Cookies and privacy on a creator website: EU rules
Cookie consent for an EU creator website, using Italy's 2021 guidelines: a banner with an X, scrolling isn't consent, analytics and re-prompting rules.
A creator's website often runs more tracking tools than you'd think: analytics, ad pixels, embedded videos, sign-up forms. Each can set cookies, and some need visitors' consent.
EU cookie rules come from the ePrivacy and data protection framework, and national regulators publish guidance on how to apply them. This guide uses one detailed example: the Italian data protection authority's (Garante) guidelines on cookies and other tracking tools of 10 June 2021, published in the Official Journal on 9 July 2021. Other EU regulators have similar but not identical guidance. It isn't legal advice: check the guidance in the countries where you operate.
Which cookies need consent?
The guidelines split tools into two broad categories. Technical cookies make the site work or deliver a service the user requested: these only need a notice. Profiling cookies link behaviour to identified people, for example for advertising: they can only be used after consent is obtained.
In particular, the Italian authority adds that legitimate interest can never be relied on for non-technical cookies: consent is required. On first visit, no cookies other than technical ones may be set.
| Consent needed | |
|---|---|
| Session cookie for course login | No |
| Anonymised, aggregate-only analytics for your site | No |
| Third-party analytics without anonymisation | Yes |
| Social media ad pixels | Yes |
| Videos embedded from external platforms | Depends |
Our summary of the Italian Garante's 10 June 2021 guidelines. 'Depends' means configuration matters.
What should the banner look like?
According to the guidelines, the banner must let visitors refuse all non-technical cookies by closing it with a command marked by an X, positioned at the top right, with the same visual prominence as the other commands. The banner must say that closing it with the X keeps the default settings.
In addition, more detailed choices, by cookie category, must all start set to refusal: the user's action serves to give consent, never to deny it. The site footer needs a link, such as "review your cookie choices", to change your mind at any time.
What doesn't count as consent?
Scrolling, on its own. The Italian authority considers it inadequate in itself to collect valid consent; it can at most be one component of a more structured process. And a cookie wall, blocking access to anyone who doesn't accept, is considered unlawful, except, to be assessed case by case, where the site offers an equivalent content or service without requiring consent.
Are analytics cookies technical?
They can be. The guidelines treat analytics cookies like technical ones if:
- they prevent direct identification of individuals, for example by masking at least the fourth component of the IP address;
- they're used only for aggregate statistics for a single site or app;
- if they're third-party, the data isn't combined with other processing or passed on to others.
However, if your analytics tool doesn't meet these conditions, it needs consent like other non-technical cookies.
An example
A creator has a site with a sales page, a blog and a newsletter sign-up. She inventories her tools: analytics, a social platform pixel to measure ads, a video embedded from an external platform and the course login. The login uses technical cookies and stays as it is. She configures analytics with IP anonymisation and no data sharing, so it qualifies like a technical cookie. The ad pixel is profiling: she loads it only after consent, via a banner with an X at the top right and all categories set to refuse. For the embedded video she picks the mode that sets no cookies until play is pressed. She also adds a footer link to review choices. In practice, the inventory cut the cookies needing consent down to one, and the banner got simpler. The example is ours and isn't legal advice.
How often can you re-show the banner?
After a refusal, the guidelines allow re-showing the banner in only three cases: when processing conditions change significantly (for example the third parties involved), when it can't be known whether a cookie is already stored (for example because the user deleted cookies), or when at least 6 months have passed since it was last shown.
For example, ads that use pixels are covered in Meta ads to sell online courses; email consent in lead magnet ideas for creators.
Which mistakes should you avoid?
- Loading pixels before consent. Only technical cookies on first visit.
- A banner without an X. Refusing must be as easy as accepting.
- Pre-selected categories. They must all start on refuse.
- Treating scrolling as consent. On its own it isn't.
- Re-showing the banner on every visit. After a refusal you need one of the listed conditions.
Key terms. A technical cookie makes the site work or delivers a requested service. A profiling cookie links behaviour to people, usually for advertising. A cookie wall blocks access to anyone who doesn't accept cookies.
How we checked. We found the Italian guidelines the most detailed we could read, which is why we use them as the example. We read the Italian Garante's guidelines on cookies and other tracking tools (decision no. 231 of 10 June 2021, Official Journal no. 163 of 9 July 2021), in Italian. We didn't read other national regulators' guidance. Not legal advice. Contact: hi@heytea.app. Editorial note: we check every figure against the sources listed below and correct mistakes openly.
Frequently asked questions
Does a creator website need a cookie banner?
If it only uses technical cookies, a notice is enough and consent isn't needed. If it uses profiling cookies or third-party tools that don't qualify as technical, such as ad pixels, prior consent is required, and so a banner. The Italian data protection authority's 10 June 2021 guidelines describe in detail how it should work.
Does the banner need an X to close it?
Under the Italian authority's guidelines, yes: visitors must be able to refuse by closing the banner with a command marked by an X, at the top right, with the same visual prominence as the other buttons. Closing with the X keeps the default settings, meaning no non-technical cookies.
Does scrolling the page count as consent?
No. The Italian authority considers mere scrolling inadequate, on its own, to collect valid consent. At most it can be one component of a more structured process, never the only action.
Do analytics cookies need consent?
Not always. The guidelines treat analytics cookies like technical ones if they prevent identifying individuals (for example by masking at least the last part of the IP address), produce only aggregate statistics for a single site, and third parties don't combine the data with other processing.
How often can you show the banner again?
After a refusal, according to the guidelines, the banner may only be shown again if processing conditions change significantly, if it can't be known whether a cookie is already stored (for example because the user deleted cookies), or if at least 6 months have passed since it was last shown.
Sources
- Garante per la protezione dei dati personali (Italian data protection authority), "Linee guida cookie e altri strumenti di tracciamento", 10 June 2021. In Italian. Accessed 19 October 2026. garanteprivacy.it