NZAI Security
Cookie Consent Banners NZ Privacy Act 2020: Accept, Reject and Manage Preferences UX requirements
Privacy

Cookie Consent Banners: NZ Privacy Act 2020 Compliance Guide for NZ Sites

Guide Educators + General Updated 20 Sept 2026

Plain-English guide to cookie consent banners under the NZ Privacy Act 2020: banner UX rules, what to include, and copy-paste WordPress and HTML.

Written and reviewed by Feroze Ashraff Last reviewed Editorial standards

Quick answer

Under the NZ Privacy Act 2020, a cookie consent banner must let visitors make a real choice — accept, reject, or manage — before any non-essential cookies are set. A banner that buries Reject, makes Accept the only obvious button, or sets analytics cookies before the visitor clicks anything is not compliant. The minimum useful banner has three buttons: Accept all, Reject non-essential, and Manage preferences, with the Reject option at the same visual weight as Accept. The banner must not appear after the visitor has already scrolled or interacted with the page; it must appear on first load and stay until a choice is made.

If you want to check your own site first, run the Free Website Security Check — it inspects cookie flags (Secure, HttpOnly, SameSite) and flags obvious banner-pattern problems.

What the Privacy Act 2020 actually says about cookies

The Privacy Act 2020 does not use the word "cookie" anywhere in the statute (1). It does not specify banner colours, button sizes, or the phrase "by continuing to browse this site you agree". What it does say — across IPPs 1, 3, 5 and 6 — is that personal information about an identifiable individual must be collected fairly and lawfully, used for a purpose the individual was told about, and protected against unauthorised disclosure (1)(2).

In practice, that means a NZ website operator who drops a third-party analytics cookie on every visitor without asking is collecting personal information about that visitor without telling them what it is for. The Office of the Privacy Commissioner has been clear that pre-checked boxes, implied-consent patterns, and "click X to dismiss" patterns do not satisfy the Act (2).

The actual technical and UX rules fall out of two places:

  • The Privacy Act 2020 itself — the principles of lawfulness, purpose limitation, and consent (1).
  • The Office of the Privacy Commissioner's published guidance — including the 2020 expectations on tracking pixels and the 2023 guidance on generative AI cookies (2).

Both treat cookies that identify an individual (analytics, advertising, session replay, A/B testing) as personal information. The banner pattern that satisfies the Act is the one where the visitor can say no before any non-essential cookie is set, where the no option is as easy to click as the yes option, and where the choice is recorded.

A banner that is technically present but functionally impossible to refuse — pre-checked toggles, Reject hidden under a "Manage preferences" link, Accept as the only visible button — is treated by the Office of the Privacy Commissioner as if no banner were shown at all (2).

Three reasons they sit in the NZAI baseline rather than being filed under "EU-only":

  • The Privacy Act 2020 applies to NZ organisations, not just overseas ones. Any NZ school or small business that drops a Google Analytics cookie on a visitor is collecting personal information about that visitor under NZ law. The Office of the Privacy Commissioner can investigate complaints from parents, students, staff or members of the public (1)(2).
  • Student data is in scope. If your school site uses any tracking at all — even anonymous-looking analytics — and a parent complains that their child was tracked without consent, the issue is in scope of IPP 1 and IPP 5 (1).
  • The pattern is converging globally. The EU GDPR pattern (reject at equal visual weight, granular consent, no pre-checked boxes) is now the expected minimum worldwide. NZ guidance and UK guidance both converge on the same rules (2). Doing it right once means doing it right everywhere.

For the broader educator safety pathway, including account security, devices, phishing, and student data, see Building Cyber-Safe Habits as an NZ Educator.

A cookie banner that loads analytics cookies before the visitor clicks anything is the single most common NZ Privacy Act 2020 finding on school and small-business sites. The fix is mechanical: only call the analytics loader (Google Analytics, Plausible, Matomo, Facebook Pixel) after the consent state is "accepted". A gtag('consent', 'update', { analytics_storage: 'granted' }) call guarded by a consent check is the standard pattern.

A compliant banner is not hard to design — but it does have specific structural rules. The following list is what the Office of the Privacy Commissioner and comparable regulators treat as the floor.

