You said, in a comment, that you may be asking the wrong question. I think a better way to put it would be that your question based on a confusion that is extremely common, so it deserves a clear answer.
From a European perspective, there are two different pieces of legislation at work.
(Rather than link directly to the legislation, I have linked to the Wikipedia pages from where you can find the legislation if you need it)
ePrivacy
The popup banners you see are aimed at compliance with Article 5(3) of the ePrivacy directive.
What the ePrivacy directive says
Article 5 begins:
Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing.
Cookies count as storing information on the equipment of a user, and requesting cookies counts as "gaining access". The default rule is that you may not do this without informed prior consent by the user.
There is an exception for essential cookies:
This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.
Here "essential" really means what it says. Google Analytics, while useful, really isn't essential and so any use of it had better obtain prior consent. The ePrivacy directive imports its definition of "consent" from the GDPR, so they mean the same thing (see recital 17).
By the way, for a long time you used to see "we care about your privacy" style popups that would allow you to say "yes" but if you wanted to say "no" you had to go through and select the cookies you did not want. This breaks a general rule of GDPR consent that consent should be as easy to refuse as to a give. "Yes" and "no" should be the same level of work.
Where does this apply?
So, now to the question I think you are asking. Where does this apply? The directive itself does not give us much detail. It says (in article 3):
This Directive shall apply to the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks in the Community, including public communications networks supporting data collection and identification devices.
I have emboldened the most crucial part.
Clearly, you have to at least have an electronic communications service and it must be available over a public communications network in the EU ("the Community"). But does that apply if my website just happens to be visible in the EU?
As far as I know, there's no direct authority on this point - in other words no case law. The European Data Protection Board ("EDPB") whose job it is to oversee the GDPR have given it some thought -see Internal EDPB Document 04/2021 on criteria of territorial competence of supervisory authorities to enforce Article 5(3) of the ePrivacy Directive. Their view is that it may depend on the law of the nation state in question (eg German law might come to a different decision than French law).
The proposed ePrivacy Regulation would clarify all this to some extent, though arguably in a more Draconian fashion. If this answer hangs around for a few years, that will become relevant.
In short: it is not particularly clear. If a service targets people in the EU as customers, I suspect that would fall within the directive. Otherwise I am not sure.
GDPR
Where does the GDPR apply?
The GDPR does have clear rules on jurisdiction. If you process personal data - where "process" includes storage etc - then there are four ways that you can come within the scope of the GDPR:
- That processing happens "within the context" of an establishment in the EU. For example, you have subsidiary with offices there which sells advertising that appears on your website (to pick an example from Google Spain). This possibility does not depend on where the data subjects are or whether they are European or no.
- If a controller isn't established in the EU, but offers goods or services to data subjects in the EU.
- If a controller isn't established in the EU, but monitors the behaviour of data subjects in the EU
- If a controller, rather than being in the EU, is somewhere that the law of a member state applies as a matter of International Law (eg a ship or perhaps a spacecraft under the Outer Space Treaty).
Do I need a consent banner under the GDPR?
Other than for ePrivacy compliance? No.
Well, to be pedantic, it might be possible to conceive of some such situation, but it would be very unlikely to happen in practice.
To amplify, the GDPR imposes a number of conditions on processing. One of these is that a controller must process "lawfully".
"Lawfully" obviously includes "not breaking the law", so if you breach the ePrivacy directive by not putting up a cookie banner and those cookies are also personal data, which would be common, then you also infringe the GDPR.
But the GDPR also says that "lawfully" includes a requirement to have what is known as a "lawful basis" for processing. Article 6 provides a short list of these.
One of these is "consent". The GDPR strongly discourages over-reliance on consent. For example, consent must be properly informed; it must be properly informed; and it must be freely given. This is very different from life under the data protection directive and I have spent a lot of time since 2018 (when the GDPR came into force) explaining to clients that they could nor, or should not, try to use consent as their lawful basis.
The two bases that usually apply are one that involves a contract between the data subject and the controller (if a controller contracts to supply a service to a data subject, that will involve processing personal data and will be lawful provided it is necessary) and a catch-all "legitimate interest". Google successfully relied on "legitimate interest" in the Google Spain case.
The thing is that a banner can just about allow someone to meaningfully decide whether they want non-essential cookies or not, though it can be tough to get that right, but not the complex processing that is typical in a more complicated relationship. Sure, you can point to a privacy notice or set of terms, but they are unlikely to be read or studied at the point when you need consent, even if data subjects can (and trust me they do) go back and read them later.
And "you may not use our service unless you consent..." does not sound like consent. Any "or else" works against the freedom of consent. This is why GDPR consent banners are (1) almost certainly useless and (2) almost never used. I have certainly never seen one.
