Cookie Consent Banner POPIA: What You Need

By Next Level Web Solutions · · 6 min read · Compliance and trust

If your South African website uses cookies or scripts beyond what it needs to function, a cookie consent banner for POPIA is the cautious way to handle it. A good banner explains what runs, offers accept, reject and manage choices, and, most importantly, stops non-essential scripts from loading until the visitor agrees.

The Protection of Personal Information Act does not name cookies, and South Africa has no dedicated cookie law like the EU's ePrivacy rules. To our knowledge the Information Regulator has not issued dedicated cookie guidance. But cookies and similar identifiers often relate to identifiable people, so most advisers recommend treating them as personal information. This article is general information, not legal advice.

Cookie consent banner for POPIA: which cookies need consent

Think in terms of what the cookie does, not what it is called. Ask two questions about every cookie, pixel or script on your site: is it strictly needed for something the visitor asked for, and does it track or profile the visitor?

Things that generally warrant consent:

  • Analytics: tools that record visits and behaviour, including Google Analytics and similar products.
  • Advertising and remarketing pixels: Meta Pixel, Google Ads tags and the like.
  • Embedded third-party content: YouTube videos, social feeds and some map embeds that set their own cookies.
  • Heatmaps and session recording tools.
  • Chat widgets that store identifiers before the visitor starts a chat.

If you are unsure, load the site in a private browser window, open the browser's developer tools, and look at the cookies and network requests that appear before you click anything. That is your real starting position.

Essential vs non-essential

Essential cookies are those without which the site or a requested feature would not work. Typical examples are a session cookie that keeps someone logged in, a shopping cart, a security token that protects a form from forgery, and a cookie that remembers the visitor's cookie choice itself. These generally do not need opt-in consent, though you should still disclose them.

Non-essential cookies are everything else. The common mistake is classing analytics as "essential" because it is useful to you. Usefulness to the business is not the test. If the visitor would still get their quote form or their page without it, it is non-essential.

A practical way to sort them is a simple table with four columns: name, provider, purpose, lifespan. Group them as essential, preferences, analytics and marketing. This table becomes the backbone of your cookie policy and your banner's "manage" panel.

Banner elements: accept, reject, manage

A banner that is fair and clear usually includes:

  1. A short explanation: one or two sentences on what cookies you use and why.
  2. An accept button: allows all categories.
  3. A reject button of equal visual weight: declines everything non-essential. Hiding it behind a "manage" link, or styling it so faintly that it looks disabled, undermines the point of consent.
  4. A manage option: lets people switch categories on or off individually, with non-essential categories off by default.
  5. Links to your cookie policy and privacy policy.
  6. A way to change the choice later, such as a "Cookie settings" link in the footer.

Avoid pre-ticked boxes, wording that guilt-trips the visitor, and banners that cover the whole page when a bar at the bottom would do. Consent should be a free, informed choice, and a banner that pushes people towards "accept" is weaker evidence of that.

Blocking scripts until consent

This is where most banners fail. A banner that merely sits on top of the page while Google Analytics and a Facebook pixel already fire in the background is decoration, not consent.

To do it properly:

  • Load non-essential scripts only after the visitor accepts the relevant category. Many consent tools do this by changing script tags so they do not execute until permission is granted.
  • Use consent signals where the tool supports them. Google's tags, for example, support a consent mode that lets you set analytics and advertising storage to denied by default and update it once the visitor chooses. Check Google's current documentation for the exact setup.
  • Load third-party embeds on click. A video can show a placeholder with "Load video" so YouTube cookies are only set once the visitor presses play.
  • Store the visitor's choice in a first-party cookie or local storage, and respect it on later visits.
  • Keep unused tags out entirely. Every removed script is one less thing to consent to and one less thing slowing the site.

If you are working out which tools you actually need for a Google Analytics consent setup, the data inventory in our POPIA website compliance checklist is a good starting point.

Cookie policy and privacy link

The banner is the short version, and the cookie policy is the full one. It should list the cookies and similar technologies you use (using the table above), explain each purpose, state how long they last, say who sets them, and tell the visitor how to change their mind or clear cookies through their browser. Some businesses put the cookie section inside the privacy policy instead of a separate page, which is acceptable as long as it is easy to find and complete.

Link to it from the banner and the footer. For wider guidance on what the main document should contain, see what a privacy policy for a South African website should say.

Testing that declines really stop tracking

Testing is the step most owners skip. Do this after every change:

  1. Open a fresh private window and visit the site.
  2. Open developer tools, go to the Application or Storage tab, and note which cookies exist before you interact.
  3. Click "reject" and reload. Confirm no analytics or advertising cookies appear and no requests go to tracking domains in the Network tab.
  4. Click "accept" in a new private window and confirm the tools now load.
  5. Change the choice using the footer link and confirm the behaviour changes.
  6. Repeat on a phone.

If a decline still sends requests to an analytics domain, the banner is not doing its job and you should treat that as a defect to fix before launch.

Reviewing as your tools change

Cookie lists drift. A new plugin, a marketing agency adding a pixel, or an embedded form from a third party can introduce new trackers overnight. Set a reminder to rescan the site every few months and whenever tools change, then update the banner categories and cookie table to match. Tag managers make this easier but also make it easier for unnoticed tags to creep in, so review them regularly.

If you would like the banner, scripts and policy wired up properly as part of a build or a tidy-up, see our website services or contact us. This article is general information, not legal advice, and a lawyer should review your approach if you handle sensitive data.

Frequently asked questions

Do I need a cookie banner?

If your site uses non-essential cookies or tracking such as analytics or advertising pixels, asking for consent is the cautious approach under POPIA. If you only use strictly necessary cookies, you may not need a consent banner, but you should still disclose them in your privacy or cookie policy.

Is a banner alone enough?

No. The banner has to be backed by behaviour: non-essential scripts must not run until the visitor consents. You also need a matching cookie policy and a way for people to change their choice later.

Want this done for your business?

Book a free call →