GDPR cookie banner for SaaS products
SaaS has a shape most cookie banner guides skip past. You've usually got a marketing site and a logged-in app, often on different subdomains, with different tracking on each and a signup flow in between that you'd rather not break.
Here's what that setup needs to get right.
Your marketing site and your app aren't the same problem
The marketing site carries the analytics, the ad pixels and the attribution scripts. Those are non-essential, so under EU rules they need consent before they're set, not after.
The app runs mostly on essential cookies: session, auth, preferences. Those don't need consent. Whatever product analytics you've bolted on does. Treat both surfaces the same and you'll either over-block the app or under-protect the marketing site.
Consent has to survive the subdomain hop
Someone who accepts on your marketing site and then lands in the app shouldn't be asked again. Set the consent domain so the choice carries across subdomains, and test the signup path specifically, since that's the journey that crosses the line.
Gate the tags, not just the banner
The usual SaaS failure is a perfectly good banner sitting on top of scripts that already ran. Consent state has to be set before your tag manager starts.
Check it the blunt way: fresh incognito window, network tab open, load a page, and see whether anything non-essential has made a request before you touch anything.
What GDPR actually asks for
Consent has to be freely given, specific, informed and unambiguous, which rules out pre-ticked boxes and "by continuing you agree". Withdrawing it has to be as easy as giving it, so people need a way back into the banner. And you have to be able to show consent was given, which is a record-keeping job more than a design one.
So you need granular categories, a way to reopen preferences, and a consent log you can export.
Selling into the US too
Once you have EU and US customers, one configuration stops being enough. Several US state laws are opt-out rather than opt-in, and expect you to honor a browser-level Global Privacy Control signal without being asked.
One Privacy picks up GPC and applies region rules per visitor, so one install covers both and you're not maintaining a banner per market.
Frequently asked questions
Do I need a cookie banner inside the logged-in app?
If the app only sets essential cookies, session, auth and preferences, then generally no. Product analytics, session replay and heatmaps are non-essential, and once they're in, consent applies inside the app too.
Does consent carry from the marketing site to the app subdomain?
It can, if the consent domain covers both. Test it on the real signup path rather than assuming, because that's where a duplicate banner shows up most obviously.
Is session replay covered by consent?
Session replay is treated as non-essential and often captures personal data directly, so it belongs behind consent. Worth naming it explicitly in your categories.
What about customers outside the EU?
Region rules decide what each visitor sees. An EU visitor gets the opt-in flow, a California visitor gets the opt-out one, and you keep one install instead of a banner per market.
Scan your marketing site and your app
Run a free scan on each and see what's firing before consent.
Get Started For FreeKeep reading
This page is general information about how consent tooling works, not legal advice. What applies to you depends on your jurisdiction and on how your product handles data, so check with a qualified advisor before you rely on it.