Cookie banners: does a US small business website need one?

Most US small businesses that serve local customers do not need the large "accept all cookies" banner seen on European websites. Those banners come mainly from European rules, which apply to sites aimed at people in Europe. In the US, the usual approach for a small local business is a clear privacy policy that mentions cookies, plus, if you run ad tracking, an easy way to opt out. That changes if you serve European customers, use heavy ad tracking or fall under a state privacy law. Here is how to think it through. It is not legal advice; check your situation with your attorney.

A cookie is a small note a website stores in a visitor's browser, so it can remember something next time: that they are signed in, what is in their cart, or that they visited before. Some cookies are needed for a site to work. Others are used to count visits or to show ads to people who visited.

On a typical small business site, cookies may come from:

The website itself, to keep it working. Many simple sites set none.
Visitor statistics, such as Google Analytics.
Ad tracking, such as the Meta pixel or a Google Ads tag.
Embedded content: a YouTube video, a Google map, a booking widget or a social feed placed inside your page.

Why European sites show big banners

The European Union and the UK have rules that require websites to ask permission before setting cookies that are not strictly needed, such as analytics and ad cookies. That is why European sites show a banner with "Accept" and "Reject" buttons before anything else.

Those rules are aimed at sites that serve people in Europe. A plumber in Ohio or a bakery in Texas whose customers are local is not usually who they are written for. If you do actively serve European customers, for example by shipping there, taking bookings from European tourists or advertising in Europe, ask your attorney whether those rules reach you.

What US rules usually expect instead

In the US, the general approach is notice and choice rather than permission first:

A privacy policy that says what the site collects, including cookies, and how visitors can block them. California's online privacy law requires a policy for commercial sites collecting personal information from Californians, and many tools require one in their terms. Do you need a privacy policy? explains what goes in it.
State privacy laws. California and a growing number of other states have broader consumer privacy laws. Many apply only to businesses above certain size or data thresholds, which most small local businesses do not reach, but check with your attorney. Where they apply, they can require an opt-out from the "sale" or "sharing" of data, which can include some ad tracking.
Browser privacy signals. Some browsers send a "Global Privacy Control" signal meaning the visitor does not want their data sold or shared. Under some state laws, businesses those laws cover are expected to honor it.
Honesty. Whatever your site says about cookies has to be true. The FTC treats misleading privacy statements as deceptive.

Three typical situations

Your site has no statistics and no ads. Just your pages, a contact form and maybe a map. You likely need no cookie banner. A sentence in your privacy policy about cookies from embedded content is common practice.

Your site uses basic visitor statistics. Google Analytics or similar. Most US local businesses in this spot mention it in the privacy policy, say what it is for, and explain how to block cookies or opt out. Google offers a browser add-on for opting out of Analytics; its help pages on support.google.com explain it. Some owners choose a privacy-friendly statistics tool that sets no cookies, which removes most of the question. Website analytics without spying on visitors looks at those options.

Your site runs ad tracking. A Meta pixel, Google Ads remarketing or similar. Here a light notice is more often worth it: a small, polite line at the bottom of the screen saying the site uses cookies for ads and statistics, with a link to opt out and to the privacy policy. The ad platforms' own terms also ask you to tell visitors. If a state privacy law covers you, an opt-out may be required.

What a light notice can say

For a US small business with ad tracking, a notice is often as short as:

"We use cookies to count visits and to show our ads to people who've been here." Then a link labeled "Privacy and opt-out".

Behind the link, explain what each tool does and how to turn it off. If you can, honor the visitor's choice for real: when someone opts out, the ad pixel should not load for them. Whoever runs your site can tell you whether your builder supports that.

Mistakes to avoid

A banner that does nothing. "By using this site you agree to cookies" with only an "OK" button, while tracking runs regardless, tells visitors nothing useful and may misdescribe what you do.
A banner copied from a European template that asks visitors to manage ten categories of cookies on a five-page site.
Forgetting embedded content. A YouTube video or a booking widget can set cookies even if you did not add any tracking yourself.
A notice that covers the phone number or the call button on a phone.
Saying you set no cookies when your statistics tool or an embed does.

Check what your site actually sets

Before deciding anything, find out what your site does today:

Ask whoever built or runs it which statistics, ad and booking tools are installed.
Look at your builder's settings for analytics, marketing or tracking integrations.
Check for an old pixel left by a previous agency or ad campaign. It is common to find tracking nobody remembers adding.

Remove anything you no longer use. Fewer tools means fewer cookies, less to explain and a faster page.

What to do this week

List the tools on your site that set cookies: statistics, ad pixels, embeds, booking widgets.
Remove any you do not use.
Make sure your privacy policy mentions cookies and how to opt out.
If you run ad tracking, consider a small, bottom-of-screen notice with an opt-out link.
If you serve European customers or may fall under a state privacy law, ask your attorney.

If your current site carries old tracking code and a banner nobody understands, you can see your site rebuilt first, clean and fast, and decide what to add back.