A policy is disclosure. A banner is the mechanism.
Regulation 6 of PECR is about not storing or accessing information on somebody's device until the conditions are met. That is something your site does, not something it says.
A cookie policy explaining what you set is disclosure, and it is required. It does not stop a single tag firing. Most small sites have the prose and not the mechanism, which is the wrong half of the job and the half that is easier to write.
Three tiers, not two
Nearly every cookie tool presents this as essential versus everything else. Schedule A1 is more specific than that, and the middle tier is where most small sites live.
Nothing needed. Technical storage for carrying out a transmission, and anything strictly necessary for a service the user asked for. The Schedule expressly includes security, fraud prevention, fault detection and authenticating users. Sessions, baskets and the cookie remembering this very choice are all here.
Notice and an opt-out, but no prior consent. Statistics whose sole purpose is understanding how the service is used with a view to making improvements, provided the information is not shared with third parties and there is a simple way to opt out. Also cookies that adapt the site to somebody's preferences or improve its appearance.
Opt-in consent. Everything else. Advertising, third-party analytics, embeds.
Which means some sites do not need a banner
A site with essential cookies, a dark mode preference and self-hosted analytics has nothing in the opt-in tier. It needs clear notice and a working opt-out, not a wall in front of the content.
That is a real answer and this tool gives it. Building a consent wall you do not need costs you visitors and gains you nothing, and it is what happens when a tool assumes every site is the same site.
The line that catches people is the third-party one
The statistics exception has a condition attached: the information must not be shared with third parties.
Self-hosted analytics can satisfy that. Google Analytics cannot, because sending the data to Google is sharing it with a third party. The same numbers, the same purpose, a different tier, entirely because of where the data ends up.
Free hosted analytics is generally free because the data is the payment, which is worth remembering when deciding which of the two you have.
How blocking has to work
A script that has already run cannot be un-run. So anything that claims to block tags after the page has loaded is decorative: the request went out, the cookie was set, and the consent banner is arguing with something that already happened.
The only approach that works is not putting the script on the page at all. Your tags go in with type="text/plain" and a category attribute. The browser sees something it does not recognise as JavaScript and leaves it alone. When somebody consents, the banner swaps the type and the tag runs for the first time.
It is slightly fiddly to set up once and it is the difference between a banner that works and a banner that looks like it works.
Two things people expect to help, which do not
Non-personalised advertising. Still storage on somebody's device, still needs consent. It buys a lower revenue per thousand impressions and no relief from the banner at all.
Frequency capping. Sounds like housekeeping. It is information stored on a visitor's device to remember what they have seen, which is exactly what the regulation is about.
Rejecting has to be as easy as accepting
The banner here puts Reject next to Accept, same size, same prominence, not behind a settings link.
A design where accepting takes one click and refusing takes three is the specific thing regulators have been writing to organisations about, and it is the default in a lot of the paid tools because it produces better consent rates. Better consent rates obtained that way are the problem rather than the point.
Common questions
Do I need a cookie banner?
It depends which tier your cookies fall into, and there are three rather than two. Strictly necessary cookies need nothing. First-party statistics and preference cookies need clear notice and a simple opt-out, but not prior consent, provided the data is not shared with third parties. Everything else, notably advertising and third-party analytics, needs opt-in. A site running only essential and self-hosted analytics may not need a blocking banner at all.
I thought all analytics needed consent
That is the version most cookie tools still tell you, and Schedule A1 to PECR is more specific. It permits collecting data for statistical purposes about how a service is used with a view to making improvements, on notice and an opt-out, but only where the information is not shared with third parties. Self-hosted analytics can meet that. Sending the same data to an analytics company cannot, because that is sharing it with a third party.
Is a cookie policy enough on its own?
No. A policy is disclosure. Regulation 6 is about not storing or accessing information on somebody's device until the conditions are met, which is a mechanism rather than a document. A page of prose explaining what you set does not stop anything being set. Most small sites have the policy and not the mechanism, which is the easiest half to get backwards.
How does the blocking actually work?
By never putting the script on the page in the first place. Your tags go in as type="text/plain" with a category attribute, which the browser will not execute, and the banner switches them on only for the categories somebody has allowed. That is the only approach that genuinely works: a script that has already run cannot be un-run, so anything claiming to block tags after page load is decorative.
Does non-personalised advertising avoid the banner?
No, and neither does frequency capping. Both still store or access information on the visitor's device, and that is what regulation 6 is about rather than whether the advertising is targeted. Serving non-personalised ads buys you a lower revenue per thousand and no relief from consent at all.
What about a YouTube embed?
It sets third-party cookies when the page loads, not when somebody presses play, which is the part people get wrong. A video nobody watches has already talked to Google by the time the page finishes rendering. Either hold the embed back with the banner or replace it with a click-to-load placeholder, which is usually faster anyway.
Why do the free banner tools have limits?
Because the banner is the funnel. CookieYes caps its free tier at 5,000 pageviews a month and keeps its own branding on your banner until the paid tier; Cookiebot, Termly and OneTrust meter the same way. What this produces is one file you paste into your site. It loads nothing, it phones nobody, and there is no tier for it to be limited by.