Plenty of New Zealand small business websites now show a cookie pop-up the moment someone lands on the homepage, usually because a plugin or template defaulted to one. Most of these owners have never checked whether cookie consent for their NZ small business website is actually required, or whether they are showing visitors unnecessary friction that costs them leads. The real answer sits between the two extremes: the Privacy Act 2020 does not mandate a GDPR-style opt-in banner for every site, but it does require disclosure, and some NZ businesses genuinely do need consent. This guide sets out which camp you’re in.

Does the Privacy Act 2020 Actually Require a Cookie Banner?

No single clause in the Privacy Act 2020 cookies provision says “every website must show a consent banner”. The Act is built around disclosure, not a specific mechanism. If your site collects personal information, including through cookies, you need to tell people what you’re collecting and why. A banner is one way to do that. It is not the only way, and for most NZ small business sites it is not strictly required at all.

Where owners get this wrong is assuming the stricter European model applies by default. The EU’s rules require opt-in consent before most non-essential cookies load. New Zealand’s framework is closer to an opt-out model built on transparency – disclose what you collect, let people see and correct it, and give them a reasonable way to decline tracking they don’t want.

Essential vs Non-Essential Cookies: The Distinction That Matters

Not every cookie carries the same obligation. Splitting your site’s cookies into two buckets makes the rest of this far simpler.

• Essential cookies – these run the site itself: shopping cart contents, login sessions, security tokens, language preference. They don’t need a consent mechanism because the site can’t function properly without them.
• Non-essential cookies – analytics tools like GA4, advertising pixels from Meta or Google Ads, and third-party embeds like YouTube or a booking widget. These are where disclosure, and in some cases consent, actually matters.

Most small business sites run two or three non-essential cookies at most. Auditing which ones actually fire on your site is a faster first step than installing a banner plugin and hoping it covers everything.

When You Do Need Consent

Two situations push a NZ small business past simple disclosure and into genuinely needing opt-in consent:

1. You serve overseas visitors covered by stricter law. If a meaningful share of your traffic or customers are in the EU or UK, GDPR and UK PECR rules travel with those visitors regardless of where your business is based.
2. You run advertising cookies or pixels. Retargeting pixels from Meta or Google Ads sit in a greyer area than plain analytics. Treating these as requiring clear, informed consent – rather than assuming silence counts as acceptance – is the safer practice NZ law firms generally recommend.

GA4 Consent Mode and Google Ads

If your site uses GA4 or runs Google Ads, Google’s own consent mode framework is worth understanding even if NZ law doesn’t force your hand. GA4 consent mode lets the tag adjust what it records based on a visitor’s consent status, so you can run analytics in a reduced, privacy-safe state for visitors who decline, rather than an all-or-nothing switch. For a small business mainly serving NZ customers, this matters most if any Google Ads campaigns target overseas audiences, or if you simply want your tracking setup to hold up if the business expands later.

Writing a Cookie Banner That Doesn’t Kill Conversions

If you decide a banner is the right call for your business, the design choices matter as much as the legal box-ticking.

• Keep it short. One sentence explaining what’s tracked and why is enough – nobody reads a paragraph on arrival.
• Give equal visual weight to accept and reject, not a bright button for one and a grey link for the other.
• Don’t block the whole page behind a modal if you don’t need to. A slim bar at the bottom of the screen does the job without stopping someone reading your homepage.
• Link straight to your cookie policy from the banner itself, rather than making people hunt for it in the footer.

What to Put in Your Cookie Policy

Whether or not you run a banner, a cookie policy NZ businesses can point to when asked is worth having. It should cover, in plain language: which cookies your site sets, whether they’re essential or not, which third parties (GA4, Meta, embedded video) set cookies through your site, and how a visitor can opt out if they want to. This usually lives as a short section inside your main privacy policy rather than as a separate page, which keeps it in one place people actually find. It sits alongside the other items most NZ sites need to get right under the website legal requirements every small business should check off before launch.

FAQ

Do I need a cookie banner if I only use Google Analytics?

Not necessarily. Plain analytics with no advertising component sits closer to the disclosure-only end of the spectrum under NZ law. Disclosing it in your privacy policy is the baseline most NZ businesses rely on.

What happens if I ignore cookies entirely?

You risk a Privacy Act breach if your site collects personal information through cookies without disclosing it anywhere, and you lose the ability to point to a clear policy if a customer ever asks what you’re tracking.

Are free cookie banner plugins worth installing?

They can help, but check what they default to. Many are built for GDPR markets and will show every NZ visitor an opt-in flow that isn’t required locally, adding friction for no legal benefit.

Does this apply to a site with no contact form or tracking at all?

A genuinely static site with no analytics, no embeds and no forms has very little to disclose. That’s rare in practice – most sites run at least GA4 or a booking tool, which brings cookies back into play.