Required elements

  • Three buttons at the same visual weight: Accept all, Reject non-essential, Manage preferences. The Accept and Reject buttons must be the same size, colour, and prominence. "Manage preferences" can be a link or a smaller button, but it must be visible on first load.
  • Visible before any non-essential cookie is set. The banner appears on the first page load and remains until the visitor makes a choice. No analytics, no tracking pixels, no Facebook pixel — none of those — until the visitor has clicked Accept or Manage.
  • A short plain-English statement of what cookies are used for. Two to four sentences is enough. Examples: "We use cookies to remember your preferences and to count how many people visit each page. We do not use them to identify you individually."
  • A link to a cookie policy that lists every cookie by name, purpose, and provider. The link is part of the banner text, not buried in a footer.
  • A record of the choice. Once the visitor clicks Accept or Reject, the choice is stored (in a cookie or localStorage) so the banner does not reappear on every page. The choice can be revisited from the footer or from a "Privacy" link.

Patterns to avoid

  • "By continuing to browse this site you agree" — implied consent is not consent under NZ law (2).
  • Pre-checked categories — a "Manage preferences" panel that opens with Analytics already toggled on is treated the same as no consent at all.
  • Cookie wall — a banner that blocks the page until Accept is clicked (rather than letting the visitor read with non-essential cookies disabled) is not compliant.
  • Hidden Reject — burying Reject under a "Settings" link while Accept is the only visible button is the most-cited complaint pattern at the Office of the Privacy Commissioner (2).
  • "Strictly necessary" stretched to mean analytics — analytics cookies are not strictly necessary under any sensible reading. The Office of the Privacy Commissioner has been specific on this (2).
A common excuse for a poorly designed banner is "nobody reads them anyway". That is true — and it is exactly why the regulator focuses on the cases where a banner does collect a meaningful consent or refusal. If your banner is so intrusive or so opaque that the only useful action is to dismiss it, the choice you collected is meaningless — and that is the version the Office of the Privacy Commissioner investigates (2).

What cookies actually need the banner

Not every cookie needs consent. The split is roughly:

  • Strictly necessary — session cookies, CSRF tokens, authentication cookies, load-balancer cookies. The site breaks without these. No banner trigger needed.
  • Functional — language preference, accessibility settings, recently-viewed items. The site works without these but the visitor experience is degraded. Some implementations lump these with strictly necessary; others ask.
  • Analytics — Google Analytics, Matomo, Plausible, Cloudflare analytics. Collects aggregate traffic data. Requires consent under NZ law (1).
  • Marketing / advertising — Facebook pixel, Google Ads, LinkedIn Insight, TikTok pixel. Builds a profile of the visitor across sites. Requires explicit consent (2).
  • Third-party content cookies — embedded YouTube videos, embedded Google Maps, social-media embeds. Sets cookies from the third-party domain when the embed loads. Requires consent unless the embed is gated behind the consent decision.

A correctly configured banner fires only for the last three categories. Strictly necessary and functional cookies can be set before the visitor makes a choice, as long as you are honest about what is being set in your cookie policy.

For the secure cookie flags that complement this — Secure, HttpOnly, SameSite — see the Secure Cookie Flags guide.

Cookie Consent Banners NZ Privacy Act 2020 — Accept, Reject and Manage Preferences for compliance

Copy-paste: a minimal compliant HTML banner

Below is a self-contained HTML/CSS/JavaScript banner that satisfies the structural rules above. Drop it into any site that lets you edit the page template. It uses localStorage to remember the visitor's choice, and only loads analytics after consent is granted.

<!-- Cookie consent banner — drop into <body> of every page -->
<div id="cookie-banner" role="dialog" aria-label="Cookie preferences"
     style="display:none;position:fixed;left:0;right:0;bottom:0;z-index:9999;
            padding:1rem 1.25rem;background:#14212b;color:#fff;border-top:2px solid #c3a769;
            display:flex;flex-wrap:wrap;gap:1rem;align-items:center;justify-content:space-between;
            font:15px/1.5 system-ui,sans-serif;">
  <div style="flex:1 1 320px;max-width:680px;">
    <strong>We use cookies.</strong> We use cookies to remember your preferences
    and to count how many people visit each page. We do not use them to identify
    you individually. See our
    <a href="/cookie-policy/" style="color:#c3a769;text-decoration:underline;">cookie policy</a>.
  </div>
  <div style="display:flex;gap:.5rem;flex-wrap:wrap;">
    <button id="cookie-reject" type="button"
            style="padding:.6rem 1rem;background:transparent;color:#fff;
                   border:1.5px solid #fff;border-radius:6px;cursor:pointer;">
      Reject non-essential
    </button>
    <button id="cookie-manage" type="button"
            style="padding:.6rem 1rem;background:transparent;color:#fff;
                   border:1.5px solid #fff;border-radius:6px;cursor:pointer;">
      Manage preferences
    </button>
    <button id="cookie-accept" type="button"
            style="padding:.6rem 1rem;background:#c3a769;color:#14212b;border:none;
                   border-radius:6px;cursor:pointer;font-weight:600;">
      Accept all
    </button>
  </div>
</div>

