What your hotel’s cookie banner settings could cost you
A decade ago, the most common legal threat presented to hotels and resorts based on their website was ADA compliance; the new target is cookie compliance, and the absence of a consent management platform on your website, or how it’s configured, could cost your hotel.
We’re here to break down what a consent management platform is, what it controls, and how your approach to settings could impact your property. We’ve seen how strict, explicit opt-in consent settings can impact a client (and we’ll even show you the numbers). You’ll walk away armed with the information to make the best decision for your property - making sure to consult your legal counsel to ensure the best path forward for compliance and marketing impact.
What is a CMP vs a cookie banner?
A consent management platform, or CMP, is the software running behind the scenes on your property's website. It detects where a visitor is browsing from, applies the right consent rule for that geographic region, and controls which cookies and tracking scripts are allowed to fire based on the visitor's choice.
The cookie banner is the part of the CMP that visitors actually see: the pop-up or bar that appears on first visit, asking them to accept, decline, or customize cookies. Its wording, button options, and design are configurable, but the choices it collects are enforced by the CMP underneath.
In short, the CMP is the engine, and the banner is the dashboard visitors use to set their own preferences. The CMP and cookie banner work together to direct how any cookies/tracking scripts are allowed to function on the website.
The most common CMPs our hotels and resorts work with are CookieYes and OneTrust.
What are cookies, when it comes to your hotel’s website tracking?
A cookie is a small text file a website stores in a visitor's browser to remember information between page views or visits.
For a hotel or resort, cookies do the quiet work behind a booking journey that allow us to understand how the user behaves on the site, retarget ads to them on our ad channels and more. Cookies are what let us:
- Keep a cart or reservation in progress as a guest moves through the booking engine
- Remember language, currency, or a saved search (dates, room type, rate plan)
- Recognize a returning visitor and credit that return to the right marketing channel
- Serve a retargeting ad to that user across marketing campaigns on channels like Facebook and Google Ads
- Measure whether a paid search click, hotel metasearch listing, or email actually led to a booking, even when the booking happens days later on a different visit
Without cookies, each of those visits looks like a brand-new, disconnected stranger, which is exactly what happens when a visitor declines them. Fewer cookies allowed means fewer visits a property can stitch together, which shows up directly in retargeting reach and attribution.
3. The main types of cookies on a hotel site
There’s a variety of cookie types that are aimed at different functions. Here is a breakdown of the different types and their purpose for your hotel:
| Cookie type | Examples for a hotel site | Business purpose | Typical consent requirement |
| Strictly necessary | Booking engine session, shopping cart, login, security/fraud checks | Lets the site function, hold a reservation in progress, keep a guest logged in, prevent abuse | Usually exempt; can be set without asking, though many CMPs still disclose them |
| Functional/preference | Language selector, currency, saved search filters (dates, room type, rate plan) | Remembers a visitor's choices so the site doesn't reset on every page or visit | Consent generally required in opt-in markets; often bundled as a low-friction category |
| Performance/analytics | GA4, heatmaps, scroll tracking, on-site behavior tools | Measures how visitors use the site, where they drop off, and what content or pages perform | Consent required in opt-in markets; frequently opt-out by default in the US geographic region |
| Advertising/marketing | Retargeting pixels, conversion tracking, hotel metasearch bidding tags, affiliate tracking | Drives paid media performance — audience building, retargeting, and attribution across the booking journey | Consent required almost everywhere non-essential cookies are regulated; the category most affected by decline rates |
| Personalization | Recommendation engines, dynamic offer/rate display, on-site content targeting | Tailors what a visitor sees based on past behavior or profile | Consent required in most jurisdictions; sometimes grouped with marketing depending on the CMP |
4. The difference between explicit opt-in vs. opt-out consent approaches
Every consent banner is built on a couple of the most common approaches, and the settings approach determines what happens the moment a visitor lands on the site, before they've clicked anything at all. Your consent management platform controls if and when your hotel’s marketing tags fire on your website.
