A website without a cookie banner

Most small sites need one only because of something they load. Leave that out, and the banner can go too.

When a banner is needed

Under the EU's ePrivacy rules and the GDPR, a site has to ask before it stores anything in a visitor's browser that isn't strictly needed for what the visitor asked for, and before it tracks them. A site that does neither has nothing to ask about.

This page explains how Boxlet works. It isn't legal advice: whether your site needs consent depends on everything on it.

What usually brings the banner

  • An analytics script, such as Google Analytics.
  • A YouTube video or a Google Map embedded the usual way, which loads the provider's scripts and cookies before anyone presses play.
  • Fonts loaded from another company's servers.
  • Social media buttons and tracking pixels.
  • Plugins that add any of these without saying so.
A cookie scan of demo.boxletcms.org: no cookies are set before consent, with 0 necessary, preference, analytical, marketing and other cookies.

No cookies, checked

Boxlet sets no cookies for visitors: not on pages, not on the 404, not when someone sends a form. We scanned the demo for cookies before consent and found none, in any category.

The statistics settings: counting on, Do Not Track honoured, and how much of a visitor's location is counted.

Statistics without a tracking script

Visits are counted by the site itself, on your own server. A visitor is recognised for one day only, by an anonymous key that changes every day; the IP address makes the key and is never stored. Nothing is added to the page.

A YouTube video on a Boxlet page before it is pressed: the video's own picture with a play button, served from the site itself (Big Buck Bunny, © Blender Foundation, CC BY 3.0)

Videos and maps on a press

Paste a YouTube or Vimeo address into a Video block and Boxlet takes the video's own picture by itself: once, on your server, kept in Media as an ordinary picture of your site. Visitors see that picture with a play button, served from your own server, and nothing is asked of YouTube or Vimeo until someone presses play. A YouTube video then comes from youtube-nocookie.com.

You can choose another cover picture whenever you like. A map shows a placeholder until it is pressed, and can be OpenStreetMap.

Fonts and everything else

All 27 typefaces are served from your own server. Pictures, scripts and stylesheets come from the site itself: nothing is fetched from another company while a page loads.

For your privacy policy

Settings writes a paragraph about the statistics for your privacy policy, from your own settings, in English or Croatian. A starting point, not legal advice.

Try it on your next small site

Ordinary shared hosting is enough: PHP 8.1 and MySQL or SQLite.