Those "Accept all cookies" pop-ups are everywhere, so plenty of Kiwi business owners assume their website legally needs one too. Here's the good news: most New Zealand websites don't — and the ones that do usually only need it because of choices that are entirely avoidable.
Where cookie banners actually come from
The banner plague is European law: the EU's ePrivacy rules and GDPR require websites to get consent before setting non-essential cookies — the tracking kind that advertising platforms use to follow people around the internet. European sites must ask; sites with lots of European visitors often ask to be safe; and everyone else copied the pattern because it looked like compliance.
New Zealand has no cookie-banner law. Our privacy framework is the Privacy Act 2020, and it takes a different approach: it doesn't regulate cookies as such — it regulates collecting personal information.
What NZ law actually expects from your website
Under the Privacy Act, if your website collects personal information — a name and email in a contact form is already enough — you're expected to be upfront about it:
- Tell people what you collect and why. That's a privacy policy page, in plain language.
- Only collect what you need, keep it safe, and let people ask what you hold about them.
That's the real compliance work for a typical NZ small-business site: an honest privacy page, not a consent pop-up. Every site I build ships with one as standard — written in plain English, editable by the owner, and covering exactly what that specific site does. (My own privacy policy is the template's big sibling, if you want to see the style.)
"But my website has analytics — don't I need a banner for that?"
This is where it gets interesting, because it depends on which analytics.
Google Analytics works by setting tracking cookies and building visitor profiles across sessions — that's the sort of tracking that drags EU-style consent questions (and awkward privacy-policy paragraphs) in the door, and it's why so many sites felt obliged to add banners.
But there's a whole generation of cookieless analytics now — I use one called Umami on the sites I build. It counts visits, popular pages, and where traffic comes from, without setting a single cookie and without collecting any personal information at all. Visits are anonymised; nobody can be identified or followed across the web.
No cookies, no personal information, nothing to consent to — no banner needed. And the business owner still gets the numbers that actually matter: how many people visited, what they looked at, and whether that Facebook post did anything.
The banner-free website, by design
So the recipe for a fully above-board NZ website with no pop-ups is straightforward:
- A plain-English privacy policy describing the contact form, the anti-spam protection, the analytics — whatever the site really does.
- Cookieless analytics instead of ad-platform tracking.
- No third-party advertising scripts. If you later run remarketing pixels (Meta, Google Ads), that's the moment consent questions genuinely appear — a decision to make deliberately, not a default.
- Forms that collect only what's needed — and send it to your inbox rather than hoarding it in databases.
That's how every site I build works out of the box. It's not a workaround; it's just not doing the invasive stuff in the first place.
Why this is worth caring about (beyond the law)
- Visitors hate banners. Every pop-up is friction between a potential customer and your phone number. On mobile, a clumsy banner can eat half the screen.
- Speed. Consent-management scripts are yet more JavaScript slowing down your first impression — and speed feeds your Google ranking.
- Trust. "We don't track you, so there's nothing to accept" is a genuinely nice thing to be able to say. Especially for health, legal and family-facing businesses.
The short version
- Cookie banners are EU law. NZ law wants honesty, not pop-ups.
- A contact form means you need a privacy policy page — that's the actual NZ requirement.
- Cookieless analytics (like Umami) gives you visitor numbers with no cookies, no tracking, no banner.
- Ad pixels are the exception — add those and you've invited the consent question in.
Not sure where your current site stands? It's the sort of thing I check (and fix) as part of every build — the quote form is the easy way to start that conversation. And if you're weighing up the whole picture of what a proper site involves, the costs are published here.