Cookie banners are the most visible piece of privacy law on the internet, and the most misunderstood. Some sites have no banner at all while running a dozen tracking tools. Others show a banner that sets every cookie before the visitor has clicked anything. Both are problems.
The rules changed in 2026, which makes this a good moment to check. This guide explains the UK cookie banner rules as they stand in September 2026, what the Data (Use and Access) Act 2025 changed, and what a sensible, compliant setup looks like for a small business website. It is general information rather than legal advice; the ICO’s cookie guidance is the authoritative source and was being updated through 2026.
Which law covers cookies
Cookies are covered by regulation 6 of the Privacy and Electronic Communications Regulations 2003, usually called PECR, which sits alongside UK GDPR. The rule applies to any technology that stores information on, or reads information from, a visitor’s device. That includes cookies, but also tracking pixels, local storage and device fingerprinting. So a site with “no cookies” but a Facebook pixel is still covered.
The basic rule is that you must give clear and comprehensive information about what you store and why, and get consent unless an exception applies. Consent here means the UK GDPR standard: freely given, specific, informed and a clear positive action. Pre-ticked boxes, or treating “carried on scrolling” as consent, do not count.
What changed in February 2026
Section 112 and Schedule 12 of the Data (Use and Access) Act 2025 added new exceptions to the consent requirement. They came into force on 5 February 2026. Alongside the long-standing exceptions for strictly necessary storage and for transmitting communications, the new list includes:
- Statistical purposes: collecting information about how your website is used so you can improve it, provided the data is used only for that purpose, you give clear information and the user has a simple, free way to object.
- Appearance and functionality: remembering choices such as language, text size or display preferences that the user has made.
- Security and fraud prevention, and some technical and emergency-location purposes that rarely matter for small business sites.
What still needs consent
Anything used for advertising, retargeting, building profiles of people across sites or sharing data with third parties for their own purposes still needs consent before it is set. In practice that includes most social media pixels, advertising tags, and many third-party embeds that track visitors.
Third-party analytics tools sit in the grey area. Where a provider uses the data for its own purposes, or the tool is set up to share data for advertising, it is unlikely to fit a narrow statistical exception. Some privacy-focused analytics tools are designed to fit it. Until the ICO’s updated guidance settles the detail for specific tools, asking for consent for third-party analytics remains the cautious option.
| Type of cookie or tracker | Example | Consent needed? |
|---|---|---|
| Strictly necessary | Shopping basket, login session, load balancing | No, but explain them |
| Security | Fraud prevention, bot detection on forms | Generally no, but explain them |
| Preferences the user chose | Remembering language or text size | Often no under the 2026 exception, with clear information |
| First-party statistics used only to improve your site | Privacy-focused visitor counts | Can be exempt if the conditions are met, including a free, simple way to object |
| Third-party analytics sharing data with the provider | Many standard analytics setups | Treat as needing consent unless you have checked it fits the exception |
| Advertising and retargeting | Social media pixels, ad network tags | Yes |
| Embedded content that tracks | Some video and map embeds | Yes, unless loaded in a privacy-enhanced mode that sets nothing until clicked |
What a compliant cookie banner looks like
- It appears before any non-exempt cookies are set, not after.
- It offers “Accept” and “Reject” with equal prominence on the first layer. Hiding reject behind “Manage settings” is exactly what the ICO has challenged.
- It explains briefly what each category is for, with a link to a fuller cookie policy.
- Categories are off by default. No pre-ticked boxes.
- Choices are respected: rejecting really stops the tags from firing.
- People can change their mind easily later, usually through a link in the footer.
- Where you rely on the statistics exception, the information and the opt-out are easy to find.
Do you need a cookie banner at all?
If your website only uses strictly necessary cookies, and perhaps statistics that genuinely fit the new exception, you may not need a consent banner. You still need clear information about what is stored and, for statistics, a simple way to object. That can be a cookie notice in the footer and a short page, rather than a pop-up.
This is the cleanest setup for many small businesses. A brochure site for a joiner, a café or an accountant rarely needs advertising pixels. Choosing analytics carefully and avoiding tracking embeds can remove the banner entirely, which is better for visitors and for how the page looks on a phone.
Common mistakes
- A banner that is purely decorative: tags fire whether or not the visitor accepts.
- “By continuing to use this site you agree to cookies”. Continuing to browse is not consent.
- Accept is a big coloured button; reject is a small grey link two screens away.
- A cookie policy copied from another site listing tools you do not use and missing ones you do.
- Forgetting that a newly added booking widget, chat tool or video embed can bring its own cookies.
- Assuming the 2026 changes mean analytics can run with no information and no opt-out.
Penalties and enforcement
The ICO enforces PECR. It has written to operators of popular UK websites about non-compliant cookie banners and made clear that making “reject” as easy as “accept” is expected. The Data (Use and Access) Act 2025 also brings the maximum PECR penalties into line with UK GDPR levels. Small businesses are unlikely to be the ICO’s first target, but a non-compliant banner is also a trust signal visitors notice.
Cookie compliance checklist
At Nerdsharks we start from which trackers a business actually needs, because the fewer there are, the simpler the cookie setup. Whoever builds yours, ask them to show you what is set before and after you click reject.
- List every cookie and tracker your site actually sets, using your browser’s developer tools or a scanning tool.
- Decide for each whether it is exempt, fits the 2026 statistics or preferences exception, or needs consent.
- Remove anything you do not really use.
- If you need consent, use a banner with equal accept and reject options and nothing set before a choice.
- Publish a cookie policy that matches the list, with a way to change choices.
- Recheck whenever you add a new plug-in, widget, embed or tag.