Cookie banners and UK law: what a small business website needs

Cookie banners are one of the most copied and least understood parts of a business website. Many sites show a banner they do not need, or run tracking before anyone has agreed to it. This note explains the UK rules in plain words, what you can do without asking, and a short routine for getting your own site right. It is general information, not legal advice.

Two laws, two jobs

Two sets of rules apply, and it helps to keep them apart.

• PECR, the Privacy and Electronic Communications Regulations, covers storing information on, or reading information from, a visitor's device. That includes cookies and similar tools such as local storage. It is about the device, whether or not the information is personal.
• UK GDPR covers what you do with personal data once you have it: having a lawful reason, telling people about it, keeping it safe and deleting it when it is no longer needed.

A banner is about the first one. A privacy notice, a lawful basis and good handling are about the second. A banner does not make a site compliant on its own.

The basic rule: ask first, unless an exception applies

Under PECR you generally need the visitor's consent before you store or access information on their device. Consent has to meet the UK GDPR standard: it must be a clear, active choice, freely given and informed. Pre-ticked boxes do not count, and neither does "by continuing to browse you agree". You must also say, before the cookie is set, what each kind is for and how long it lasts. The Information Commissioner's Office (ICO) sets out its position in its guidance on storage and access technologies, which was finalised in April 2026.

What you can set without asking

The guidance lists exceptions. The ones that matter most for an ordinary website are:

• Strictly necessary technologies: those needed to provide something the visitor asked for. Examples are a session cookie that keeps a form working, a shopping basket, or a security token that stops forged form submissions.
• Appearance and preference settings that the visitor chose, such as remembering a light or dark theme.
• Statistical purposes, since changes made by the Data (Use and Access) Act 2025. Some analytics cookies can now be used without prior consent, but only in limited conditions: the purpose is to understand and improve your own service, you give clear information, and you offer a simple way to object. This is narrower than many people assume. It is not a general permission for the big analytics and advertising platforms, so read the ICO's conditions before relying on it.

Marketing and advertising cookies, social media tracking pixels and cross-site tracking still need consent first.

Making a banner that works

When you do need consent, the design matters as much as the wording.

• Do not set anything non-essential before the visitor says yes. A banner on top of scripts that already ran is the most common mistake.
• Make "no" as easy as "yes". If there is an Accept all button on the first layer, there should be an equally clear Reject or Decline button there too.
• Explain in plain language what each group does, who sets it and how long it lasts. A link to a cookie policy that lists the real names is the standard way.
• Let people change their mind. A permanent link such as "Cookie settings" in the footer is enough.
• Do not lock content behind the choice unless there is a genuine reason.
• Keep a record of the choice and the wording shown when it was made, and ask again if you add new kinds of cookie.

A routine for your own site

1. List what you really set. Open your site in a browser, open the developer tools, and look at Cookies and Local Storage under the Application tab, before and after you click around. Do it with a clean profile. Plugins and embedded videos often add items you forgot.
2. Give each item a purpose. If you cannot say what it is for, you probably do not need it.
3. Remove what you do not need. Every item you delete is one less thing to explain and ask about.
4. Group what is left into strictly necessary, preferences, analytics and marketing.
5. Load third-party scripts only after consent when they need it. Video embeds, social buttons and chat widgets often set their own cookies.
6. Write the policy from the list, with real names and durations, and update it whenever the list changes.
7. Test it. Reject everything and check nothing non-essential appears; accept and check it does; change your mind and check it takes effect.

Do you need a banner at all?

If everything your site stores falls under the exceptions above, PECR does not require a consent banner. You still need to tell people what you use, which is what a cookie policy and a link to it are for. Some sites choose the simplest route: use only strictly necessary items and settings the visitor chose, publish a clear policy, and show no choice at all. That is a legitimate design, and it is faster and easier to use than a banner full of switches. The condition is that it stays true: the day you add an analytics or marketing tool, the position changes and the policy, the banner and the code have to change together.

Common mistakes

• Copying a banner from another site without checking what your own site sets.
• Describing a cookie as "necessary" because it is convenient for you rather than needed for what the visitor asked for.
• Loading analytics before the choice, then hiding the banner.
• A policy that lists cookies the site no longer sets, or misses new ones.

The rules around analytics have changed recently and guidance is still being applied in practice. Check the current ICO page, and ask a data protection adviser if you run advertising, a shop or a large audience.