Guide · June 17, 2026
Free cookie banner for online stores: grouping and rollout
Guide to a free cookie banner for online stores: group cart/checkout vs marketing cookies and deploy quickly, PDPL-compliant.
Quick answer
What is a free cookie banner for online stores?
A free cookie banner for online stores is the layer of notice and accept/decline choices on the website that helps you distinguish cookies necessary for processing orders from cookies used for marketing. For SMEs, this is the minimal approach to reduce compliance risk while keeping a stable shopping experience.
The important point is that not all cookies are the same. Cart, login, and keeping the checkout session are typically essential cookies for the website to operate. Remarketing cookies, behavioral measurement, and ad pixels generally trigger a duty to obtain consent and allow users to change their choices.
How to group cart/checkout cookies vs marketing?
You should separate cookies by purpose, not just by technical name. This is easier to explain to customers and easier to configure on a small storefront, especially if you use Shopify, WooCommerce, Haravan, Sapo, or a custom-coded site.
| Cookie group | Real-world examples | Can be enabled by default? | Consent required? | Implementation notes | |
|---|---|---|---|---|---|
| Necessary | keep login session, cart, CSRF token, save checkout state | Yes | Usually no, if truly needed to provide the service | Only enable those directly serving the transaction | |
| Analytics | Google Analytics, funnel measurement, heatmaps | Should not be default | Usually yes | Load only after the user consents | |
| Marketing | Meta Pixel, Google Ads remarketing, TikTok Pixel | Should not be default | Yes | Do not fire before a clear choice is made | |
| Preferences | remember language, region, display size | It depends | Case-by-case | Explain briefly, in plain language |
A practical example: an online clothing shop may put “cart”, “login session”, and “save shipping address” in the necessary group; while “measure orders from Facebook Ads” goes in the marketing group and is only activated when the user clicks accept.
How to deploy a free cookie banner for online stores?
You can do this for free with a plugin, custom script, or built-in settings from your website platform. The key is not a pretty banner, but a banner that blocks non-essential trackers upfront and records valid choices.
Inventory cookies and trackers:
list all cookies running on the website: cart, checkout, chat, analytics, ad pixels, embedded video, live chat.
Group by purpose:
at minimum have “Necessary”, “Analytics”, and “Marketing”. If your shop is small, don’t over-segment into too many confusing groups.
Block non-essential by default:
marketing and analytics scripts must load only after the user consents.
Keep the banner short and clear:
state the purposes, provide “Accept”, “Reject”, and “Customize”. Don’t use vague wording like “by continuing you agree”.
Store consent evidence:
save the timestamp, banner version, the user’s choices, and a technical ID if available. This is what many SMEs overlook.
Add a change-choice button in the footer:
users must be able to reopen the banner/cookie settings at any time.
Test before running ads:
use incognito/private mode to ensure pixels don’t fire before consent.
If you don’t have a dev team, the fastest way is to use a cookie consent management plugin on your CMS. If you do have devs, implement a “deny by default” approach for marketing/analytics groups and only “fire on consent”.
How should you write sample content for a free cookie banner?
For a small shop, the banner should be concise, purpose-driven, and not make customers feel forced. Below is a ready-to-use template you can adapt to your technical stack.
Sample banner text: “We use necessary cookies to operate the cart and checkout. For analytics and marketing cookies, we only use them when you consent. You can view details or change your choices at any time.”
Suggested buttons:
- Accept all
- Reject non-essential
- Customize settings
Sample cookie group descriptions:
- Necessary: help the site run, keep the cart, and process orders.
- Analytics: measure visits and improve the experience.
- Marketing: support advertising and remarketing.
What to avoid is lumping everything into a single sentence like “by using the website, you agree to all cookies.” For online stores, this is both hard to explain and hard to prove that a clear choice was obtained.
Do you need to keep cookie consent evidence?
Yes. With a free cookie banner for online stores, storing consent evidence is as important as the interface. In case of a dispute or regulatory inspection, you need to know who chose what, when, and what content the banner displayed at that time.
At a minimum, store: the time of consent/decline, the cookie groups selected, the version of the policy/cookie notice, and technical traces appropriate to your system. If the website has customer accounts, you can attach a hashed user ID or session token.
How does the cookie banner relate to the PDPL from 01/01/2026?
It does. The Personal Data Protection Law (Law 91/2025/QH15) takes effect from 01/01/2026, replacing/upgrading the framework of Decree 13/2023/ND-CP. For cookies and trackers, businesses should pay attention to transparency, obtaining consent where needed, and managing data by purpose.
The enforcement authority is the Ministry of Public Security, specifically the Department of Cybersecurity and High-Tech Crime Prevention (A05). Specific penalties will be set by the Government’s guiding decree; serious violations may be subject to criminal handling as provided by law.
When should you ask a lawyer or technical team for help?
If your website uses ad pixels, shares data with third parties, or runs multichannel sales with CRM/email automation, review your setup before enabling the banner. If you use a free tool but cannot block trackers before consent, ask a lawyer or developer to check the configuration.
If you need a compact banner with consent logs and easy SME integration, consent.vn can help you go from cookie notice to DSAR without having to figure out every piece yourself.
- Usually you don’t need consent for cookies that are genuinely necessary to keep the cart, log in, and process payment. But you should still describe them in the cookie policy.
- Under the rules, they should be blocked by default and only enabled after the user consents. This is especially true for advertising and remarketing pixels.
- It may be sufficient at a basic level if the plugin blocks trackers before consent and records consent evidence. You should still test your actual configuration.
- You should have at least three groups: necessary, analytics, marketing. This is easy to understand, implement, and justify when needed.
Source: Luật 91/2025/QH15 thuvienphapluat.vn; Nghị định 13/2023/NĐ-CP thuvienphapluat.vn; Bộ Công an/A05 bocongan.gov.vn
Get started — set up in 5 minutes.
Need help with PDPL compliance?