Explicit opt-in consent setting
Under an opt-in model, non-essential cookies stay off by default. Nothing beyond strictly necessary cookies fires until the visitor actively agrees, usually by clicking "accept" or selecting specific categories. If the visitor closes the banner, ignores it, or never responds, the default state is no tracking. This is the stricter of the two models, and it puts the burden of action on the visitor rather than the site. This has the most dramatic impact on your hotel’s marketing, since it requires users to take action by clicking “opt-in” before our marketing cookies will fire and track the user.
Opt-out consent setting
Under an opt-out model, cookies, including your advertising and marketing analytics cookies, fire by default the moment the page loads. The visitor is given a way to decline or limit tracking, but if they take no action, the default state is tracking on. This model preserves more data collection out of the gate, since it doesn't depend on the visitor taking any action. This is the common approach for visitors in the US geographic region.
5. How consent laws differ by visitor location
Consent requirements aren't consistent worldwide (or even across states in the US, for that matter), and a hotel with demand across the country and internationally can't assume the same rules apply to every visitor to your hotel’s website. Only using one of the above approaches means you’re putting your property at risk with either costly privacy law issues or costly impact to your marketing.
EU/UK (GDPR, PECR)
The EU's GDPR and the UK's PECR require explicit opt-in consent for non-essential cookies. Advertising, analytics, and personalization cookies must stay off until the visitor actively agrees, and consent has to be granular; a visitor can accept analytics cookies while declining advertising cookies, rather than facing a single all-or-nothing choice. This is the strictest of the major frameworks, and the one most consent banners are built around by default. Visitors must actively click “opt in” on your hotel website’s cookie banner in order for your marketing tags to function and track the visitor’s actions across your site, including up to a booking.
United States
There's no single federal cookie law in the US. Instead, a growing list of states have passed their own versions of these laws, including California's CCPA/CPRA, Colorado's CPA, Virginia's VCDPA, and others. US cookie laws generally follow an explicit opt-out model. Cookies can fire by default, but visitors must be given a clear way to opt out, often through a "do not sell or share my personal information" link or a similar mechanism. Requirements vary somewhat by state, but the underlying model across nearly all of them is opt-out rather than opt-in. You can probably guess: this means more visitors’ actions can be tracked (and remarketed to) since there is no action needed to allow marketing tags to function and track. The visitor must take action by clicking “opt-out” to disable the cookie tracking.
What this means for your hotel
A single global cookie banner setting approach is not advised - it will either be too strict or not strict enough. A banner built to opt-in standards will over-comply for US visitors and unnecessarily suppress tracking that US law would allow; a banner built to opt-out standards will under-comply for EU and UK and create risky regulatory exposure. This is why most CMPs geolocate each visitor and switch the banner's behavior by region to show an opt-in experience to EU/UK traffic and an opt-out experience with a "do not sell/share" link to US traffic.
6. The risk and impact of each consent management approach
Choosing a consent model isn't just a legal decision; it's a trade-off with real business consequences on both sides, and it’s important to decide what’s best for your hotel by factoring in both sides.
Opt-in: strongest compliance posture, real revenue cost
An opt-in model gives a property the strongest compliance posture available. It's the safest choice in any jurisdiction, since it never sets a non-essential cookie without explicit agreement. But that same strictness has a direct cost: fewer visitors actively agree than would otherwise be tracked passively, which shrinks the addressable retargeting audience and leaves gaps in attribution. Bookings that happen days after an initial visit become harder to trace back to the marketing that drove them, even when the marketing worked.
Opt-out: preserves revenue, carries regulatory exposure
An opt-out model preserves far more tracking and, with it, more retargeting reach and cleaner attribution; cookies fire by default, so nothing depends on the visitor taking action. The cost shows up on the legal side instead. Applied in a jurisdiction that requires opt-in consent, this approach creates real regulatory exposure: fines, enforcement actions, and reputational risk if a regulator or a visitor challenges it.