<script>
(function () {
  var banner = document.getElementById('cookie-banner');
  var stored = localStorage.getItem('nzai_cookie_choice');
  if (!stored) {
    banner.style.display = 'flex';
  } else {
    if (stored === 'accepted') loadAnalytics();
  }

  function setChoice(value) {
    localStorage.setItem('nzai_cookie_choice', value);
    banner.style.display = 'none';
    if (value === 'accepted') loadAnalytics();
  }

  document.getElementById('cookie-accept').addEventListener('click', function () { setChoice('accepted'); });
  document.getElementById('cookie-reject').addEventListener('click', function () { setChoice('rejected'); });
  document.getElementById('cookie-manage').addEventListener('click', function () {
    window.location.href = '/cookie-policy/#manage';
  });

  function loadAnalytics() {
    // Replace with your analytics loader. Only fires after consent.
    var s = document.createElement('script');
    s.async = true;
    s.src = 'https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX';
    document.head.appendChild(s);
    window.dataLayer = window.dataLayer || [];
    function gtag(){ dataLayer.push(arguments); }
    gtag('js', new Date());
    gtag('config', 'G-XXXXXXX');
  }
})();
</script>

The three buttons are the same size and weight. The Reject button is visible on first load. Analytics only fires after the visitor has actively clicked Accept. The choice is stored in localStorage. Adapt the styling, the cookie policy URL, and the analytics loader to your environment.

Copy-paste: WordPress

For a WordPress site, the cleanest pattern is to drop the HTML/CSS banner into your theme's footer.php (or a child-theme footer) and the JavaScript into your theme's JS file. Two practical patterns:

Pattern 1: theme-level edit

In wp-content/themes/your-theme/footer.php, add the banner HTML just before </body>. In wp-content/themes/your-theme/js/main.js, add the consent-storage script. The advantage is full control; the disadvantage is that theme updates can overwrite your changes unless you use a child theme.

Pattern 2: a small plugin

Create wp-content/plugins/nzai-cookie-banner/nzai-cookie-banner.php:

<?php
/**
 * Plugin Name: NZAI Cookie Banner
 * Description: Minimal Privacy Act 2020 cookie consent banner for NZ sites.
 * Version: 1.0.0
 */
if (!defined('ABSPATH')) exit;

function nzai_cookie_banner_enqueue() {
    wp_enqueue_script(
        'nzai-cookie-banner',
        plugin_dir_url(__FILE__) . 'banner.js',
        array(),
        '1.0.0',
        true
    );
}
add_action('wp_enqueue_scripts', 'nzai_cookie_banner_enqueue');

function nzai_cookie_banner_render() {
    if (is_admin()) return;
    ?>
    <div id="cookie-banner" role="dialog" aria-label="Cookie preferences"
         style="display:none;position:fixed;left:0;right:0;bottom:0;z-index:9999;
                padding:1rem 1.25rem;background:#14212b;color:#fff;border-top:2px solid #c3a769;
                align-items:center;justify-content:space-between;font:15px/1.5 system-ui,sans-serif;">
      <div style="flex:1 1 320px;max-width:680px;">
        <strong>We use cookies.</strong> We use cookies to remember your preferences
        and to count how many people visit each page. See our
        <a href="/cookie-policy/" style="color:#c3a769;text-decoration:underline;">cookie policy</a>.
      </div>
      <div>
        <button id="cookie-reject" type="button">Reject non-essential</button>
        <button id="cookie-manage" type="button">Manage preferences</button>
        <button id="cookie-accept" type="button">Accept all</button>
      </div>
    </div>
    <?php
}
add_action('wp_footer', 'nzai_cookie_banner_render');

Then place the JavaScript shown above in banner.js next to the PHP file. Activate the plugin from the WordPress dashboard. Theme updates will not touch it.

If your site uses a third-party consent-management platform (OneTrust, Cookiebot, CookieYes, Iubenda), the same structural rules apply: three buttons at the same weight, no pre-checked toggles, no analytics until consent is granted. Most CMPs ship with sensible defaults — but verify with the Office of the Privacy Commissioner checklist rather than assuming the platform is correct for NZ law.

Verify before you ship

Two reliable ways to confirm the banner is compliant.

