# Cookie banner rules in the UK (2026): what small business websites need

> UK cookie rules for small business websites after the Data (Use and Access) Act 2025: when you need a banner, the new analytics exception and what a compliant one looks like.

- Source: https://nerdsharks.com/blog/cookie-banner-rules-uk
- Publisher: Nerdsharks (Exeter, Devon, UK)
- Updated: 2026-09-26

**Short answer:** Under PECR, a UK website must tell visitors about the cookies it uses and get consent before setting non-exempt ones, such as advertising and cross-site tracking cookies. Since 5 February 2026, cookies used only for statistics to improve your own site, and for remembering display preferences, can be exempt if you explain them clearly and offer a free, simple way to object.

Published 2026-09-26. 10 min read. Category: Website advice.

Cookie banners are the most visible piece of privacy law on the internet, and the most misunderstood. Some sites have no banner at all while running a dozen tracking tools. Others show a banner that sets every cookie before the visitor has clicked anything. Both are problems.

The rules changed in 2026, which makes this a good moment to check. This guide explains the UK cookie banner rules as they stand in September 2026, what the Data (Use and Access) Act 2025 changed, and what a sensible, compliant setup looks like for a small business website. It is general information rather than legal advice; the ICO’s cookie guidance is the authoritative source and was being updated through 2026.

## Which law covers cookies

Cookies are covered by regulation 6 of the Privacy and Electronic Communications Regulations 2003, usually called PECR, which sits alongside UK GDPR. The rule applies to any technology that stores information on, or reads information from, a visitor’s device. That includes cookies, but also tracking pixels, local storage and device fingerprinting. So a site with “no cookies” but a Facebook pixel is still covered.

The basic rule is that you must give clear and comprehensive information about what you store and why, and get consent unless an exception applies. Consent here means the UK GDPR standard: freely given, specific, informed and a clear positive action. Pre-ticked boxes, or treating “carried on scrolling” as consent, do not count.

## What changed in February 2026

Section 112 and Schedule 12 of the Data (Use and Access) Act 2025 added new exceptions to the consent requirement. They came into force on 5 February 2026. Alongside the long-standing exceptions for strictly necessary storage and for transmitting communications, the new list includes:

- Statistical purposes: collecting information about how your website is used so you can improve it, provided the data is used only for that purpose, you give clear information and the user has a simple, free way to object.
- Appearance and functionality: remembering choices such as language, text size or display preferences that the user has made.
- Security and fraud prevention, and some technical and emergency-location purposes that rarely matter for small business sites.

> The analytics exception is not a blanket “analytics no longer needs consent”. It covers statistics used to improve your own service, with an easy opt-out, and the detail of how each tool shares data matters.

## What still needs consent

Anything used for advertising, retargeting, building profiles of people across sites or sharing data with third parties for their own purposes still needs consent before it is set. In practice that includes most social media pixels, advertising tags, and many third-party embeds that track visitors.

Third-party analytics tools sit in the grey area. Where a provider uses the data for its own purposes, or the tool is set up to share data for advertising, it is unlikely to fit a narrow statistical exception. Some privacy-focused analytics tools are designed to fit it. Until the ICO’s updated guidance settles the detail for specific tools, asking for consent for third-party analytics remains the cautious option.

**Common website cookies and whether they need consent (UK, 2026)**

| Type of cookie or tracker | Example | Consent needed? |
|---|---|---|
| Strictly necessary | Shopping basket, login session, load balancing | No, but explain them |
| Security | Fraud prevention, bot detection on forms | Generally no, but explain them |
| Preferences the user chose | Remembering language or text size | Often no under the 2026 exception, with clear information |
| First-party statistics used only to improve your site | Privacy-focused visitor counts | Can be exempt if the conditions are met, including a free, simple way to object |
| Third-party analytics sharing data with the provider | Many standard analytics setups | Treat as needing consent unless you have checked it fits the exception |
| Advertising and retargeting | Social media pixels, ad network tags | Yes |
| Embedded content that tracks | Some video and map embeds | Yes, unless loaded in a privacy-enhanced mode that sets nothing until clicked |

## What a compliant cookie banner looks like

- It appears before any non-exempt cookies are set, not after.
- It offers “Accept” and “Reject” with equal prominence on the first layer. Hiding reject behind “Manage settings” is exactly what the ICO has challenged.
- It explains briefly what each category is for, with a link to a fuller cookie policy.
- Categories are off by default. No pre-ticked boxes.
- Choices are respected: rejecting really stops the tags from firing.
- People can change their mind easily later, usually through a link in the footer.
- Where you rely on the statistics exception, the information and the opt-out are easy to find.

