Does My Website Need a Cookie Banner? The UK Rules, Plainly

Does my website need a cookie banner? It’s the kind of question that turns up after you’ve noticed banners on every other site you visit, or a customer’s mentioned GDPR in passing, or your accountant’s asked and you realised you didn’t actually know the answer. Here’s the straight version: it depends on what your website is quietly doing in the background, not on how big your business is or how many pages you’ve got.

I build and fix websites for small businesses around Sunderland and the North East, and it’s a question every site owner should be able to answer. This isn’t legal advice and I’m not pretending it is. What follows is what the rules say, taken from the regulator, plus how to check your own site rather than guess at it.

So, does my website need a cookie banner?

The short answer: only if your site stores or reads something on a visitor’s device beyond what the rules let you do without asking. Size and turnover have nothing to do with it. A one-page site for a market stall and a ten-page site for a solicitor’s practice are judged by the same rule.

The regulation that covers it is PECR, the Privacy and Electronic Communications Regulations, rather than UK GDPR on its own, though the two overlap once personal data’s involved. The ICO published its finalised guidance on storage and access technologies on 29 April 2026, taking in the changes the Data (Use and Access) Act made to PECR, and there are now five exceptions rather than two. Anything you read still saying two is out of date.

Three of the five matter to an ordinary small business site. Anything strictly necessary to deliver what the visitor asked for, so a shopping basket or a login session. Anything whose sole purpose is aggregate statistics about how the site gets used, which is the new statistical purposes exception. And anything that only adapts how the site looks for that visitor. The catch on the last two is what people miss: the regulations require clear information plus “a simple means of objecting, free of charge”, and without that the exception doesn’t apply. Everything else needs consent before it runs, advertising most obviously, because no advertising purpose meets the strictly necessary exception and the statistical one doesn’t stretch to it.

So a genuinely plain site can sit outside all this. A few static pages, a contact form that emails you directly, no embedded video, no live chat bubble, analytics kept to plain visitor counts with a clear way to opt out. That’s a real position now, and a year ago it wasn’t. Read the conditions back, though. Check your own site against every condition before assuming you’re in the clear.

What your site is probably actually doing

Nobody sets out to break this rule. It can happen in the background, in separate steps, months apart, with nobody checking the whole picture.

Say whoever built the site put Google Analytics on at launch, and nobody had the consent conversation. Later, someone might run a Facebook ad campaign and add the Meta pixel to see what worked. The campaign ends; the pixel’s still sat there, loading on every visit since. Then there’s a YouTube video on the about page, and that’s a third party’s player on your page, so check what it sets before anyone has pressed play.

None of those three are strictly necessary. That bit’s straightforward. Where each one lands after that isn’t, so don’t lump them together. Analytics has a way out, if it’s only ever producing aggregate numbers and you give people a simple free way to object. The ICO is specific about what tips it back over the line: logging what individual visitors did, profiling people by IP address or by the pages they read, measuring ad clicks, or passing conversions to an ad platform. Google Analytics wired into Google Ads can be doing some of those. The Meta pixel does it by design, which is why that one always needs consent. And the YouTube embed is a third party’s feature on your page, which the ICO treats as your responsibility to check.

How to check your own site in five minutes

You don’t need to take anyone’s word for this, mine included. Open your site in a private window, so there’s no old consent choice sitting in storage, and press F12 or right-click and choose Inspect. In Chrome it’s the tab labelled Application; in Firefox it’s Storage. Find Cookies in the list on the left and click your own domain.

Now reload and look at what’s already there before you’ve clicked anything, banner included. Names starting with _ga mean Google Analytics is running. _fbp means the Meta pixel. Anything from youtube.com is worth a closer look: it may mean an embedded video is setting something before consent. If that list is empty until someone actively agrees to something, you’re in decent shape. If it isn’t, you’ve just seen the actual problem instead of guessing at it.

The Network tab does the same job if you’d rather watch requests fire as the page loads: filter for “google-analytics”, “googletagmanager”, “facebook” or “youtube” and reload. Either way, five minutes and you’ve stopped guessing.

If that list comes back longer than you expected and you’d rather someone read it for you, that’s something I can look at with you.

What PECR actually asks of you

Once you know what your site is setting, the rule itself is short. Tell people it’s there, explain what it does and why, and get consent before you set anything that isn’t exempt. Regulation 6 of PECR covers storing or accessing information on someone’s device and it isn’t limited to cookies. That’s why the ICO’s guidance covers tracking pixels and device fingerprinting as well. Strip it right back and “does my website need a cookie banner” becomes one question: is anything loading on your pages that isn’t exempt?

What counts as consent has its own bar. PECR borrows the UK GDPR definition, so it has to be freely given, specific, informed, unambiguous, and given by a clear affirmative action. Then the ICO adds two more requirements. You must not pre-enable non-exempt storage and access technologies, in its own words, and its checklist for consent mechanisms includes one that “makes it as easy to refuse consent as it is to accept”. Those two lines do much of the work in this whole topic.

