Cookie banners are the most visible piece of privacy compliance, and one of the most misunderstood. Some small business sites have no banner at all, some copied a pushy one that annoys visitors and blocks nothing, and very few know which of the two they actually need. This guide explains, in plain language, what cookies and website tracking are in practice, what a Canadian small business genuinely needs to do about consent, and how to avoid both extremes. It is general guidance, not legal advice.
What we are really talking about
A "cookie" is a small file a website stores in a visitor's browser. Some are essential: they keep you logged in, remember what is in a cart, or make the site work at all. Others exist to watch behaviour: analytics that count visitors and track what they click, and advertising or "pixel" trackers from Google, Meta, or LinkedIn that follow people across sites to target ads. The word "cookies" is really shorthand for this second group, the tracking, because that is what raises the privacy questions. The honest first step is simply knowing which trackers your own site runs, and most owners are surprised by the list.
Essential versus non-essential, the distinction that matters
Almost every rule in this area turns on one split. Essential cookies, the ones strictly needed to deliver a service the visitor asked for, generally do not require opt-in consent, though you should still mention them. Non-essential cookies, analytics, advertising, and cross-site tracking, are the ones that call for meaningful consent, because the visitor is not asking to be tracked, you are choosing to track them. Get this split clear for your own site and most of the confusion evaporates: you are not asking permission to run your website, you are asking permission to observe people while they use it.
What the law expects in Canada
Canada does not have a single "cookie law" like Europe's, but the principle still applies through PIPEDA and provincial laws such as Quebec's Law 25: collecting personal information, and tracking behaviour counts, requires meaningful, informed consent, and Law 25 specifically expects tracking technologies to be off by default until someone turns them on. In practice, if you serve customers in Quebec or in Europe, or you simply want to be on the right side of it, the safe posture is: tell people plainly what you collect, and get genuine consent before loading non-essential trackers. This sits alongside your broader privacy policy, which is where the detail lives; the banner is just the consent moment.
What a good cookie banner actually does
- It offers a real choice. "Accept" and "Reject" should be equally easy. A giant "Accept all" button next to a buried "manage settings" link is the pattern regulators increasingly frown on.
- It waits before tracking. The point of consent is that non-essential trackers do not load until the visitor agrees. A banner that fires Google Analytics and ad pixels the instant the page opens, then asks, is decorative, not compliant.
- It is honest and brief. Say what categories of cookies you use and why, in plain words, and link to your privacy policy for the detail. Nobody reads a wall of text.
- It remembers the answer. Do not nag a visitor who already chose. Store their preference and let them change it later through a small link.
You do not have to build this. Reputable consent-management tools plug into common website platforms and handle the banner, the "wait until consent" behaviour, and record-keeping for you. The job is to pick one and configure it honestly, not to hand-code it.
The trap: collecting more than you need
The quiet mistake is not the banner, it is the pile of trackers behind it. Many small business sites load analytics, a heat-mapping tool, three ad pixels, and an embedded widget or two, most added long ago and never questioned, each one sending visitor data to a different company. Every tracker you run is something you must disclose, justify, and protect. The most under-rated move here is subtraction: audit what your site actually loads, and remove the trackers you are not genuinely using. Less tracking means a simpler banner, a shorter privacy policy, and less risk, at no real cost to the business.