Most of the consent banners on New Zealand financial services websites arrived by default rather than by decision. There is no New Zealand cookie law, and no regulator here has told your firm to run one - that obligation is European, and it stayed there. What we do have is the Privacy Act 2020, which asks a harder question: what are you collecting, and has anybody been told? This is general information rather than legal advice, and a firm with overseas clients or particular obligations should take its own.
The rule that put a consent banner on every site you visit is European, and it did not travel. No statute here requires permission before setting a cookie, and no regulator in this country has told firms they must run one. What people are half-remembering reaches a New Zealand practice only in the narrow circumstances I set out later.
I put it that bluntly because the alternative costs money. Firms pay for a consent platform, pay an agency to configure it, then pay a third time in the analytics they no longer collect - all to satisfy an obligation that does not exist here.
None of that makes tracking a free-for-all. The law that governs it is simply a different law, asking different questions.
The instrument that does apply is the Privacy Act 2020, administered by the Office of the Privacy Commissioner. It is not a cookie law. It is a law about personal information - what you collect, why, where you keep it, who you hand it to, and what a person can do about it afterwards.
Its information privacy principles apply to data gathered through a website exactly as they apply to a paper form on the front counter. Collect only what you need for a purpose you can state out loud. Tell people you are collecting it, keep it secure, and let someone see what you hold and correct it if it is wrong. The Commissioner publishes plain-language guidance on those principles.
The question stops being do I need a banner, and becomes what am I collecting, and has anybody been told.
So where did yours come from? Usually one of three places. A plugin offered it during setup and whoever built the site clicked yes. An agency reused a template built for a European client and never stripped the consent layer out. Or somebody read an article about GDPR in 2018, forwarded it to the designer, and the decision was never revisited.
The tooling built to survive that wave became the default in every website builder and plugin directory on the market, and defaults travel. Years on, the accounting firms I look at are running consent infrastructure designed for a Berlin ad tech business, on a site with four hundred visitors a month.
Imported anxiety is the polite description.
Turn the question around and ask what is actually loading. Almost every firm site runs Google Analytics. Most carry something from an advertising platform if the firm has ever run a campaign, and those pixels tend to outlive the campaign by years. Add embedded fonts, a map on the contact page, a video on the about page, and a tag manager container nobody has opened since launch.
Each of those makes a request to a server offshore, and most record something about the visitor: pages viewed, time on page, an identifier that persists between visits, an approximate location. Mainstream analytics is less identifying than it was a decade ago, largely thanks to the same European pressure that produced your banner. It is still data leaving your site, though, and you are the one who put it there.
The scripts that concern me are not the analytics ones. They are the tools a firm adds for convenience and never registers as data collection at all.
A booking widget takes a name, an email and a phone number before anything reaches your inbox. A chat widget keeps the transcript on a vendor's servers, and clients type things into chat windows they would never commit to an email. Session recording and heatmap tools are the sharpest example, because on a form page they can extend to keystrokes. A prospective client entering their income, their debt position and their date of birth into a fact-find is not a session you want stored offshore.
Most of these tools ship with a setting that masks form fields. Most installations I open have never had it switched on.
You can answer this yourself in about ten minutes, and you should, because the person who built the site may genuinely no longer know.
- Open your homepage in a browser, open the developer tools, and watch the network tab as the page loads. Every third-party domain that appears is a script you are running.
- Look at the storage tab for cookies set by your own domain and by everyone else.
- Ask whoever manages your tag manager for a list of every tag in it, including the paused ones.
- Repeat the exercise on a form page, because the scripts are rarely identical to the homepage.
Then ask what each one is for and who asked for it. A third of them usually have no owner at all.
Here is the distinction that gets lost in the argument. A tracking script mostly collects behavioural data about a visitor nobody has identified. A contact form collects a named person voluntarily telling you something about their financial situation. The second is personal information in the plainest sense, and it is where a financial services firm carries its real exposure.
I have watched a firm spend a fortnight debating the wording on a cookie banner while its enquiry form emailed unencrypted client details to a personal address, kept a second copy in the WordPress database on shared hosting, and pushed a third to a CRM offshore. Nobody could say who had access.
The banner sits on the screen, so it collects the attention. The form is what matters, and it sits two clicks away with nobody watching it.
A privacy statement is not a shield you buy once and forget. It is a description of what your firm actually does with information, and it is only worth anything if it is true.
Write it in the language you would use with a client across the table: what you collect through the site, what you use it for, who else sees it, where it is stored, and how somebody asks for a copy or a correction. Name the categories of third party involved - your CRM, your email provider, your analytics - rather than writing as though there are none.
The Privacy Act 2020 is published in full on the New Zealand legislation site. The work that matters, though, is the mapping, not the wording.
There are three situations where I would tell a firm to run a banner, and none of them is New Zealand law.
The first is overseas traffic. If you act for expatriates in London, or take enquiries from people physically sitting in the EU or the UK, foreign rules can reach you regardless of where your server is. That is a question for your own legal adviser rather than for a plugin's defaults.
The second is platform terms. If you advertise through the large ad networks, they impose their own consent requirements for traffic from certain regions, and falling short degrades your measurement rather than your legal position here.
The third is group policy. Firms inside an Australian or global network usually inherit a standard from head office, and arguing the jurisdictional point up the chain is rarely worth the hour.
If you decide you need one, the worst outcome is a banner that does nothing. A great many are purely cosmetic: the scripts fire on page load no matter what the visitor clicks. That is worse than having no banner, because you have made a statement your site does not honour.
A banner that works holds the scripts until consent is given, offers a decline as easy to click as the accept, and remembers the answer instead of reappearing on every page. It should not cover your phone number, and it should not be the first obstacle a nervous prospective client meets on a small screen.
Expect your analytics to thin out once it is running properly. That is the trade, and a fair one if the consent is real.
The banner is the visible part, which is why it gets the argument. The scripts nobody has audited and the enquiry form quietly copying client details into three systems are the parts that matter, and they sit where nobody is looking. If your firm has an hour to spend on privacy this quarter, spend it on the map of where information goes, not on the pop-up at the door.
