Cookie banners: what UK law asks for and what it does not

You open your own website on a new phone and a box slides up from the bottom: “This site uses cookies. OK.” You did not ask for it, you are not sure who put it there, and you have no idea whether it keeps you within the law or is decoration. Most of what gets written about cookie law is written to sell a cookie plugin. The rules are shorter than the plugins suggest.

The two laws, in one paragraph each

PECR, the Privacy and Electronic Communications Regulations, is the cookie law. It says a website must ask before it stores anything on a visitor’s device, or reads anything back from it, unless that thing is needed to provide the service the visitor asked for. Cookies are the usual example. The same rule covers the browser’s local storage, tracking pixels and the fingerprinting tricks some ad tools use.

UK GDPR sets the standard that permission has to meet. Consent must be a clear action by the visitor, given freely, for something they were told about, before anything happens. A pre-ticked box fails that. So does “by continuing to browse you accept our cookies”, because carrying on scrolling is not a choice anybody made.

The Information Commissioner’s Office, the ICO, enforces both. Its first step is a letter, and it has written to large sites whose banners made saying no harder than saying yes. A small firm with a sensible banner is a long way down its list. A small firm with a banner that does nothing has a fault anybody can spot in ten seconds, which is a poor position to be in if a complaint arrives for another reason.

What does not need permission

PECR exempts anything strictly necessary for the thing the visitor came to do. On a typical small business site that covers:

• A shopping basket. The site has to remember what is in it from one page to the next.
• Logging in. A customer area or a WordPress login needs a cookie to know who you are.
• Security. Cookies that stop spam on a form, or that a firewall uses to tell a person from an attack.
• Remembering the visitor’s cookie choice. Storing “this person said no” is necessary, or the site would have to ask again on every page.

If your site sets only those, you do not need a banner. You still need a privacy page that says what you collect, but nobody has to be asked anything on arrival.

That is rarer than it sounds. Most small business sites carry at least one thing from the next list, often added years ago by somebody who has since moved on.

What does need permission

• Analytics. Google Analytics sets cookies to tell one visitor from another. It needs consent.
• Advertising tags. The Meta pixel, Google Ads remarketing, LinkedIn’s Insight Tag. These exist to follow people around the web, which is the case the law was written for.
• Embedded content. A YouTube video or a Google Map on your contact page can set Google’s cookies as the page loads, before anybody presses play. YouTube has a privacy-enhanced mode that holds back until the video starts; plenty of sites do not use it.
• Chat widgets, heatmaps and review badges. Many of these set their own tracking cookies, and their documentation tends to say so in small print.

The Data (Use and Access) Act 2025 loosened the rule for some analytics: a site can count visits for its own statistics without asking, provided it tells visitors and gives them an easy way to object. Google Analytics sits awkwardly with that, because the data goes to Google and Google uses it too. Until the ICO’s guidance settles the detail, the safe reading for a site running Google’s tools is that they still need a yes.

Why a banner with one OK button is worthless

A banner that says “We use cookies” with a single OK button fails twice.

First, there is no way to refuse. Consent that cannot be withheld is not consent, and an OK button records nothing except that the visitor wanted the box gone.

Second, and worse, the tracking has usually run before the banner appears. On a lot of sites the analytics and the ad pixels load with the page, and by the time the visitor taps OK, the cookies are on their phone.

A banner that counts needs three things:

1. Nothing optional runs until the visitor says yes. The analytics and ad scripts wait.
2. Saying no is as easy as saying yes. Two buttons, same size, same page. A big green Accept beside a pale “Manage preferences” link that opens four screens of toggles is the pattern the ICO has written to big sites about.
3. The visitor can change their mind later, and the site tells them how. A link in the footer that brings the banner back is the friendliest way.

What Google’s Consent Mode does

If you run Google Analytics or Google Ads, Consent Mode is the part of Google’s tag that listens to your banner. Set up properly, the page starts with everything marked as denied. Google’s tag loads in that state and sets no analytics or advertising cookies. When the visitor taps Allow, the banner tells the tag, and from that moment it works normally. If they tap No, it stays in the denied state for the rest of the visit and on later visits.

Google can still receive a basic signal that a page was viewed, without a cookie attached, and it uses those signals to estimate the visitors it cannot count. That keeps your reports and your Google Ads conversion figures closer to the truth than a site that loses everybody who refused. It only works if the default is denied. A site that loads Google’s tag first and asks afterwards has Consent Mode switched on and the same fault as the OK-only banner.

Our own banner, as a worked example

Our site uses Google Analytics and nothing else that needs permission, and the banner on this page is built round that one question.

• Before anything else runs, the page tells Google’s tag that analytics and advertising storage are denied.
• The banner appears at the foot of the screen with one sentence about what we use and why, a link to the privacy page, and two buttons of equal size: No thanks and Allow.
• Tap Allow and the banner tells Google’s tag to go ahead. Tap No thanks and nothing changes.
• Either answer is stored in your browser so the banner does not come back. That stored answer is the one thing we keep without asking, because remembering a refusal is strictly necessary.
• A visitor whose browser blocks storage gets asked again on the next visit, rather than the site assuming a yes.
• To change your answer, you clear this site’s data in your browser and the banner comes back. The privacy page says so. A footer link that reopens the banner would be friendlier, and it is the part of ours we would improve first.

There is no settings maze because we have one thing to ask about. A site with analytics and three ad platforms might want a switch for each.

Where to start with yours

Open your site in a private browser window and, before touching the banner, check what has loaded. In Chrome, right-click, choose Inspect, then Application, then Cookies. Anything listed there with a name starting _ga, _fbp or _gcl has been set before the visitor agreed to anything. Then tap No, reload, and look again. If those cookies are still there, the banner is decoration.

Most fixes are small: move the tags behind the banner, add a No button, set the default to denied. If the banner came from a plugin nobody has updated in years, replacing it is usually quicker than repairing it. Our website care and hosting plan covers this kind of fix for £49 a month. If you would like to know what your site sets before a visitor says yes, ask for a free website review and we will list it for you.