If your website uses Google Analytics, advertising tools, or almost any tracking beyond the strictly essential, UK law requires you to ask visitors for consent before those cookies load. This guide explains what that actually means in practice, without acting as a substitute for tailored legal advice.
Direct answer: a compliant UK cookie banner must appear before any non-essential cookies load, clearly explain what categories of cookies your site uses, give visitors a genuinely equal choice to accept or decline, and link to a full cookie policy. Non-essential cookies, such as analytics or advertising, must not fire until the visitor has actively consented.
Do you actually need one?
In most cases, yes. UK PECR rules, which sit alongside UK GDPR, require consent for non-essential cookies, and this covers the vast majority of small business websites running standard analytics or marketing tools. A change under the Data (Use and Access) Act 2025, in force from February 2026, introduced a narrow exemption for certain anonymised analytics setups, but official guidance for small businesses on applying this is still developing. Until that guidance is clearer, keeping a compliant banner remains the safer approach for most sites.
What a compliant banner needs to do
1. Appear before non-essential cookies load
The banner needs to show on a visitor’s first visit, and analytics or marketing cookies should not fire until they’ve actively consented. A banner that appears after tracking has already started doesn’t meet the requirement.
2. Offer a genuinely equal choice
“Accept” and “Decline” need to be equally easy to find and select. A prominent accept button paired with a hidden or awkward decline option does not meet current standards, since regulators specifically look for this pattern.
3. Explain what your cookies actually do
Rather than a vague statement about “improving your experience,” the banner or its linked settings should explain the categories in plain terms, such as analytics cookies used to understand site traffic, or marketing cookies used for advertising.
4. Link to a full cookie policy
The banner itself doesn’t need to explain everything. It should link through to a detailed policy covering what each cookie does, how long it lasts, and how a visitor can change their choice later. This is often included within your website privacy policy, or as a separate linked document.
5. Let visitors change their mind
Consent isn’t a one-time decision. A simple, easy to find way to revisit cookie settings, commonly a small link in the footer, needs to remain available after the initial choice.
How this fits into your website build
Cookie consent is a legal and technical requirement worth planning for from the start rather than adding as an afterthought. If you’re working from a website design brief, flag it alongside your privacy policy requirements so a developer can build the mechanism in properly, ensuring tracking scripts genuinely wait for consent rather than firing regardless.
Free versus paid cookie consent tools
| Option | Best for |
|---|---|
| Free tier of a dedicated consent tool | Simple sites with standard analytics and a handful of third-party scripts |
| Paid consent management platform | Sites with several tracking tools, needing automatic cookie scanning and detailed consent logs |
| Manual implementation | Very simple sites with a developer comfortable building the blocking logic properly |
Most small businesses do well starting with a reputable free tier, provided it genuinely blocks non-essential cookies until consent is given rather than simply displaying a banner without enforcing the choice behind it.
Common mistakes
- A banner that doesn’t actually block anything. Some basic setups display a notice without technically preventing cookies from loading beforehand, which doesn’t meet the requirement.
- Pre-ticked consent boxes. Consent needs to come from a clear, active choice, not a default that’s already switched on.
- No easy way to withdraw consent later. A one-time choice with no way to revisit it falls short of current guidance.
- Confusing “necessary” cookies with tracking ones. Only cookies genuinely required for the site to function, such as a shopping basket, are exempt from consent. Analytics almost never qualifies as strictly necessary.
When to get professional legal help
This guide explains what a cookie banner needs to do and where it fits into your website, but it isn’t a substitute for tailored legal advice, particularly if your business processes data in more complex ways or operates across multiple countries. A solicitor or specialist legal service can confirm your specific setup meets current requirements.
FAQs
What happens if my website doesn’t have a cookie banner? You risk non-compliance with PECR and UK GDPR, which the ICO can enforce, alongside the reputational cost of visitors noticing tracking cookies loading without their consent.
Do I need a cookie banner if I only use Google Analytics? In most cases, yes, since standard Google Analytics setups count as non-essential tracking requiring consent. A narrow exemption exists under recent legislation for specific anonymised configurations, but official small-business guidance on this is still developing.
Is a free cookie consent tool good enough? Often, yes, for a simple small business site. Check that it genuinely blocks non-essential cookies until consent is given, rather than just displaying a notice without enforcing the choice.
Is a cookie banner the same as a cookie policy? No. The banner is the visible consent mechanism a visitor interacts with. The cookie policy is the detailed document explaining exactly what each cookie does, which the banner should link to.
