Does your website need a cookie banner? A UK guide

Cookies are small pieces of information a website stores in a visitor's browser. They can keep someone signed in, remember a basket or help track visits. The UK rules also cover other ways of storing or accessing information on a device, including browser storage, tracking pixels and some device fingerprinting. A tool described as cookie-free is not automatically outside the rules.

Ask your web person for an inventory of the tools that run on every page, including anything added through a tag manager. A tag manager is a tool for loading other website scripts. Check what happens before a visitor makes a choice, not just the list in an old cookie policy.

• List analytics, advertising tags, booking widgets, maps, videos, live chat, security tools and social media embeds.
• For each tool, record what it stores or reads, its purpose, how long it lasts and which supplier receives information.
• Check the homepage, contact form, booking flow and checkout. Different pages may load different tools.
• Compare the actual behaviour with the supplier's current documentation. A scanner is a useful starting point, not proof that the whole site complies.

PECR means the Privacy and Electronic Communications Regulations. Regulation 6 and Schedule A1 set the UK storage and access rules. The ICO says that, unless an exception applies, you need clear information about the purpose and consent before storing or accessing information on the device. This applies even when the information does not identify a person.

The strictly necessary exception is about providing an online service the visitor has requested. The ICO says the technology must be essential to that service on a technical level. Judge this from the visitor's viewpoint. A tool being useful to your business, included by your website builder or described by a supplier as essential does not settle the question.

A basket cookie, a login session or a cookie used solely to remember a visitor's cookie choices may qualify. The ICO also recognises a separate exception for technology used solely to transmit a communication over a network. Advertising does not qualify as strictly necessary. If a cookie also tracks people for another purpose, do not assume its necessary function exempts everything it does.

A fictional shop uses a cookie to keep the products a visitor has chosen in their basket. That may fit the strictly necessary exception. Recording the same visitor's browsing so an advertising platform can show them adverts later is a separate purpose that needs its own assessment.

As at 13 October 2026, these are not merely proposed changes. Section 112 and Schedule 12 of the Data (Use and Access) Act 2025 took effect on 5 February 2026. Regulation 2 of the commencement regulations, SI 2026/82, confirms that date. They amended PECR and added Schedule A1. Royal Assent in June 2025 was not the date these cookie changes started applying.

The ICO finalised its updated storage and access guidance on 29 April 2026. That is the guidance publication date, not the legal commencement date. The changes add limited exceptions, not a general permission to run tracking without consent.

• Statistical purposes. Certain analytics used solely to understand and improve your own online service may run without prior consent if all the conditions are met. The next section explains them.
• Appearance and functionality. Certain uses solely to adapt or improve how the website looks or works on the device may qualify. Examples in ICO guidance include remembering a language preference. Clear information and a simple, free way to object are still required. This is not an exemption for personalised adverts or content based on inferred interests.
• Emergency assistance. A narrow exception covers locating a device to provide emergency help after an indication that someone needs assistance. It is not a general exemption for a business wanting to know a visitor's location.

Schedule A1's statistical exception concerns how your service is used, with a view to improving it. The ICO distinguishes this from tracking who uses it. Counts of page visits or loading performance may qualify. Advertising measurement, individual profiling and ordinary session recordings do not qualify under this exception.

Check the configured tool, its contract and every enabled integration. The same product can be used in different ways. Removing a banner because the supplier describes its analytics as anonymous is not enough. The ICO's conditions include the following points.

• Your service must fall within the online services covered by the exception. Check the legal scope if your setup is unusual.
• The sole purpose of the storage or access must be collecting statistics about your service or website to improve it. Do not combine it with advertising or tracking individual visitors.
• Aggregate the information into statistics that do not identify people. The ICO says to retain any personal data only as long as necessary for that aggregation, not keep individual-level records afterwards. There is no universal aggregation deadline in the rules.
• Share information only to help improve your service. Under ICO guidance, an analytics supplier must act on your behalf as a processor, not use the data for its own purposes or combine it with other information. Tell visitors about the supplier and its role.
• Give clear information about the purpose and a simple, free way to object. Honour an objection by stopping that use. A visible analytics settings control can do this; relying only on browser settings cannot.
• Do not apply this exception to collecting or monitoring information automatically emitted by a device, such as Wi-Fi probe requests. The legislation excludes that activity from this exception.

Where no exception applies, the ICO expects a positive choice before the technology runs. A banner that appears after advertising tags have loaded does not meet that timing. Continuing to browse, ignoring the message or leaving a pre-ticked box unchanged is not valid consent.

A consent tool can help, but installing one does not prove that it controls your website's scripts. Give your web person this practical checklist, based on the ICO's consent guidance.

• Block technologies that need consent until the visitor agrees to the relevant purpose.
• Make refusal as easy as acceptance. The ICO gives equally prominent accept-all and reject-all buttons as good practice, rather than hiding refusal inside extra settings.
• Explain the purposes in everyday language and let visitors make separate choices for different purposes. Keep consent-required options off until selected.
• Keep a clearly labelled way to revisit settings and withdraw consent as easily as it was given. Check that withdrawal stops the relevant technologies.
• Keep the controls usable on a phone and with a keyboard. Do not cover the buttons with another pop-up.

If your site uses only technology covered by the strictly necessary or communication exceptions, those uses do not need a consent request. Explain the setup accurately rather than asking visitors to accept cookies they cannot refuse. Where you rely on the statistical or appearance exceptions, keep the required information and objection route easy to find.

The ICO's transparency guidance asks for the purposes, relevant third parties and duration of storage or access. Name suppliers clearly. A combined privacy and cookie notice can avoid duplication, provided visitors can find the relevant information and controls without searching through unrelated terms.

PECR and the UK GDPR are separate checks. If a tool handles personal data, you still need to assess the lawful basis, privacy information and other data protection duties. A PECR exception does not remove those obligations. Describing the processing as a legitimate interest does not replace consent where PECR requires it.

Ask your web person to test a fresh visit before any choice, rejection, acceptance of one purpose and later withdrawal. They should inspect browser storage and network requests, not just check that the banner disappears. Keep a record of the tools, classification, settings and test results.

Repeat the checks when someone adds a booking panel, video, advertising campaign or analytics integration. A decision about last year's website may not fit today's setup. Removing an unnecessary tracking tool can be simpler than adding another layer of consent controls.

This is general UK information, not a legal opinion on your website. Check the official sources against your own configuration. Overseas visitors, services used by children and unusual tracking can need a wider assessment. If an exception is unclear, ask a suitably qualified adviser before relying on it or removing existing consent controls.