Why Does Every Website Have a Cookie Banner? (And Why This Recipe Site Doesn't)

Published August 2026

Quick answer: every website has a cookie banner because UK and EU rules say a site must ask before it stores or reads anything on your device that isn't strictly necessary — and most sites, especially ad-funded ones, do a great deal of that. The banner is the paperwork for tracking. A site that doesn't track doesn't owe you the paperwork, and that is the route we took: Drizzlelemons has no cookie banner because there is nothing on it to consent to.

A note on who is writing this: we build Drizzlelemons, an ad-free recipe converter, and this post explains a decision we made about our own site — so no, we are not a neutral party. Which is exactly why everything below is checkable from your own browser in about a minute, and we'll show you how.

Why does every website have a cookie banner?

Websites show cookie consent popups because they store or read things on your device that aren't strictly necessary to deliver the page — advertising identifiers, analytics cookies, retargeting pixels — and European privacy rules require asking first. The banner isn't decoration and it isn't a greeting. It is a consent form for tracking.

The reason nearly every site has one is that nearly every ad-funded site runs the same machinery. Display advertising works through real-time auctions: when a page loads, an ad-tech stack offers your attention to dozens of bidders, and each vendor in that chain — exchanges, data brokers, attribution services, the consent platform itself — wants to set or read its own identifier to recognise you again. Every one of those vendors becomes a row in the consent dialog. That is why the "vendors" list behind a banner's Manage Settings button can run into the hundreds, and why the banner arrived on a site roughly the same week its ads did.

Put simply: a cookie banner is not a legal requirement in itself. It is what a site owes you once it has decided to do non-essential tracking. Remove the tracking, and the obligation goes with it.

What a cookie banner is actually for (and what it isn't)

A cookie banner is how a website asks permission before storing or reading information on your device for purposes that are not strictly necessary. The rules behind it — PECR in the UK, the ePrivacy rules in the EU — cover any storage on your device, not just literal cookies: local storage, tracking pixels and device fingerprinting are all in scope. Strictly necessary storage needs no consent at all: a sign-in session, a shopping basket, the preferences you chose.

What it isn't: a general toll for operating a website, or a badge of compliance. A wall of toggles that takes four taps to refuse is not legally better than simply not tracking — it's just more profitable. This is how we read the rules as they apply to our own site, not legal advice; if you want the source rather than a recipe site's summary, the UK regulator's plain-English cookie guidance is genuinely readable.

Why recipe sites get the worst version of it

Recipe pages are among the most heavily monetised pages on the web, and the consent load scales with the ad load. When we measured 50 recipe sites, the median page transferred 3.3 MB over 120 requests and ran roughly 36 external scripts. The median recipe page contacts 27 third-party hosts — and each one that stores or reads something on your device is a row in that consent dialog. That is why the banner is at its worst exactly where you are trying to cook.

None of this makes food bloggers villains. Display advertising is how independent recipe developers get paid, and once a site takes ad money the whole apparatus — auctions, vendors, consent platform — arrives as a package. The consent popup is a structural consequence of the business model, not a moral failing. (Our longer essay on the reader's side of that bargain: why online recipes are so annoying.)

Are there websites without cookie banners?

Yes. Websites without cookie banners are the ones that only use strictly necessary storage: many documentation sites, personal blogs, small independent tools, and a growing set of products that swapped tracking analytics for cookieless kinds. They are rare among commercial sites because advertising is the default business model — it's the no-ads decision that makes the no-banner state possible, not a legal loophole.

One honest caution: the absence of a banner is not automatically virtue. A site can track you and simply fail to ask — that is worse, not better. The absence only means something if the site's storage genuinely is essential-only, which is exactly the kind of claim you can verify yourself in the browser. We'll do ours below.

What Drizzlelemons stores, and why there's no banner

We run no advertising and no third-party tracking, so the complete inventory of what this site keeps in your browser is short enough for one table:

What	Why it exists	Consent needed?
Essential cookies	Sign-in session cookies from our authentication provider so you stay signed in. If you start a checkout, Stripe sets its fraud-prevention cookies (__stripe_mid, __stripe_sid). Nothing on the site sets a cookie for advertising.	No — strictly necessary
Local storage	Your recipes, shopping list, weekly plan, theme and preferences, kept in your own browser so the app works instantly — and offline — even without an account. Your analytics choice is stored the same way.	No — it's the product working for you
Cookieless analytics	Vercel Analytics, served from our own domain: anonymous, stores nothing on your device, and cannot follow you across sites. We added an off switch anyway.	No — but you get a switch regardless

Our cookies do exactly two jobs: keeping you signed in, and letting Stripe prevent card fraud if — and only if — you start a checkout. There is no third job, and nothing for advertising. The full detail, plus the analytics opt-out switch, lives in the cookies section of our privacy policy — one switch, no settings maze, and flipping it takes effect immediately.

