Do I need a cookie banner? UK rules for small business websites

Do I need a cookie banner on my website? In the UK, you need one if your site uses cookies or similar tracking for anything beyond what's essential, such as advertising, social media pixels or most third-party analytics. If your site only uses essential cookies, you don't need a consent banner, although you still need to explain them in your privacy policy.

The rules changed in February 2026, and some simple analytics no longer need consent. That has caused a lot of confusion, and plenty of myths along the lines of "cookie banners are gone".

This guide is for UK small business owners who want a plain answer. We'll cover what changed, which cookies still need consent, how to check what your own site sets, and what a compliant banner looks like.

The short version

• UK cookie rules come from PECR, the Privacy and Electronic Communications Regulations. The ICO (the UK's data protection regulator) enforces them.
• Since 5 February 2026, some low-risk uses, including basic analytics used only to improve your site, can run without consent if strict conditions are met.
• Advertising cookies, tracking pixels and social media tracking still need consent. That hasn't changed.
• If you do need a banner, rejecting must be as easy as accepting, and nothing non-essential can load before someone says yes.
• Whatever you use, your privacy policy should explain it clearly.

What counts as a cookie?

A cookie is a small text file a website saves in your browser. It lets the site remember something about you, such as what's in your basket or whether you've visited before.

The UK rules don't just cover cookies, though. They cover any technology that stores or reads information on a visitor's device. That includes tracking pixels, local storage and similar tools. The ICO now calls these "storage and access technologies".

So when we say "cookies" in this guide, we mean all of them.

Do I need a cookie banner in the UK? It depends what your site uses

Under PECR, the starting point is simple. You need consent to store or read information on someone's device, unless one of the exceptions applies.

The ICO's guidance on the exceptions lists five situations where consent isn't needed:

1. Communication: purely to carry a communication across a network, such as some load-balancing cookies.
2. Strictly necessary: needed to provide something the visitor has asked for, such as a shopping basket, a login or security features.
3. Statistics (new): collecting statistical information about visitors, purely to improve your website.
4. Appearance (new): remembering a visitor's preferences for how the site looks or works, such as text size or language.
5. Emergency assistance (new): finding the location of someone who needs emergency help.

If everything your site sets fits into those boxes, you don't need a consent banner. If anything falls outside them, you do.

One important detail: "strictly necessary" is judged from the visitor's point of view, not yours. The ICO is clear that advertising cookies are not strictly necessary, even if your business relies on ads.

What changed in 2026?

The Data (Use and Access) Act 2025 became law on 19 June 2025. It added the three new exceptions above to PECR. According to legislation.gov.uk, those cookie changes came into force on 5 February 2026.

The headline for small businesses is the statistics exception. It means some website analytics can now run without asking first. However, it comes with conditions, and it's narrower than many articles suggest.

The conditions for analytics without consent

To use the statistics exception, all of these need to be true:

• The only purpose is collecting statistics to improve your website.
• The data isn't shared with anyone, except someone helping you make those improvements.
• You give visitors clear and comprehensive information about what you're doing and why.
• You give visitors a simple, free way to object, and they haven't objected.

The ICO adds that this exception is about overall statistics, not tracking individual people. It also doesn't cover advertising or measuring ad campaigns.

What about Google Analytics?

This is the question we hear most. The honest answer is: it depends on how it's set up.

The ICO says you can use a third-party analytics provider under the exception. However, the provider must only use the information to improve your service, must act on your behalf rather than for its own purposes, and must not combine it with other data. You also need to tell visitors you use it.

The ICO doesn't name any particular product. So whether your analytics qualifies comes down to its settings and the provider's terms. If your analytics is linked to advertising features, or the provider uses the data for its own purposes, the exception won't apply. In that case, keep asking for consent.

If you're not sure, asking for consent is the safe option. It's what we do on our own site.

Which cookies still need consent?

These all still need a visitor's permission before they load:

• Advertising cookies, including those used to measure ads. The ICO's page on online advertising says these purposes are not exempt and never have been.
• Social media tracking, such as tracking pixels from social networks, or share buttons and feeds that track visitors. The ICO says consent is needed whether or not your visitor uses that network.
• Remarketing, where visitors later see your ads on other sites.
• Analytics that don't meet the conditions above.

It's also worth checking anything you've embedded. Videos, maps, chat widgets and booking tools from other companies can set their own cookies. They count as part of your site.