The setup that breaks the rule

Here’s one way a site can fall down without anyone meaning it to. A banner appears, it looks the part, and Google Analytics has already fired before anyone’s touched it. That’s not a cookie banner. That’s decoration sat on top of tracking that never stopped, and it’s arguably worse than no banner at all, because it tells the visitor you’ve handled something you haven’t.

The other version is the wording. “By continuing to browse, you accept our use of cookies” has sat on plenty of UK websites for years and does not meet the bar. Don’t take my word for that one either: the ICO puts almost exactly that sentence in its guidance as a worked example of bad practice, and says it “does not represent valid consent, even if the mechanism also includes an ‘OK’ or ‘Accept’ button”. Scrolling past isn’t a positive action. Neither is closing it, and neither is a pre-ticked box.

This isn’t legal advice, and the ICO says that too

This is a plain-English read of the regulator’s own guidance, not a legal opinion on your site. I’m not qualified to give you one. Where you want that, go to the source rather than a web designer’s blog, mine included. The ICO publishes advice written for small and medium organisations, and gov.uk has a plain overview of UK data protection law, covering UK GDPR and the Data Protection Act 2018. PECR sits alongside those rather than inside them, so for cookies you want the ICO guidance.

On the “what actually happens to me” question, treat anything more than a few months old with suspicion. The ICO says the PECR enforcement regime is changing to line up with the UK GDPR regime, with new guidance to follow; until then its Regulatory Action Policy applies, reserving monetary penalties for the most serious infringements. Announcing the new guidance it also said 99% of the UK’s top 1,000 websites now meet its standards for cookie banners, after working directly with industry. That says nothing about every other site, and the rule applies however small yours is. Don’t assume the current approach will last, because the ICO says the enforcement regime is being aligned with the UK GDPR one.

What actually fixing this looks like

On a small site this can be a short job rather than a project. Audit what’s firing using the check above. Then decide what you actually need, and put something in front of the rest that stops it running until someone’s said yes. That can be a proper consent management tool, or in some cases just moving the analytics code so it only loads after a genuine click instead of sitting in the page’s head from the first byte the browser downloads.

There’s a second route, and on a straightforward brochure site it’s the one I’d look at first. If all you ever wanted from analytics was visitor numbers and which pages people read, keep it inside the statistical purposes exception instead: unpick the ad-platform wiring, stop it profiling individuals, say plainly in your privacy notice what you collect and why, and give people a simple free way to object. Done properly that’s no banner at all, which beats bolting a consent tool onto tracking nobody ever looks at.

It needn’t be anyone’s deliberate choice. The cause can be whoever installed the analytics: an agency years back, a theme that shipped with GA switched on, or a plugin that added a pixel nobody remembers agreeing to. Fixing it properly means looking at the wider setup, which is closer to an IT infrastructure consultation than a cosmetic tweak. If the site’s old enough that this is the least of its problems, it’s worth seeing what a rebuild would fix at the same time. Either way it sits alongside ongoing tech support, not a one-off panic.

FAQs

Does my website need a cookie banner if I don’t use Google Analytics?

Possibly not, but don’t assume it from that alone. Check for a Meta pixel, embedded YouTube or Vimeo videos, live chat widgets, and any booking or payment tool not hosted on your own domain. Any of those can set cookies that fall outside all five exceptions, which brings the same rule back into play with GA switched off.

Do I need a cookie banner just for Google Analytics?

Not automatically, and this is the bit that changed. Analytics has never been strictly necessary, but since the Data (Use and Access) Act amended PECR there’s a statistical purposes exception covering it, provided the sole purpose is aggregate statistics used to improve the site, you tell people clearly, and you give them a simple free way to object. Go beyond that and you lose it. Profiling visitors, tracking individuals, measuring ad clicks or feeding conversions back to an ad platform all need consent.

What happens if I don’t have a cookie banner and I should?

I can’t give you a legal answer on your own risk and you shouldn’t take one from a blog post. What I can tell you: the ICO’s Regulatory Action Policy reserves monetary penalties for the most serious infringements, the PECR enforcement regime is being changed to line up with UK GDPR, and the rule applies however small you are. Worth fixing either way.

Does “by continuing to browse you accept cookies” count as valid consent?

No. The ICO’s guidance uses almost that exact sentence as a worked example of bad practice and says it doesn’t represent valid consent, even with an OK or Accept button next to it. Consent has to come from a clear affirmative action, and a pre-ticked box doesn’t count either. Wording alone, with no real option to say no, does not meet the bar.

What’s actually involved in sorting a cookie banner properly?

Three steps. Find out what’s genuinely firing, decide which of it you actually want, then either gate the rest behind a banner that blocks until someone opts in, or strip the non-exempt parts out so you don’t need one.

You can run that check yourself in the time it takes to make a coffee, and plenty of people should. If you’d rather I looked at what your site’s actually loading and told you plainly whether it’s a problem, I do website and IT work for businesses across Sunderland and the North East. Get in touch and I’ll tell you straight what, if anything, needs sorting.