two narrow exemptions. So in most cases the pixel should wait until the visitor accepts.
Will holding tracking back hurt my Facebook ads?
You'll typically see fewer visits and conversions reported, because people who say no aren't counted. Your ads still run, but remarketing audiences and conversion reporting may shrink, which can affect how well the ads are targeted. Talk to whoever runs your ads, and judge results from the date of the change rather than against older figures.