Worth being precise about local storage, because almost every "look, no cookies!" post on the web gets this wrong: the UK and EU rules cover any storage on your device, and local storage is squarely in scope. Ours passes the same test the sign-in cookie does — it is the strictly necessary kind, holding the recipes you asked us to save and the preferences you chose, used for nothing else. It is also yours in the fullest sense: you can export your recipes to a file you own whenever you like.

How to check any recipe site's claims in 60 seconds (including ours)

You do not have to take our word for any of this — or any site's. The browser you are reading this in can audit us right now:

1. Open the Network tab — press F12 (or right-click → Inspect), choose Network, and reload the page. Enable the Domain column or group by domain.
2. Count the third-party hosts — every domain that isn't the site you're on is someone else receiving your visit. On a median recipe page that's 27 hosts; ad exchanges and trackers dominate the list.
3. Open the Application tab — look under Cookies and Local Storage to see exactly what the site has stored on your device, and for whom.
4. Read the verdict — a site that claims it doesn't track you should show you a short, boring list. Long vendor lists and advertising domains mean the banner you clicked through was doing real work.

Run that here, signed out, and you'll find requests to drizzlelemons.com plus exactly one outside service: a call to our sign-in provider (api.stack-auth.com) checking whether you're signed in. No ad exchanges, no trackers, no analytics CDNs — our analytics is cookieless and served from our own domain. Under Application you'll find sign-in cookies, your own saved data, and nothing else. For the recipe sites that fail the check, we've written up ways to remove ads from recipe sites.

The honest caveats

"No tracking" is not the same as "no data", and a post like this earns its keep by being precise about the difference:

• One outside call exists. Pages talk to our sign-in provider to manage sessions, as described above. It is an authentication service, not an ad or analytics vendor — but it is a third party, and pretending otherwise would be exactly the kind of rounding-up this post is against.
• Checkout means Stripe. Payment pages are never tracker-free anywhere on the web, because fraud prevention needs device signals. Stripe's cookies appear only after you choose to start a checkout, and never before.
• Conversion uses AI on our servers. When you convert a recipe, the page text is processed by Anthropic's models server-side to extract the structured recipe. Your browser never talks to them, and the exchange carries the recipe — not your identity.
• Local storage is still storage. The rules treat it exactly like cookies, and so do we — it holds your data, for you, and you can export or delete it. "Nothing to consent to" describes our tracking, not an absence of engineering.

If you want to know more about who builds Drizzlelemons and why, that page is the honest version too.

Frequently asked questions

Is it illegal to not have a cookie banner?

No. A cookie banner is only required when a site stores or reads non-essential information on your device, such as advertising or analytics cookies. A site that only uses strictly necessary storage — sign-in sessions, a shopping basket, your own saved data — does not need one under UK and EU rules. What regulators actually police is the tracking, not the absence of a popup.

Does every website need a cookie consent banner?

No — only websites doing non-essential storage or tracking need to ask consent first, which in practice means most ad-funded sites. Sites that run no advertising and no tracking cookies don't need a banner at all. The near-universal banner says more about how common ad tracking is than about what the law demands of every website.

How do I stop cookie banners?

From the reader's side you mostly can't, because the banner is the site's obligation, not yours. The practical options are browser extensions that auto-answer consent dialogs for you, rejecting non-essential cookies whenever the choice is offered, and favouring sites that don't track in the first place. The banners disappear for good only where the tracking does.

What happens if I don't consent to cookies?

The site must still work: strictly necessary cookies keep functioning, so you can browse, sign in and pay. What you decline is the non-essential layer — mostly advertising identifiers and analytics — so you will typically see the same number of ads, just less precisely targeted, and the site keeps less of a record of your visit.

Does Drizzlelemons track me?

No. Drizzlelemons sets no advertising or tracking cookies and contacts no ad or tracking services from your browser. Its analytics is cookieless and anonymous — nothing is stored on your device and it cannot follow you across sites — and the privacy policy's cookies section includes a switch to turn even that off. Sign-in cookies exist only to keep you signed in.

How does Drizzlelemons make money without ads?

People pay for it directly instead of being sold to advertisers. Converting a recipe costs a lemon — a small credit — and cooks who want unlimited conversions buy a one-time Lifetime plan rather than a subscription. When readers are the customers, there is no reason to track them, which is why the site has no ads, no trackers and no cookie banner.