A cookie banner is not a legal requirement. It is a consequence of what your website loads, and of a decision someone made while building it.
That distinction is worth a few minutes of your time, because a lot of UK small business sites carry a banner nobody ever needed.
TL;DR. If your site sets nothing beyond what it needs to function, there is nothing to ask permission for. If it measures visitors in a genuinely aggregate way, a change to UK law now in force may cover that without consent. If it runs advertising, tracks people between sites, or loads third-party embeds, you very likely do need one.
Most sites we are asked to look at fall into the first two.
The rule is about consent, not cookies
The relevant law is PECR, the Privacy and Electronic Communications Regulations. Its requirement is simple to state: storing information on someone’s device, or reading information already there, needs their permission first.
Two things follow from that wording, and both get missed.
The first is that this was never only about cookies. Local storage, tracking pixels and device fingerprinting are all caught, which is why the ICO now talks about storage and access technologies rather than cookies.
The second is the word first. Consent has to be obtained before non-essential technologies operate, not while they are already running. A banner that sets tags on page load and asks afterwards is not doing the job it appears to be doing. That is worth knowing, because a fair number of plugin banners behave exactly that way.
There has always been an exception for anything strictly necessary to deliver the service the person asked for. A cookie holding a shopping basket, keeping someone logged in between pages, or balancing traffic across servers sits inside it. A cookie that follows a visitor to somebody else’s website does not.
Strictly necessary means necessary to the visitor’s request. It does not mean necessary to your marketing.
What changed in 2025
The Data (Use and Access) Act received Royal Assent in June 2025 and introduced further exceptions for lower-risk uses of storage and access. Those exceptions are in force. Section 112 of the Act, which rewrites the consent rule in regulation 6 of PECR, commenced on 5 February 2026, and the ICO published its final guidance on storage and access technologies in April 2026.
The one that matters to a small business site is the exception for statistical purposes, often called the analytics exception. Broadly, if you are counting visitors to understand and improve your own site, that may not require a consent banner, provided you stay inside the conditions:
- The measurement is only used to improve your service. The moment the same data feeds an advertising audience, the exception is gone.
- The output is aggregate and does not identify anyone. Visitor counts and page paths, not a profile of a named person.
- You tell people clearly what you are doing. The exception removes the need to ask permission. It does not remove the need to be open about it, and that belongs in your cookie notice.
- You give people a simple, free way to object. An exception that relies on the visitor never being told, or never being able to say no, is not one you want to be leaning on.
Two cautions here, because this is where the reading usually goes wrong.
No analytics product is automatically exempt. The exception attaches to what the measurement does, not to a brand name. A tool configured to share data with its provider for that provider’s own purposes, or to build cross-site audiences, is outside it regardless of how it is marketed. Check the configuration, not the homepage.
Equally, no third-party tool automatically requires consent. What matters is whether it sets or reads non-essential information on the device. Many embeds do. Some do not. That is a question you answer by looking, not by assuming.
Four categories, and only one of them needs a banner
Strictly necessary. Baskets, logins, security, load balancing. No consent needed, and no banner.
Qualifying statistical use. Aggregate measurement of your own site, meeting the conditions above. No consent banner, but you still owe people a clear explanation and a way to object.
Advertising and cross-site tracking. Conversion tags, remarketing pixels, anything building an audience profile. Consent required, before it runs.
Third-party embeds and widgets. Maps, video players, chat bubbles, social feeds. Judged on what they actually set. In practice this is the category that catches small sites out, because the embed arrives with its own storage and nobody checks.
Check your own site in 10 minutes
You can usually settle this yourself, because it turns on what your site loads rather than on interpretation.
- Open your site in a private window.
- Open your browser’s developer tools, then the Application or Storage panel.
- Load a few pages as a normal visitor would.
- Read what is listed under cookies and local storage, and note which names you do not recognise.
- For each one you do not recognise, find what put it there. It is almost always an embed.
If that list is empty, or holds only things your site needs to work, you do not need a banner. You need a cookie notice that says so.
An example
A physiotherapy clinic asks us to look at their site. It has a banner. The inventory turns up three items: a session cookie for the contact form, an aggregate analytics cookie, and a set from an embedded Google Map on the contact page.
The form cookie is strictly necessary. The analytics is configured to stay aggregate and is not feeding an ad platform. The map is the only thing creating a consent problem, and it is on one page, for an address that could be a static image linking through to directions.
Swap the embed, keep the notice, drop the banner. The site is now simpler, faster and easier to defend than it was with a consent dialogue on it.
What we do on the sites we build
We start from the position that a page should load without asking the visitor for anything. That is a design decision before it is a legal one: the first thing someone meets should be your work, not a dialogue box.
In practice that means keeping third-party embeds off the page unless they earn their place, and choosing measurement that stays aggregate. Some sites do genuinely need consent: a business running paid advertising has to measure it. There we build the banner so it blocks tags until someone agrees, rather than firing them and apologising afterwards.
One caveat, plainly. This is a description of how the rules work, not legal advice, and the detail is still settling. If your site handles health data, children’s data, or anything else sensitive, take proper advice rather than working from a blog post.
The point is narrower than it sounds. Before accepting a banner as the price of having a website, it is worth 10 minutes to check whether yours needs one. A good number do not.
If you would like a second pair of eyes on what your site is actually loading, we are happy to take a look and tell you what we find. No charge, and no obligation either way.
