Cookie banners: what UK law asks of a small website (2026)
When you need consent for cookies, when you don't, and what changed with the Data (Use and Access) Act 2025, from the ICO and GOV.UK.
The short answer
Under the Privacy and Electronic Communications Regulations (PECR), you must tell people which cookies your website uses and why, and get their consent before setting any that aren't exempt. Cookies that are strictly necessary for something the visitor asked for, like a shopping basket or a secure log-in, don't need consent. The Data (Use and Access) Act 2025 added new exceptions to PECR, including cookies used to collect statistics about how your site is used so you can improve it. Everything else, such as advertising and most third-party tracking, still needs clear, opt-in consent.
The basic rule
From the ICO's guidance on PECR.
- Tell people the cookies are there.
- Explain what they do and why.
- Get their consent before you store a cookie on their device, unless an exception applies.
- Make the information clear and easy to find.
Cookies that don't need consent
- Strictly necessary cookies: essential to provide something the visitor asked for, such as a basket or checkout, the security of a log-in, or load balancing. Helpful or convenient isn't enough.
- Statistics: the Data (Use and Access) Act 2025 added an exception for collecting statistical information about how your online service is used, with the aim of improving it.
- The ICO says the Act lets you set some other low-intrusion cookies without consent too, such as some that improve how your website works. Its cookie guidance is being revised, so check the current version before relying on an exception.
What valid consent looks like
- Freely given, specific and informed.
- An unambiguous positive action, like pressing 'Accept'. Carrying on browsing isn't consent.
- No non-essential cookies set before the visitor has chosen, including on the home page.
- An easy way to turn non-essential cookies on and off later.
The simplest option for a small site
If your website only needs to count visits, you can often avoid the question altogether: some analytics tools don't use cookies at all. Our own site uses privacy-friendly analytics that don't use cookies or collect personal data, so it has no cookie banner.
If you add a booking system, a shop or embedded videos, check which cookies each one sets. Third-party tools often set their own.
Sources and related
Sources, checked 20 October 2026: ICO: Cookies and similar technologies (guide to PECR); GOV.UK: Data (Use and Access) Act factsheet, PEC Regulations; ICO: The Data (Use and Access) Act 2025, what does it mean for organisations?. Rules change, so check the source before you rely on it.
Quick answers
Do I need a cookie banner on my website?
Only if you set cookies that need consent. Strictly necessary cookies and, since the Data (Use and Access) Act 2025, some statistics cookies are exceptions. Advertising and most third-party tracking cookies still need consent.
Are analytics cookies allowed without consent now?
The Data (Use and Access) Act 2025 added an exception for collecting statistics about how your online service is used, with the aim of improving it. The ICO is revising its cookie guidance, so check its current guidance for the exact conditions.
Does carrying on browsing count as consent?
No. The ICO says consent needs a clear positive action, and continuing to use a website isn't one.
Can I set cookies before someone accepts?
Only exempt ones. Non-essential cookies mustn't be set until the visitor has given consent.