Most UK business owners installed a cookie banner once, years ago, and have not looked at it since. 2026 is a good year to look again. The law changed earlier this year, the regulator has updated its guidance, and the maximum penalty is now in the same league as a UK GDPR fine. This guide covers what the rules say, what changed, and how to check your own banner in about twenty minutes.
What does UK law say about cookie consent banners?
PECR applies to cookies, but also to pixels, local storage, device fingerprinting and similar methods, which is why the ICO now talks about "storage and access technologies" rather than just cookies. Its guidance on the use of storage and access technologies is the document to read if you want the regulator's own wording.
Consent here has the UK GDPR meaning. It has to be freely given, specific, informed and an unambiguous positive action. Pre-ticked boxes, "by continuing to browse you accept" notices, and consent buried in terms and conditions do not count.
What changed for cookie banners in 2026?
The ICO's statement on commencement confirms the new fine ceiling, which brings PECR enforcement into line with UK GDPR. The ICO has since finalised its updated guidance, after consulting on how the new exceptions should work in practice.
For a typical small business site, the practical effect is modest. The new exceptions cover the boring, low-risk end of tracking. Everything that earns its keep in marketing terms, such as ad pixels and retargeting, still needs a yes first.
Which cookies no longer need consent?
The ICO's page on what the exceptions are gives concrete examples:
- Strictly necessary: shopping baskets, logins, security, fraud prevention and load balancing.
- Statistical purposes: counting visits and understanding how people use your pages, with the sole aim of improving the service.
- Appearance: remembering choices such as language, text size or dark mode.
The appearance exception has a sharp edge. The ICO says it does not cover changing the content you show someone based on their known or inferred interests. Personalised product recommendations are not "appearance".
Is Google Analytics exempt under the new rules?
This is where most owners will get it wrong. The headline "analytics cookies no longer need consent" is true for a narrow setup and false for the setup most small businesses actually run. If your analytics feeds audiences into ad campaigns, shares data with the provider for its own purposes, or tracks people across devices for marketing, keep it behind consent.
A sensible middle path for many sites is to run a lean, statistics-only analytics tool under the exception, with an easy opt-out, and keep marketing tags behind the consent banner.
What must a compliant cookie banner include?
In practice, a good banner has:
- A short first layer. One or two sentences, an Accept all button, a Reject all button of matching size and style, and a link to granular settings.
- Clear categories. Necessary (always on, not toggleable), statistics, preferences, and marketing. Keep the names plain.
- Honest defaults. Marketing toggles off by default. If a tool genuinely qualifies for the statistics exception, you do not need to ask first, but visitors must be able to switch it off easily.
- A way back. A footer link or small icon that reopens the settings on every page.
- A cookie policy. A page listing each tool, what it does and how long it lasts.
If your site also collects personal data through forms, chat or AI tools, the UK data protection checklist for AI tools covers the wider obligations that sit alongside cookie consent.
What are the most common cookie banner mistakes?
A quick self-audit in Chrome or Edge:
- Open your site in a private window. Do not click the banner.
- Open developer tools, go to the Application tab and look at Cookies. Then check the Network tab for requests to Facebook, Google Ads, TikTok or Hotjar.
- If marketing cookies or requests appear before you click anything, your banner is decorative.
- Click Reject all, reload, and check again. Nothing marketing-related should appear.
Other frequent problems include embedded YouTube videos and map widgets setting cookies on page load, and ecommerce plugins adding their own pixels outside the banner's control. If you run abandoned cart emails or other automated follow-ups, check whether the tracking behind them relies on cookies that need consent.
How much could a cookie breach cost a UK business?
The higher ceiling matters less for its size than for what it signals. Cookie compliance is no longer a minor technical footnote with small penalties attached. The ICO has consistently favoured writing to organisations and giving them time to fix issues, so the cheapest path is to fix the obvious problems now, before a complaint prompts a letter.
