A cookie policy for your website is needed as soon as you add Google Analytics, a Meta pixel or an embedded YouTube video, because each of them stores cookies on visitors' devices. In Latvia, as across the EU, most of those cookies also need consent first. Here's what the policy should say, which cookies are exempt and how to set up a fair banner.
What is a cookie policy for a website, and does yours need one?
A cookie policy tells visitors which cookies your website stores on their device, why, and how they can say no. In Latvia, Section 7.¹ of the Information Society Services Law allows storing anything on a visitor's device only after they've had clear information about the purpose and given consent.
That section brings Article 5(3) of the EU ePrivacy Directive into Latvian law, and the GDPR defines valid consent. The Data State Inspectorate (DVI), Latvia's data protection authority, explains both in its guidelines on cookies. So if your site runs Google Analytics, a Meta pixel or YouTube embeds, you need a cookie policy and a consent banner.
Which cookies can you use without consent?
Only technical, or strictly necessary, cookies. They're needed for the site to work or to deliver something the visitor asked for: keeping a shopping cart, finishing a payment, staying logged in or remembering the visitor's cookie choice. Every other cookie needs consent before it's set.
The DVI also calls technical cookies “necessary” or “functional”, but what counts is the purpose, not the label. The EDPB, the EU body of data protection authorities, has warned that some sites call cookies “essential” when they aren't. The DVI's advice is simple: if your site doesn't need a cookie, don't use it.
| Category | Examples | Consent needed? |
|---|---|---|
| Strictly necessary (technical, functional) | Login session, shopping cart, payment, security, storing the cookie choice | No |
| Preferences | A language or region the visitor picks | No, when the visitor chooses it |
| Analytics | Google Analytics (_ga), visit statistics | Yes |
| Marketing | Meta pixel (_fbp), advertising and remarketing cookies, embedded YouTube videos | Yes |
What should a cookie policy include?
It should let an average visitor understand which cookies you use and why. The DVI sets a minimum: what cookies are, which types you use and for what, and who receives the data, you or third parties.
In practice, a complete cookie policy covers:
- your company name, registration number and contact details;
- a plain explanation of what cookies are;
- the cookie categories and the purpose of each;
- every cookie with its name, purpose and storage period;
- the third parties that receive data, such as Google or Meta;
- how visitors give, change and withdraw consent;
- a link to your privacy policy and how you'll announce changes.
Keep the wording concrete. The DVI gives “we may use your personal data to offer personalised services” as an example of what not to write. Say what actually happens, for example that you keep purchase history to suggest similar products.
Using the DVI's sample cookie policy
The DVI has published a sample cookie policy in Latvian for a made-up company, in nine parts from general provisions and the list of cookies to rejecting cookies, withdrawing consent and changes to the policy.
Use it as a structure, not as a list to copy. Your list has to match the cookies your site really sets, with their real names and storage periods.
What does a compliant cookie banner look like?
A compliant banner shows two equal choices on its first layer, “Accept” and “Reject”, plus a link to the cookie policy or settings. Until the visitor chooses, no cookie that needs consent is set. If they reject, the site works as before, only without analytics and advertising cookies.
That's the DVI's position, and in 2023 the EDPB's cookie banner taskforce found that a vast majority of EU authorities treat a banner with no way to refuse next to the accept button as an infringement.
What works and what doesn't
Do
- A “Reject” button as visible as “Accept”
- Optional categories switched off by default
- One-click withdrawal, such as a “Cookie settings” footer link
- Each visitor's choice stored as proof of consent
- A new request when cookies or purposes change
Don't
- “By continuing to browse you accept cookies” with a single “OK”
- Treating a click on the “X” as consent
- Pre-ticked boxes in the settings
- “Reject” as a small text link or in faint, hard-to-read text
- Blocking purchases when a visitor rejects analytics
- Loading Google Analytics before the visitor chooses
Withdrawing consent must be as easy as giving it, under Article 7(3) of the GDPR; “change your browser settings” doesn't meet that, the DVI says. And in Planet49 (2019), the EU Court of Justice ruled that a pre-ticked checkbox isn't valid consent.
What is Google Consent Mode, and do you need it?
Google Consent Mode passes the choice a visitor makes in your banner on to Google's tags, such as Google Analytics and Google Ads. It doesn't collect consent itself: Google says that's your responsibility, so you still need a banner. If you run Google ads or remarketing, you need its signals too.
