Do You Need a Cookie Banner? UK Rules for Small Business Websites

What changed in 2026

The UK’s cookie rules sit in the Privacy and Electronic Communications Regulations, usually shortened to PECR. The Data (Use and Access) Act 2025 changed them, and the cookie changes took effect on 5 February 2026. Three things matter for a small business website:

• New exceptions to consent. Alongside cookies that are strictly necessary, you no longer need consent for cookies used only to collect statistics so you can improve your site, or only to remember how someone wants the site to look or work, such as their language. Both come with conditions, covered below.
• Much bigger fines. The maximum penalty under PECR rose from £500,000 to the UK GDPR level: £17.5 million or 4% of global annual turnover, whichever is higher.
• Final guidance. The Information Commissioner’s Office (ICO), the UK regulator, published its final guidance on “storage and access technologies” on 29 April 2026. The term is wider than cookies: it also covers tracking pixels, local storage, device fingerprinting and similar techniques.

What still needs consent

The ICO is blunt about advertising: “Online advertising purposes are not exempt from PECR’s consent requirements and never have been.” In practice, you still need a visitor’s consent before loading:

• advertising and retargeting pixels: Meta (Facebook and Instagram), TikTok, LinkedIn, Pinterest and the like
• Google Ads conversion tracking and remarketing tags
• analytics used for advertising or profiling, such as Google Analytics linked to Google Ads, or with Google signals switched on
• anything else that tracks individual visitors or builds profiles of them

Analytics: the new exception and its conditions

This is the change most small businesses will notice. Cookies for website statistics can run without consent if all of these are true:

• The only purpose is to understand how your site is used so you can improve it.
• The results are aggregated: totals and trends, not a record of what individual people did.
• You give clear information about it, usually in your privacy or cookie notice.
• Visitors have a simple, free way to object, and it works.
• If you use an outside analytics provider, it acts only on your behalf (as your processor), uses the data only to help improve your site, and doesn’t combine it with other data.

Where does Google Analytics fit? The ICO’s guidance doesn’t name it. Google Analytics set up purely for your own statistics, not linked to Google Ads, with Google signals and data sharing switched off and detailed data kept for the shortest period (two months), is the version with the strongest case for the exception. Google Analytics used for advertising clearly needs consent. The grey area is Google’s own role, because the exception needs the provider to act purely as your processor. If you want certainty, either ask for consent before loading Google Analytics, or use a cookie-free analytics tool.

Cookie-free analytics tools, such as Plausible, Fathom or Simple Analytics, don’t set cookies or store anything on visitors’ devices, which takes the consent question off the table. You still mention them in your privacy policy.

What “a simple way to object” can look like

• A short, plain explanation in your cookie or privacy notice: what you measure, with which tool, and why.
• An opt-out switch on that page that stops analytics loading for that visitor, and keeps working on their next visit.
• Respecting it everywhere: once someone opts out, nothing analytics-related should load on any page.

A small, non-blocking notice on the first visit, with a link to that switch, makes it easy to find. Whatever you choose, it should be clear, easy to use and free.

Embedded videos, maps and fonts

Embedded YouTube videos, Google Maps, social media feeds and booking widgets can set their own cookies as soon as your page loads, before anyone touches them. The ICO expects you to know whether they do, to tell visitors, and to set them up in the most privacy-friendly way available. The simplest fix is click-to-load: show a placeholder image, and only load the video or map when someone clicks it. For YouTube, the privacy-enhanced youtube-nocookie.com address helps too.

Fonts loaded from an outside service, such as Google Fonts, also come up in the guidance. The ICO says you may need to tell visitors about them and let them object, and suggests hosting the font files on your own site instead.

If you do need a banner

Using advertising pixels or ad-linked analytics? Then you need a consent banner, and it has to work properly:

• Refusing must be as easy as accepting. A “Reject all” button as prominent as “Accept all”.
• Nothing non-essential before a choice. Ads and tracking tags load only after someone says yes.
• Off by default. No pre-ticked boxes, and silence or carrying on browsing isn’t consent.
• Easy to change your mind. A link in your footer that reopens the choices. Withdrawing consent must be as easy as giving it.

A 15-minute check of your own website

1. Open your website in a private browser window, and don’t click anything.
2. Open the browser’s developer tools (F12 on most Windows browsers), go to the Application tab (Storage in Firefox) and look under Cookies and Local storage. Free online cookie scanners do the same job.
3. For each item, note who sets it and why: your website itself, your analytics, an advertising platform or an embed.
4. Sort them into strictly necessary, statistics, preferences, advertising and embeds.
5. Advertising: consent first. Embeds: click-to-load. Statistics: meet the conditions above, ask for consent, or switch to cookie-free analytics.
6. Update your privacy or cookie notice to match, and check again whenever you add a plugin, a pixel or a new tool.

We’re web designers, not lawyers. This is general information about the UK rules as they stood in November 2026, not legal advice. For anything complex, such as heavy advertising, children’s services or a large customer database, speak to a data protection specialist or read the ICO’s guidance directly.