There is also a commercial cost to getting it wrong the other way. Banners that nag, block the page or bury the reject option annoy visitors and can hurt enquiry rates, so compliance and conversion usually point in the same direction.
Does a compliant banner hurt conversions and tracking?
The honest trade-off is attribution. When people reject marketing cookies, your ad platforms see fewer conversions, and reported return on ad spend looks worse even when real sales are unchanged. Plan for it. Compare ad spend against actual enquiries or orders in your own records, not just platform dashboards.
Keep the banner at the bottom of the screen on mobile, avoid full-screen overlays, and keep the text short. The page behind it, including trust signals such as customer reviews, should still be readable while the banner is open.
What should I do this week?
A short checklist:
- Run the private-window test above on your homepage, a product or service page, and your contact page.
- Remove tools you no longer use. Old pixels from past campaigns are common.
- Decide whether your analytics can honestly qualify for the statistics exception. If not, keep it behind consent.
- Record your decisions in a short note. If the ICO ever asks, a written rationale shows you took the rules seriously.
- Put a reminder in your diary to recheck whenever you add a new plugin, embed or ad platform.
Cookie Consent Banner — FAQ
Do I still need a cookie banner in the UK in 2026?
Most small business websites still need one. The Data (Use and Access) Act, whose main provisions came into force in early 2026, added new exceptions for things like first-party statistics and remembering display preferences. It did not remove the need for consent to advertising or marketing tracking. If your site loads a Meta Pixel, Google Ads conversion tag, TikTok pixel, retargeting script or embedded content that sets its own tracking cookies, you need prior consent before those fire. A banner is still the most practical way to collect that consent and to offer the simple way of objecting that the new exceptions require. A site with only strictly necessary cookies and a qualifying, first-party-controlled analytics setup may be able to use a much lighter notice. That is a smaller group of websites than most owners assume.
Is Google Analytics exempt from cookie consent now?
Not automatically. The ICO's guidance says the statistical purposes exception covers storage or access whose sole purpose is collecting statistical information to improve your service, and any third party involved may only use the data to help you. It also says online advertising purposes are never exempt. A Google Analytics setup linked to Google Ads, with advertising features or cross-device signals switched on, is serving advertising purposes as well as statistics, so it falls outside the exception and still needs consent. A stripped-back configuration used purely for site statistics may qualify, but you must still give visitors a simple, free way to object, and you should document why you think it qualifies. If in doubt, keep it behind consent.
How big are the fines for cookie breaches in the UK?
The ICO states that the Data (Use and Access) Act lets it issue fines of up to £17.5 million or 4% of global annual turnover under PECR, which is the regulation covering cookies and similar technologies. That brings PECR penalties into line with UK GDPR. In practice, the ICO has usually written to organisations and given them time to fix problems before escalating, and a local business is very unlikely to face the maximum. The bigger practical risks for a small firm are a complaint, a warning letter, being named in an ICO compliance review, or customers losing trust because your site obviously tracks them before they agree.
Does the reject button have to look the same as accept?
Yes, in substance. The ICO's updated guidance on storage and access technologies expects accept and reject options to be given equal prominence. That means a reject option on the first layer of the banner, not hidden behind a settings link, with similar size, colour weight and wording. A bright green Accept All next to a grey text link reading Manage preferences is the pattern the ICO has repeatedly criticised. You can still style the banner to match your brand. The test is simple: could a visitor refuse non-essential cookies with the same single click it takes to accept them?
Can I use a free cookie banner plugin?
You can, and many are fine, but a plugin is only as good as its setup. The common failure is that the banner appears correctly while tracking scripts are still hard-coded into the site header, so they fire before anyone clicks anything. Check three things after installing any tool. First, that non-essential scripts are blocked until consent, which you can confirm in your browser's developer tools. Second, that reject is on the first layer with equal prominence. Third, that visitors can change their mind later through a persistent link or icon. A free plugin that passes those checks is better than an expensive platform that does not.