It sends four signals: ad_storage and analytics_storage for advertising and analytics cookies, ad_user_data for sending user data to Google for ads, and ad_personalization for personalised ads such as remarketing.
The last two have been needed since March 2024. Google's guidance says measurement, ad personalisation and remarketing only keep working for visitors in the European Economic Area if your site collects consent and passes these signals on.
Basic or advanced mode?
In basic mode, Google's tags don't load until the visitor chooses in the banner, and a refusal sends Google nothing at all. In advanced mode, the tags load straight away and send cookieless pings before consent, which Google uses to model missing data.
Basic mode is the cautious choice. Advanced mode gives more detailed ad measurement, so check it with your lawyer or data protection officer first.
How to set up cookie consent, step by step
Start with what your site already does, not with a banner tool. Once you know every cookie, you can write a true policy and set up a banner that blocks the right scripts. If you're planning a new site, put consent into the brief for website development from day one.
Six steps to cookie consent
Find every cookie
Open the site in a private window and check the cookies in the browser's developer tools, including on pages with forms, videos and the cart.
Sort them and drop what you don't need
Put each cookie in a category: necessary, analytics or marketing. Remove tools you no longer use.
Write the cookie policy
Follow the DVI sample's structure and add your own cookies with names, purposes and storage periods. Link the policy from the banner and the footer.
Set up a banner that blocks scripts
Pick a consent management platform (CMP) that really holds back analytics and advertising scripts until consent, and that supports Google Consent Mode if you use Google tools.
Connect Google Consent Mode
Set all four signals to “denied” by default and let the banner update them, in Google Tag Manager or your consent tool's settings.
Test it, then test it again
Reopen the site in a private window, click “Reject” and check that cookies such as _ga or _fbp don't appear. Repeat after every new tool or plugin, ideally as part of your website maintenance routine.
Before your banner goes live
- No analytics or advertising cookies before the visitor chooses.
- “Accept” and “Reject” on the first layer, equally easy to see.
- Optional categories switched off by default.
- The whole site works after “Reject”, including checkout and forms.
- A footer link to change or withdraw consent at any time.
- Every cookie listed with its name, purpose and storage period.
- Third parties that receive data named in the policy.
- Consent Mode signals sent to Google tools, if you use them.
- Visitors' choices stored so you can prove consent.
What happens if your cookies aren't in order?
In Latvia, the Data State Inspectorate supervises cookies. It inspects websites and orders companies to fix problems by a set date. For breaches of the consent rules, Article 83 of the GDPR allows fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher.
The DVI's 2023 and 2024 decisions on several Latvian websites show what it looks for. In two of them, including one about a news site, it found analytics and advertising cookies set without consent and no real way to refuse, and each time it ordered a consent mechanism that lets visitors genuinely choose.
Frequently asked questions
Do I need a cookie banner if my website has no ads?
If your site really sets only strictly necessary cookies, such as session or cart cookies, you don't need consent, so a banner with a choice isn't required. Check first for Google Analytics or embedded YouTube videos: if either sets cookies, you need a banner and a cookie policy. It's still worth describing the necessary cookies in your policy.
Can I use Google Analytics without cookie consent in the EU?
No. The DVI puts analytics cookies, including Google Analytics' _ga cookie, in the group that needs consent, so Google Analytics mustn't set cookies until the visitor agrees. In Google Consent Mode's basic mode, Google's tags don't load at all until the visitor chooses, which suits sites that want to stay cautious.
How long does cookie consent last?
There's no fixed period. The DVI says it depends on the context, the scope of the original consent and what the visitor would expect. Ask again whenever you change your cookies or their purposes, for example when you add a new advertising tool, and review consent regularly.
Can I use a cookie policy template?
Yes, as a structure. The DVI has published its own sample cookie policy with every section you need, from general provisions to withdrawing consent. Don't copy the cookie list from a template or another website, though: it has to show the cookies your own site sets, with their real names, purposes and storage periods.
Are cookie banners going away?
Not yet. On 19 November 2025 the European Commission published its Digital Omnibus proposal, which would, among other things, move the cookie rules into the GDPR and change how consent is asked for. The EU institutions are still negotiating it. Until it's adopted, the current Latvian law and the DVI's guidelines apply.
