What is a cookie? Cookies explained for business owners

A cookie is a small piece of data a website stores in your visitors’ browser and reads again on later visits. For you as a business owner that’s not a technical topic but a money topic: cookies help decide what you know about your visitors, what your cookie banner has to do, and how many conversions Google Ads gets to see at all. Here it is in plain words, without a law lecture.

1. What is a cookie? The simple explanation

Mozilla’s developer documentation describes a cookie as a small piece of data that a server sends to a user’s browser. The browser can store it and send it back to the same server with later requests. Technically that’s all it is: a small note the website keeps in the browser.

Mozilla sorts what cookies are used for into three purposes:

• Session management: you stay logged in, the cart stays full, the form remembers where you were.
• Personalisation: the website remembers language or display settings.
• Tracking: visitor behaviour is recorded and analysed.

First party and third party

The most important difference for you is who sets the cookie.

• First-party cookies come from your own domain. Your shop’s cart is a typical example.
• Third-party cookies come from another domain, for example through embedded content. Mozilla writes that they have many legitimate uses, such as counting ad impressions. But a third party can also build a profile of browsing habits when the same browser sends it cookies across many websites.

The groups in the cookie banner

Banner tools usually sort cookies into groups such as “necessary”, “preferences”, “statistics” and “marketing”. Those aren’t legal terms, just a practical way of ordering them. The only question that matters is whether a cookie is strictly necessary for the service the visitor explicitly wants, or not.

One more clarification: German law doesn’t talk about cookies at all, but about information on the device. It covers anything a website stores on the device or reads from it, not just cookies.

2. What the cookie banner has to do in Germany

In Germany, § 25 TDDDG governs this. A website may only store information on a visitor’s device or read it from there if the visitor has consented on the basis of clear and comprehensive information. The exception is anything strictly necessary to provide a service the user has explicitly asked for. In practice that means the banner asks before anything is stored or read, explains clearly what for, and doesn’t make “no” harder than “yes”. The data protection authority of Lower Saxony takes the view that, under certain circumstances, a banner needs an equally visible “Reject all” button, and the Administrative Court of Hanover confirmed that view in March 2025. I’m not a lawyer, and this isn’t legal advice.

A banner on the page proves nothing yet

I measured how often banner and reality diverge. For my study on tracking before consent, I opened German business websites in a real browser in September 2026, without clicking anything. Of 41,161 reachable sites:

• 59.5% had a cookie banner the browser could detect,
• 8.8%, or 3,619 sites, sent data to a measurement or advertising service before the first click, with no “denied” signal,
• on 2,619 of those 3,619 sites, a banner nobody had answered yet was on screen.

The numbers are available as an open dataset (in German) with CSV and JSON downloads. The lesson: what matters isn’t whether there’s a banner, but whether the tags wait for the answer. What the law actually requires, and which setups exist, is covered in detail in Tracking and cookie consent in Germany.

3. What Google Ads sees without consent

For your advertising, every “no” has a direct consequence. Google tags that listen to Consent Mode follow the decision in the banner. According to Google, Consent Mode doesn’t come with a banner itself; it only takes the decision from yours.

It comes in two variants:

• Basic: Google tags wait until the visitor has decided in the banner. According to Google, nothing is transmitted to Google before that decision. If the visitor declines, Google gets no data from them afterwards either.
• Advanced: Google tags load when the page opens. As long as consent is denied, they send measurements without cookies.

Modelled conversions, but not for every account

Based on the visitors who consented, Google can estimate the conversions of the others. These estimated conversions then appear in your Google Ads reports and feed into bidding. Google names two conditions for this: a correctly implemented Consent Mode, and at least 700 ad clicks over a seven-day period, per country and domain grouping.

For many small and medium accounts in Germany, that means modelling doesn’t kick in. Anyone who declines is missing from the conversions. Your account sees fewer enquiries than you actually receive, and Smart Bidding learns from that slice. It isn’t a bug you can configure away; it’s the price of consent.

What to do about it

• Set up Consent Mode. For users in the EEA, Google requires you to collect consent and send the signals to Google if you want to keep using measurement, ad personalisation and remarketing. The steps are in Consent Mode v2 setup.
• Plan for the gap. Judge campaigns on what consent leaves you, and compare the number of enquiries in Google Ads with your inbox or CRM.
• Don’t let your banner be decoration. A banner that blocks nothing doesn’t protect you and still distorts your numbers.

The bottom line

• A cookie is a small note in the browser. First-party cookies come from your domain, third-party cookies from others.
• § 25 TDDDG requires consent before a website stores anything on the device or reads from it, unless it’s strictly necessary for the requested service.
• The banner has to ask before anything is measured, and “no” must not be harder than “yes”.
• In the study, 59.5% of sites had a banner, and still 8.8% sent data before the first click.
• Without consent, conversions go missing in Google Ads. Modelling needs at least 700 ad clicks in seven days per country and domain grouping, which small accounts often don’t reach.

Not sure your banner and your tags fit together? If there’s a specific decision to make, such as basic or advanced Consent Mode, a new banner tool or setting up the old one properly, the Clarity Session is the right step: from €390, a 60-minute video call. You settle the legal question with your lawyer and the technical one with me. If you want your tracking checked in full, the conversion tracking audit covers that. Whether the session fits is something you can check first in a free intro call. Book a free intro call.

FAQ

Do all cookies need consent?

No. Anything strictly necessary for a service the user explicitly asked for doesn’t need consent under § 25 TDDDG. Cookies for statistics and advertising usually don’t fall into that category. In the individual case, your lawyer or data protection officer decides.

What’s the difference between first-party and third-party cookies?

First-party cookies are set by your own domain, third-party cookies by another one, for example through embedded content. Third-party cookies can be used to recognise visitors across many websites.

Do I need a cookie banner if I only use Google Analytics?

Yes. If Google Analytics stores information on the device or reads it, § 25 TDDDG requires consent, so you need a banner that asks first. Whether you need GA4 at all is covered in GTM vs GA4.

What happens to my Google Ads data when visitors decline?

With Consent Mode in basic mode, Google gets nothing from those visitors. In advanced mode, measurements without cookies come in. Estimated conversions only exist if your account reaches at least 700 ad clicks in seven days per country and domain grouping.