Here is the uncomfortable test: open your website in a private browser window and watch the network tab. If requests to googletagmanager.com or google-analytics.com fire before you have clicked anything, your site is collecting device identifiers, IP addresses and behavioural data from South African visitors without their consent.
That is not a grey area. POPIA defines personal information to include online identifiers — and an analytics cookie tied to a device is exactly that. The banner most sites bolt on afterwards ("This site uses cookies. OK") does not fix it, because the data was collected before the visitor could refuse, and "OK" with no alternative is not a choice.
What POPIA Actually Requires
Three principles from the Act translate directly into how your website must handle cookies:
- Consent must come first. Non-essential processing (analytics, marketing pixels) may only start after the visitor agrees — not "we started already, click OK to continue".
- Consent must be a real choice. A banner with only an "Accept" button is not consent; it is a toll gate. The visitor must be able to decline non-essential cookies and still use your site fully.
- Consent must be withdrawable. Section 11(3) gives data subjects the right to withdraw consent at any time. If a visitor cannot undo their "accept" as easily as they gave it, you are not compliant.
The most common failure
Loading analytics on page one, then showing a banner. By the time the visitor sees your banner, the tracking request has already left their browser. Auditors and complainants check this in under a minute with browser developer tools.
What a Compliant Banner Looks Like
Minimum viable compliance
No analytics until opt-in · an "Essentials Only" option with equal prominence · a persistent "Cookie Preferences" control on every page · withdrawal that actually deletes the analytics cookies · a privacy policy that describes all of this truthfully.
Walk through the visitor's experience:
- First visit: only essential cookies load (session security, theme preference). A banner offers two equal buttons: Accept All and Essentials Only, with a link to the privacy policy.
- If they accept: analytics loads from that moment onward. Nothing retroactive needs cleaning up because nothing fired early.
- If they decline: the site works identically. No nagging, no re-prompting on every page.
- Any time later: a "Cookie Preferences" link in the footer reopens the choice. Switching to Essentials Only stops analytics immediately and deletes the analytics cookies from the browser.
That last point is the one almost everyone misses. Withdrawal is not "we'll stop collecting new data" — the identifiers sitting in the visitor's browser are the mechanism of tracking, and honouring withdrawal means removing them.
"But I Need My Analytics"
You will lose some measurement — that is the honest trade-off, and anyone who promises you full analytics with full compliance is selling something. In practice the loss is smaller than feared:
- Visitors who opt in give you cleaner data than the bot-inflated, consent-less numbers you had before.
- Google's Consent Mode lets tags respect a "denied" state properly, so your implementation stays honest at the platform level rather than relying on your own filtering.
- Server-side signals — form submissions, bookings, WhatsApp clicks — measure business outcomes without any cookies at all.
We practise this. This website loads no analytics until you opt in, offers Essentials Only with equal weight, and the Cookie Preferences link at the bottom of every page withdraws consent and deletes the Google Analytics cookies on the spot. If a vendor tells you that is technically impossible, show them this site.
Your 10-Minute Self-Audit
- Open your site in a private window with the network tab open. Do analytics requests fire before any click? Fail.
- Does your banner offer a decline option as prominent as accept? If not: fail.
- Accept, then look for a way to change your mind. No persistent preferences control? Fail.
- Withdraw (if you can) and check the browser's cookie store. Are
_gacookies still there? Fail. - Read your privacy policy's cookie section. Does it describe what the site actually does — or a banner that doesn't exist? Mismatch: fail.
If you failed any of these, the remediation is a well-understood engineering task, not a legal odyssey — a consent manager, a policy update, and a test pass. It is one of the items our POPIA Compliance Audit checks and fixes as standard.