Do I need a cookie banner in the UK?

What the law says

The rule is in the Privacy and Electronic Communications Regulations, known as PECR. Regulation 6 says you must not store information on someone’s device, or read information from it, unless an exception applies. The usual way to meet it is to give people clear information and get their consent.

It’s wider than cookies. The ICO says it covers tracking pixels, local storage, software development kits and device fingerprinting too, and it applies whether or not the information is personal data.

Cookies you don’t need consent for

Some storage is strictly necessary to give someone a service they asked for. Examples include keeping items in a shopping basket, keeping someone signed in, security and fraud prevention, and remembering the choice they made in your cookie banner. Necessity is judged from your visitor’s point of view, not your business’s. Advertising never counts.

Since 5 February 2026 there are also narrow exceptions for some analytics and for remembering how someone likes your site to look. They come with conditions, including telling people and giving them an easy way to object. Our guide to the 2026 UK cookie rules explains what they allow. For most small business sites using Google Analytics alongside Google Ads, asking for consent is still the safe route.

What a valid banner looks like

Consent has to meet the UK GDPR standard: freely given, specific, informed and unambiguous, shown by a clear action. In practice that means:

• Rejecting is as easy as accepting. A banner with “Accept all” but no “Reject all” on the first screen is the ICO’s own example of getting it wrong.
• Optional categories start switched off. No pre-ticked boxes.
• Carrying on browsing doesn’t count as consent.
• Nothing optional runs before the visitor chooses. Analytics and advertising tags have to wait.
• People can change their mind later, as easily as they gave consent.

“Cookie walls”, which block your site until someone accepts, rarely pass. The ICO says that in most cases this take-it-or-leave-it approach doesn’t give people a free choice.

Keeping proof

UK GDPR says you must be able to show that someone consented. The ICO suggests recording who consented, when, what they were told and how they consented, and keeping that for as long as you rely on the consent.

What happens if you don’t

Since 5 February 2026 the ICO can fine up to £17.5 million or 4% of worldwide turnover for cookie breaches, the same as UK GDPR. The old limit was £500,000.

The ICO has been working through the UK’s busiest websites. By December 2025 it had written to hundreds of them, 564 had fixed their banners and it had issued 17 preliminary enforcement notices. That review covered the biggest sites, but anyone can complain to the ICO about a website, whatever its size.

A checklist for small businesses

1. List what your site loads: analytics, advertising pixels, chat widgets, embedded videos and maps.
2. Sort each one into strictly necessary, preferences, statistics or marketing.
3. Add a banner with “Accept all” and “Reject all” side by side, and categories switched off by default.
4. Make anything optional wait until the visitor allows it.
5. Keep a record of every choice.
6. Publish a cookie policy that lists what you use and why, and link to it from the banner.
7. Give people a way to change their choice, such as a “Cookie settings” link or button.