How to check what cookies your website uses

You can't decide whether you need a banner until you know what's there. Here's a simple way to find out:

1. List your tools. Write down every outside service your site uses: analytics, ads, social media pixels, video embeds, maps, chat, booking and payment tools.
2. Open your site in a private browser window. This starts you with no saved cookies.
3. Look at the cookies. In Chrome, right-click the page, choose Inspect, then the Application tab, then Cookies. Other browsers have a similar developer tools panel.
4. Do it before clicking anything. If non-essential cookies appear before you've accepted, your banner isn't working properly.
5. Then reject, and check again. After clicking reject, advertising and tracking cookies shouldn't appear.
6. Match each cookie to a purpose. Put each one into a category: essential, statistics, preferences, advertising or social. That tells you whether consent is needed.

If this sounds fiddly, a cookie consent plugin with a scanner can do much of it for you. Your web designer should also be able to tell you exactly what your site sets.

What does a compliant cookie banner look like?

If you need consent, the banner has to do the job properly. The ICO's guidance on managing consent in practice sets out what it expects. Use this as a checklist:

• Rejecting is as easy as accepting. In practice, that usually means "Accept" and "Reject" buttons side by side, with equal weight.
• No non-essential cookies load until the visitor actively says yes.
• Optional categories are switched off by default. No pre-ticked boxes.
• Visitors can see which third parties are involved.
• Visitors can change their mind later, as easily as they agreed. A "cookie settings" link in the footer does this well.
• Consent is separate from your terms and conditions.

And here's what doesn't count as consent:

• "By continuing to use this site, you agree to cookies" with a single OK button.
• Silence, scrolling or simply carrying on browsing.
• A "cookie wall" that blocks your whole site unless people accept. The ICO says this take-it-or-leave-it approach won't comply in most cases.

Do small businesses really need to worry?

The rules apply to any website that uses non-essential cookies, whatever the size of the business. There's no small business exemption.

That said, the ICO says monetary penalties are reserved for the most serious breaches, and its action should be proportionate. For most small businesses, the bigger reasons to get it right are trust and tidiness. Visitors notice a banner that won't let them say no.

A clean set-up is also often a faster one. Every tracking script you remove is one less thing slowing your pages down, which we touched on in how we got our website to 100 on Google PageSpeed.

From our experience

Andy has built WordPress sites since 2009, and cookie consent is one of those jobs that is easy to set up once and then forget. The most common problems we come across are simple ones. A banner that only has an "OK" button. A banner that looks fine but loads tracking before anyone clicks. Or a new plugin, embed or pixel that was added months after the banner was set up, and never added to it.

On our own site, we use a consent plugin, and Google Analytics cookies are only set if a visitor clicks Accept. If they click Deny, or make no choice, the cookies aren't set. Our privacy and cookies policy lists exactly which cookies we use and why.

For the sites we build, we set up cookie consent as part of the job. Because every website subscription includes a care plan, we're also there when things change, such as a new tool or a change in the rules. Keeping on top of changes like this is a big part of why website maintenance matters.

One honest note: we're web designers, not lawyers. This guide explains the ICO's published guidance in plain English. If your business handles sensitive data or runs a lot of advertising, it's worth getting proper legal advice too.

Frequently asked questions

Do I need a cookie banner if I don't use Google Analytics?

Not necessarily. If your site only sets essential cookies, such as for a login or basket, you don't need a consent banner. You still need to explain those cookies in your privacy policy. Check your embeds too, as videos and maps can set cookies of their own.

Can I get rid of my cookie banner now the rules have changed?

Only if everything your site sets fits one of the exceptions, including the conditions for analytics. If you use advertising cookies, tracking pixels or social media tracking, you still need consent. Check before removing anything.

Is a privacy policy the same as a cookie banner?

No. A privacy policy explains what personal data you collect and how you use it, including cookies. A cookie banner asks for permission. Most business websites need a privacy policy, even those that don't need a banner.

Does my cookie banner have to have a reject button?

If you're asking for consent, rejecting must be as easy as accepting. A clear "Reject" button next to "Accept" is the simplest way to meet that.

Do cookie rules apply to sole traders?

Yes. The rules apply to any website that stores or reads information on visitors' devices, whatever the size of the business behind it.

Want your cookie set-up checked?

If you're not sure what your site sets, or whether your banner works, we can take a look and sort it out. See our WordPress care plans, or contact us to talk it through.

We're based in West Yorkshire and work with small businesses right across the UK.