How to understand the impact of each consent approach: Model it instead of guessing
The legal risk is well documented; regulators publish fine schedules and enforcement actions. To understand the revenue risk, we recommend using a model, leaning on the same paid media data you’re already tracking:
Paid media revenue × retargeting share × consent-driven audience loss = revenue at risk
Look at how much revenue paid media drives, how much of that depends on retargeting specifically, and how much of the retargeting audience a given consent setting causes a property to lose. Multiplying those together turns "opt-in feels safer" or "opt-out protects revenue" into an actual dollar figure a property can weigh against its compliance posture. Below we showcase a real-life case study of a property that decided to move forward with explicit opt-in in a geographic region that doesn’t require it.
Hotel marketing case study:
What happens when a hotel moves to an explicit opt-in consent setting
The consent setting approach your property chooses should be a business decision made alongside your legal counsel to ensure compliance. This case study showcases what happens when a US-based property tightens consent settings to strict opt-in, without a legal requirement to do so.
Hotel marketing performance impact YOY after moving from opt-out setting to explicit opt-in setting for US visitors:
- Website revenue down 81%
- Bookings down 73%
- Conversion rate down 89%
- Users roughly flat, down 26%
If your property is considering tightening consent beyond the legal minimum, you should expect a visible hit to reported performance. We recommend testing the impact via our calculator tool below so you can drop in your own revenue and paid media numbers to understand potential impact.
What would opt-in cost you?
Enter your property's monthly revenue to see the retargeting revenue at risk under an explicit opt-in consent setting versus opt-out. Try our consent risk calculator below.
How the hotel marketing consent settings calculator works:
- Enter your property's approximate monthly revenue. That's the only number you need to get started.
- Compare the two cards under "Real revenue at risk." These show the retargeting revenue you'd stand to lose each month under an explicit opt-in setting versus an opt-out setting.
- Check the gap below the cards. It translates the difference into a single monthly figure: what going opt-in could cost you that opt-out would otherwise preserve.
- Look at "Reporting visibility gap" underneath. This is a separate number: revenue that still comes in, but stops showing up in your dashboards once a visitor declines tracking. It's why a consent change can look like a much bigger revenue drop in your reports than it actually is.
- Open "Adjust the assumptions behind this estimate" if you want to use your own numbers instead of the defaults, paid media's share of revenue, retargeting share, and how much audience each setting typically loses to a consent decline.
The two sections aren't meant to be added together. The first is revenue that's genuinely at risk. The second is revenue that's still happening but harder to see, worth knowing about before assuming a dashboard dip means the same thing as a real one.
What to do next?
Every hotel website should have a CMP, and the approach you decide upon should factor in your legal council as well as the impact to marketing and revenue. Need more guidance on the impact of your marketing based on your CMP settings and approach? Reach out to our team for more information.
FAQs about Consent Management Platforms for hotels and resorts
If your property’s website uses any non-essential cookies, including analytics, retargeting pixels, personalization tools, and draws visitors from a location that regulates cookie consent (which, given how many properties draw international or multi-state demand, is nearly every hotel), then yes. Without a CMP, there’s no mechanism to detect visitor location, apply the right consent rule, or block cookies from firing before consent is given, which leaves your property exposed to compliance risk.
No, and you most likely shouldn’t. A single global setting either over-complies for US visitors (suppressing tracking the law would otherwise allow) or under-complies for EU/UK visitors (creating real regulatory exposure). Most CMPs, including CookieYes and OneTrust, can geolocate each visitor and switch the banner’s behavior by region automatically, so the same website can show an opt-in experience to EU/UK traffic and an opt-out experience to US traffic.
Not all of it, but expect a real reduction. Under opt-in, only visitors who actively agree get tracked (click the opt-in button on the cookie banner), so the addressable retargeting audience shrinks, and some bookings that happen days after an initial visit become harder to attribute to the marketing that drove them.
It reduces risk, but a CMP and a well-configured banner aren’t a substitute for legal guidance. Consent requirements vary by state and country, continue to evolve, and how they apply to a specific property’s data practices is a legal question. The settings covered here are a marketing and revenue framework for weighing the trade-off, and the decision should be made alongside your legal counsel.
Start by checking whether your CMP is applying different rules by visitor region rather than one static banner.
