Cookies banner / GDPR regulations
When creating a website with WebAcappella, the issue of cookies and GDPR consent arises. This section details the legal obligations and integrated solutions for compliant cookie management.
Legal obligations
According to the General Data Protection Regulation (GDPR) and the ePrivacy Directive, a website must obtain the user's explicit consent before placing non-essential cookies (advertising, analytics, or social media-related).
Integrated consent banner
WebAcappella natively includes a cookie consent banner, accessible from the site’s general settings (under “Analytics / Cookie Banner”). This banner automatically manages consent for Google Analytics 4 and Google Tag Manager.
- The banner appears automatically on the first visit; the “Accept” and “Reject” buttons are displayed on the same level, as required by data protection authorities.
- No audience measurement or advertising cookies are set until the visitor has given their explicit consent (true opt-in: no checkbox is pre-checked).
- The visitor’s choice is stored for one year for subsequent visits.
- The “Display a ‘Manage Cookies’ button” option adds a discreet icon to the site, allowing the visitor to change their choice at any time—withdrawing consent must be as simple as granting it.
- With Google Tag Manager, the "Also request consent for advertising" option adds a separate "Advertising" category (a banner with "Accept All / Customize / Reject" options).
- The banner’s accent color can be customized to match your brand guidelines.
Activation
- Open the site’s general settings under “Analytics / Cookie Banner.”
- Select your tracking service—Google Analytics (basic) or Google Tag Manager (advanced)—and enter its ID.
- The consent banner, which is enabled by default, will then automatically appear on all pages of the published site.
The "Simulate Banner in Preview" option lets you check how the banner looks in the WebAcappella preview: no track data is loaded, and no selections are saved in this mode.
Strict Mode (Enhanced GDPR Compliance)
By default, the banner uses Google’s “Consent Mode”: Google scripts are loaded as soon as the page is displayed, but they do not set any cookies or transmit any identifiers until the visitor has given consent. However, some countries, such as Germany, apply a stricter interpretation of the GDPR, under which the mere loading of a third-party script already constitutes a transmission of data (IP address) to its provider.
The “Strict Mode: Load Google scripts only after consent” option meets this requirement: no requests are sent to Google until the visitor has given consent, and nothing is loaded if they refuse.
Strict mode is recommended if your audience is located in a country with a strict interpretation of the GDPR (Germany, in particular). However, Google Analytics can no longer provide modeled estimates for visitors who decline or ignore the banner.
Embedded videos: load on click
A YouTube, Vimeo, or Dailymotion video embedded on a page normally establishes a connection to its provider as soon as the page loads, before any consent is given. To prevent this, enable the “Load videos only after a click” option (in the same section of the site properties): each video is replaced by a neutral preview with a play button, and no connection to the provider—and therefore no third-party cookies—occurs until the visitor clicks. Playback then starts immediately.
This option also speeds up the initial loading of pages containing videos, which improves their performance.
Third-party widgets and content: load on click
External widgets inserted via the HTML component (Elfsight, Calendly, social media integrations, etc.) normally load their scripts as soon as the page is displayed, before any consent is given. To prevent this, check “Load only after a click (third-party content / GDPR)” in the properties of the relevant HTML component: on the published site, the code is replaced by a neutral placeholder and only executes when the visitor clicks. No requests to the third-party service—and therefore no cookies—are sent before this explicit action.
This option is configured on a per-component basis: this allows you to protect a third-party widget while still displaying harmless HTML code (formatting, static content, etc.) directly.
Cases where a banner is not required
By default, a WebAcappella website that does not use Google Analytics or third-party services does not generate cookies that require consent. In that case, the banner is not necessary.
Additional third-party services
Videos and widgets embedded via the HTML component are already covered by the "load on click" options described above. If you need centralized consent management for numerous third-party services (Facebook Pixel, targeted advertising, scripts embedded in page headers, etc.), dedicated solutions are available:
- Cookiebot: automatically generates a compliant banner and blocks cookies until consent is given.
- Axeptio: customizable consent management.
- Tarteaucitron.js: an open-source script for simple, compliant cookie management.
These scripts can be inserted via an HTML code area in WebAcappella.