## Do you need a cookie banner at all?

If your website only uses strictly necessary cookies, and perhaps statistics that genuinely fit the new exception, you may not need a consent banner. You still need clear information about what is stored and, for statistics, a simple way to object. That can be a cookie notice in the footer and a short page, rather than a pop-up.

This is the cleanest setup for many small businesses. A brochure site for a joiner, a café or an accountant rarely needs advertising pixels. Choosing analytics carefully and avoiding tracking embeds can remove the banner entirely, which is better for visitors and for how the page looks on a phone.

## Common mistakes

- A banner that is purely decorative: tags fire whether or not the visitor accepts.
- “By continuing to use this site you agree to cookies”. Continuing to browse is not consent.
- Accept is a big coloured button; reject is a small grey link two screens away.
- A cookie policy copied from another site listing tools you do not use and missing ones you do.
- Forgetting that a newly added booking widget, chat tool or video embed can bring its own cookies.
- Assuming the 2026 changes mean analytics can run with no information and no opt-out.

## Penalties and enforcement

The ICO enforces PECR. It has written to operators of popular UK websites about non-compliant cookie banners and made clear that making “reject” as easy as “accept” is expected. The Data (Use and Access) Act 2025 also brings the maximum PECR penalties into line with UK GDPR levels. Small businesses are unlikely to be the ICO’s first target, but a non-compliant banner is also a trust signal visitors notice.

## Cookie compliance checklist

At Nerdsharks we start from which trackers a business actually needs, because the fewer there are, the simpler the cookie setup. Whoever builds yours, ask them to show you what is set before and after you click reject.

- List every cookie and tracker your site actually sets, using your browser’s developer tools or a scanning tool.
- Decide for each whether it is exempt, fits the 2026 statistics or preferences exception, or needs consent.
- Remove anything you do not really use.
- If you need consent, use a banner with equal accept and reject options and nothing set before a choice.
- Publish a cookie policy that matches the list, with a way to change choices.
- Recheck whenever you add a new plug-in, widget, embed or tag.

## Questions

### Do I need a cookie banner on my website in the UK?

You need a cookie consent banner if your UK website sets cookies or similar trackers that are not exempt, such as advertising pixels or third-party tracking. If you only use strictly necessary cookies and statistics that fit the 2026 exception, you may need only clear information and an easy opt-out rather than a consent pop-up.

### Does Google Analytics need cookie consent in the UK?

Treat standard Google Analytics setups as needing consent unless you have confirmed your configuration fits the statistical purposes exception added by the Data (Use and Access) Act 2025. That exception is narrow: data used only to improve your own service, with clear information and a free, simple way to object. Check the ICO’s latest guidance.

### Does a cookie banner need a reject button?

Yes. The ICO expects rejecting non-essential cookies to be as easy as accepting them, which in practice means a reject option on the first layer of the banner with the same prominence as accept. Hiding reject behind extra clicks is one of the most common failures.

### What is the difference between PECR and GDPR for cookies?

PECR decides whether you need consent to store or read information on someone’s device, such as a cookie. UK GDPR then applies to any personal data collected, and sets the standard that consent must meet. Most websites have to consider both.

### What happens if my cookie banner is not compliant?

The ICO can take enforcement action for breaches of PECR, including fines, and the Data (Use and Access) Act 2025 raised the maximum PECR penalties to UK GDPR levels. In practice, the ICO usually starts with larger sites, but a poor banner also damages visitor trust.

## Sources

- Guidance on the use of storage and access technologies (cookies), Information Commissioner’s Office, 2026: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/
- Data (Use and Access) Act 2025, section 112 and Schedule 12, legislation.gov.uk, In force 5 February 2026: https://www.legislation.gov.uk/ukpga/2025/18/section/112
- Direct marketing and privacy and electronic communications, Information Commissioner’s Office, 2026: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/