Cookie consent on your website: why it applies to everyone collecting visitor data

In short

A consent solution, often called a cookie banner or CMP, is not legal decoration. It has to prevent analytics, ad tracking and third party content from loading before visitors have said yes. More than half of the websites we scan have a banner but still load tracking before consent. Then you carry the cost of a banner without being compliant.

What the law requires

Norway's new Electronic Communications Act (ekomloven) came into force on 1 January 2025 and requires that consent to cookies and similar technology meets the GDPR standard. That means consent has to be freely given, specific, informed and unambiguous. Pre ticked boxes and "by using this site you agree" no longer hold up. The Norwegian Data Protection Authority supervises the processing of personal data, and Nkom supervises the consent requirement in the act itself.

In practice that means three things:

• Non essential scripts must be blocked until visitors have said yes
• It must be as easy to decline as to accept
• Consent must be documented and possible to withdraw

Who this applies to

Everyone using anything beyond strictly necessary cookies. That includes Google Analytics, Google Ads and the Meta pixel, Hotjar and similar tools, embedded YouTube and Vimeo videos, Google Maps, chat widgets, external fonts loaded from third parties, and forms that set tracking. If you have one of these, you are collecting data about visitors, and the requirements apply to you. It makes no difference whether you are a sole trader or a listed company.

The most common mistakes we see

• The banner is cosmetic. Scripts load regardless of what the visitor chooses.
• Embedded content tracks before consent. A YouTube video sets cookies the moment the page loads.
• Google Consent Mode is not set up. Then you lose ad data in Google Ads even if visitors say yes later.
• Decline is hidden away. A big "Accept all" button and a small link to settings is not a free choice.
• No log. When someone asks what visitors consented to, there is no answer.

How our consent solution works

We implement Consent Pro on Webflow websites. The solution blocks scripts and embedded content before consent, categorises trackers into necessary, analytics and marketing, and logs every consent so it can be documented. Google Consent Mode v2 is set up so advertising and analytics work correctly after consent is given. The banner is designed to match your brand, and visitors can change their choice at any time.

We use the same solution on simmer.no. As a provider of consent solutions, we cannot run a non compliant website ourselves.

Start with a free scan

We have built a free scanner that shows which scripts, embeds and cookies load on your website before visitors have given consent. You get the answer in seconds, no signup. Scan your website here. If you are unsure what the result means, we go through it with you and give you a concrete plan.

Frequently asked questions

Do I need a consent banner if I only use Google Analytics?
Yes. Google Analytics sets cookies and processes personal data, and requires consent before it loads.

Can I measure traffic without consent?
Yes, with analytics tools that do not use cookies and do not identify individuals. We help you set this up as a supplement.

Does the solution work on platforms other than Webflow?
Consent Pro is built for Webflow. If you are on another platform, we are happy to talk about what fits.

What does it cost?
Implementation is priced per website based on scope. Get in touch for a quote after the scan.

See also: consent solution for Webflow and frequently asked questions.