Cookie banners and UK law: what small businesses need

Key takeaways

Under UK law, the Privacy and Electronic Communications Regulations (PECR) require consent before setting non-essential cookies, such as advertising and most tracking cookies. A compliant cookie banner makes rejecting as easy as accepting, sets nothing non-essential before consent, and explains what each category does. The Data (Use and Access) Act 2025 relaxes some rules for low-risk cookies and raises fines.

• Strictly necessary cookies do not need consent; advertising and most tracking cookies do.
• Reject must be as easy as Accept: no hidden options or pre-ticked boxes.
• No non-essential cookies should load before the visitor chooses.
• The Data (Use and Access) Act 2025 exempts some low-risk cookies.
• PECR fines rise to UK GDPR levels under the 2025 Act.

What is a cookie banner?

A cookie banner is a notice on a website that tells visitors what cookies and similar technologies the site uses and, where the law requires it, asks for their consent before non-essential ones are set.

Cookies here means any technology that stores or reads information on a visitor's device, including tracking pixels, local storage and device fingerprinting. The ICO's guidance on cookies and similar technologies covers all of them.

When do you need consent for cookies?

Under PECR you need consent for any cookie that is not strictly necessary to provide a service the user has requested. Strictly necessary covers things such as a shopping basket, security features and remembering a cookie choice.

Advertising cookies, social media pixels and cross-site tracking always need consent. Historically, analytics cookies have needed consent too. The Data (Use and Access) Act 2025 introduces exemptions for some low-risk purposes, including certain analytics used to improve a service, provided users are given clear information and a simple way to object. These changes are being brought into force in stages, so check the ICO's current guidance before relying on them.

What does a compliant cookie banner look like?

The ICO has been clear about the features that make a banner compliant. The same features also make it more trustworthy to visitors.

• Accept and Reject options with equal prominence on the first layer.
• No pre-ticked boxes for non-essential categories.
• Plain explanations of each category and who sets the cookies.
• No non-essential cookies or tags firing before a choice is made.
• An easy way to change the choice later, such as a footer link.
• A cookie policy listing the cookies used.

• What a UK website privacy policy must include

What are the penalties for getting it wrong?

Historically, the maximum PECR fine was £500,000. The Data (Use and Access) Act 2025 aligns PECR penalties with UK GDPR, up to £17.5 million or 4% of global annual turnover, whichever is higher. The ICO has said it will focus on the most widely used and intrusive practices, and it has written to many website operators about non-compliant banners.

For most SMEs, the more immediate risk is trust. A banner that bullies visitors into accepting, or ignores their choice, undermines the credibility of the whole site.

How do cookie rules affect your analytics?

If analytics or ad tags only run after consent, a share of visitors will not be counted. Google's Consent Mode can model some of the missing data, and server-side or privacy-focused analytics can reduce reliance on cookies, but some loss of data is the cost of compliance.

Plan for it. Judge trends rather than absolute numbers, track key events consistently, and compare enquiries recorded in analytics with enquiries actually received.

• GA4 setup for small business websites
• Track every website enquiry to its source

When do you not need a cookie banner at all?

If your site sets only strictly necessary cookies, you need to tell visitors what you use, usually in a cookie or privacy policy, but you do not need a consent banner. Some small sites achieve this by removing advertising pixels and using cookie-free analytics.

The trade-off is marketing data. Without advertising cookies you lose retargeting and some attribution. For many small businesses with modest ad spend, that is a trade worth considering.

What does this look like in practice?

A pattern we find often: a banner with a large Accept all button and a small Manage settings link, while analytics, a Meta pixel and a chat widget load the moment the page opens, before any choice.

Configuring tags to wait for consent, adding an equal Reject button and listing cookies properly makes the site compliant with current guidance. The data loss is usually smaller than owners fear.

• What makes a business website effective
• See the three problems we fix for UK businesses

Cookie compliance checklist

Check these with your browser's developer tools open.

• List every cookie and tag the site sets.
• Classify each as strictly necessary or not.
• Block non-essential tags until consent.
• Give Reject equal prominence to Accept.
• Remove pre-ticked boxes.
• Add a link to change cookie choices.
• Publish a cookie policy.
• Recheck after adding any new tool.

Next step

If you are not sure what your site sets before consent, we will check it with you in 30 minutes and tell you exactly what needs changing.