Cookie consent for e-commerce sites: what you need and how to do it well

Cookies are small files and similar technologies that help a site remember things. Some are essential. Others track behaviour for analytics and advertising. The rules differ by country, so build a banner that meets the strictest rules you are exposed to. This is general information, not legal advice.

Types of cookies

What the rules say

• EU and UK: the ePrivacy rules and the GDPR generally require consent before setting non-essential cookies. Consent must be informed, specific and given by a clear action, and refusing must be as easy as accepting (GDPR guide).
• India: there is no standalone cookie law, but India's DPDP Act requires a clear notice and valid consent for processing personal data for stated purposes, which covers tracking that identifies people (DPDP guide).

If you sell to Europe as well as India, follow the stricter standard everywhere to keep it simple.

Build a fair banner

1. Explain in plain words what you use cookies for.
2. Offer equal choices: "Accept all" and "Reject non-essential" with the same prominence.
3. No pre-ticked boxes for optional categories.
4. Let people choose by category and change their mind later through a link in the footer.
5. Do not block the site unless the visitor agrees (no "cookie walls").
6. Do not nudge with hidden decline buttons or confusing wording, which India's dark-pattern guidelines and EU regulators target.

Technical points

• Hold optional scripts until consent is given where consent is required. A banner that is shown while trackers already fire does not comply.
• Record each choice with the time and version of the banner, so you can show it later.
• Honour changes and expiry. Re-ask after a reasonable period or when your cookies change.
• Keep a cookie list with name, purpose, duration and provider, and publish it in your cookie policy.

Keep measurement useful without tracking everyone

• Use privacy-friendly analytics that do not use identifying cookies, where appropriate.
• Rely on first-party data such as orders and email sign-ups.
• Use server-side measurement from your platform for sales and conversions.
• Expect lower numbers in tools that need consent, and focus on trends rather than exact counts.

What your platform should provide

A good platform offers a configurable banner, a cookie policy template and ways to switch off optional tools until consent. Orvexa's own site has a cookie preferences page with separate controls for analytics, functional and marketing cookies.

What to do next

Open your store in a private window, before clicking anything, and look at the cookies and requests it sets. If marketing trackers load before you have chosen, fix that first.