When cookie consent is worth the effort

It is rarely the thing that gets a project approved, and often the thing that decides how it goes. Cookie consent is not free, and pretending otherwise leads to bad decisions.

Security is a maintenance habit rather than a purchase, which is why it drifts. The version that survives contact with a real deadline is the simple one.

When it is worth it

A banner does not make non-compliant tracking compliant. Small and consistent beats large and occasional here. The version that survives contact with a real deadline is the simple one.

When it is not

If nothing downstream depends on it and nobody is complaining, it can wait. There is a version of this that is over-engineered, and it is worth avoiding.

How to decide

Make refusing as easy as accepting. It is worth being explicit about, because assumptions differ quietly. The teams that stay on top of it are the ones who put it on a calendar rather than a wish list.

The short version

The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about cookie consent before you move on:

• Someone can say what the current setup is without going to look
• A banner does not make non-compliant tracking compliant — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Pick the one that would hurt most if it failed, and start there.