1. Manual checklist

Open your site in a private/incognito window. The banner must:

  • Appear on first load, before any non-essential cookie is set.
  • Show three buttons at the same visual weight: Accept, Reject, Manage.
  • Not pre-tick any categories in the Manage panel.
  • Remember the choice across page loads.
  • Stay out of the way once a choice is made (not blocking the page).

Open the browser DevTools (F12 → Application → Cookies) and confirm no non-essential cookies are present before you click Accept.

2. Run the free NZAI scanner

The Free Website Security Check inspects cookie flags (Secure, HttpOnly, SameSite) and reports on the banner's structural rules. It will not catch every UX pattern, but it does flag the most common failures (missing Reject button, missing cookie policy link, etc.).

From running the free scanner and reading Office of the Privacy Commissioner guidance, the most frequent missteps are:

  • Two buttons instead of three. Accept and Manage, no Reject. The visitor who wants to say no cannot say no. Add a Reject button at the same weight as Accept.
  • Accept as the only obvious button. Accept in solid colour, Reject as a faint link. Same effect as not having a Reject button at all.
  • Pre-checked toggles. Manage preferences panel opens with Analytics on. Pre-checked is not consent (2).
  • Banner set after a delay. Showing the banner only after the visitor has scrolled or interacted with the page means analytics has already fired. The banner must be on first load.
  • Cookies set before consent. A gtag('config', 'G-XXX') call in <head> before the banner has fired. Move analytics into the consent handler.
  • No cookie policy. The banner links to nothing, or links to a generic Privacy Policy that does not list cookies. The Office of the Privacy Commissioner expects a per-cookie inventory (2).
  • Choice not stored. Banner reappears on every page. Either the localStorage write is broken, or the script is re-firing on every page load.

Knowledge check

Test your understanding of cookie consent under the Privacy Act 2020 with these questions. Click or tap each card to flip it and see the answer.

Q1Your school site uses Google Analytics. You have a banner with two buttons: "Accept" (large, green) and "Manage preferences" (small, link-style). The Manage panel opens with Analytics pre-checked. A parent complains to the Office of the Privacy Commissioner. What is the regulator likely to find?tap to flip
Answer: The Office of the Privacy Commissioner treats this banner as if no consent were obtained at all. Two specific failures: (1) there is no visible Reject button — Accept is the only path of low-friction action; (2) the Manage panel pre-checks Analytics, which means a visitor who clicks Manage and saves defaults has not actively opted in. Both patterns are explicitly flagged in OPC guidance as not satisfying the Privacy Act 2020. The fix is to add a Reject button at the same visual weight as Accept, and to ensure the Manage panel opens with all non-essential categories unchecked (2).
Q2A visitor lands on your site. Your Google Analytics tag fires in <head>, sets the analytics cookie, and 800ms later the consent banner appears at the bottom of the page. Is this compliant?tap to flip
Answer: No. Non-essential cookies must not be set until the visitor has actively granted consent. The 800ms gap means every visitor gets tracked regardless of whether they ever click Accept — and many visitors will never click Accept because they have already loaded the page and decided to ignore the banner. The fix is to wrap the analytics tag inside the consent handler (only fire gtag('config', ...) after the visitor clicks Accept), and to render the banner synchronously in the page load — not after a delay. For the secure cookie flags that complement this pattern, see the Secure Cookie Flags guide (1)(2).
Q3You have a banner with three buttons (Accept, Reject, Manage) at the same weight. The Manage panel opens with Analytics pre-checked "for convenience". A visitor opens Manage, looks at the toggles, and clicks Save without changing anything. Has consent been obtained?tap to flip
Answer: No — not under the Privacy Act 2020. Pre-checked toggles are not consent. The visitor must take a positive, unambiguous action to enable a non-essential category. Clicking Save on a panel that opens with Analytics already enabled is treated the same as having no Manage panel at all — the visitor did not actively choose Analytics; they accepted the default. The correct pattern is for the Manage panel to open with all non-essential categories unchecked, so that the visitor must toggle Analytics on before saving (2).

Sources and references

[1] New Zealand. Parliament. (2020). Privacy Act 2020. https://www.legislation.govt.nz/act/public/2020/0031/latest/whole.html

[2] New Zealand. Office of the Privacy Commissioner. (2025). Privacy tools for agencies — cookies and tracking. https://www.privacy.org.nz/responsibilities/privacy-tools-for-agencies/

[3] CERT NZ. (2025). Top 11 cyber security tips for your business. https://www.cert.govt.nz/business/guides/top-tips-for-cyber-security/

[4] New Zealand. National Cyber Security Centre. (2025). Cyber security baseline controls for organisations. https://www.ncsc.govt.nz/

What to do next