Does your website need a cookie banner?

Your website needs a cookie banner if it uses cookies or similar tools that aren't strictly necessary, such as advertising cookies, tracking pixels or analytics that follow individual visitors. Before those run, UK law asks you to tell visitors what they do and get their consent. If your website only uses cookies it can't work without, like a shopping basket or a login, you don't need a consent banner.

What a cookie banner is and what it does

Cookies are small files a website stores on a visitor's device. They let the website remember things such as a login or the items in a basket. Our guide explains what cookies are in more detail.

A cookie banner, or cookie consent banner, is the message that appears when someone visits your website and hasn't yet made a choice about cookies. It tells visitors which cookies the website uses and lets them accept or reject the optional ones. The consent rules cover more than cookies. Tracking pixels, web storage in the browser and other ways of storing or reading information on a device count too.

Is a cookie banner mandatory in the UK?

A cookie banner is mandatory in the UK only if your website uses cookies or similar technologies that need consent. The cookie rule comes from the Privacy and Electronic Communications Regulations (PECR), and consent has to meet the standard of the UK GDPR. Unless an exception applies, you must tell visitors which technologies you use, explain what they do and get their consent before you use them.

The Information Commissioner's Office (ICO) lists five exceptions in its guidance where you don't need consent. Three of them matter for a typical business website: strictly necessary cookies, cookies that remember how a visitor wants your website to look, and some analytics.

Cookies that need no consent

Strictly necessary cookies are the ones your website needs to provide a service the visitor asks for. The ICO judges this from the visitor's side, not yours. So advertising cookies never count, even if the ads pay for your website. Typical examples are:

• remembering the items a visitor puts in their shopping basket on the way to the checkout
• keeping a visitor logged in while they move from page to page
• security measures that data protection law requires for a service the visitor asked for
• remembering a visitor's cookie choices, so the banner doesn't ask again on every page, as long as you tell visitors clearly about this cookie

A cookie that remembers a display choice, such as the language a visitor picked, is likely to fall under a separate appearance exception. As with the analytics exception below, you still have to give visitors clear information about it and a simple way to object.

Analytics cookies and the statistical purposes exception

Since the Data (Use and Access) Act changed PECR, some analytics can run without consent in the UK, but only under strict conditions. The ICO calls this the statistical purposes exception, and it applies when:

• the only purpose is to collect statistics on how people use your website, so you can improve it
• you give visitors clear information about it and a simple, free way to object
• nobody is tracked, profiled or identified as an individual
• nothing is used for advertising, such as measuring whether someone clicked an ad
• an analytics provider only uses the information to help you improve your website

Counting page views, seeing how visitors found you and checking how fast your pages load are likely to be fine under the exception. The condition is that you look only at totals, not at individual visitors. Recordings of individual visits, sales data shared with ad partners and tracking across other sites are not. Whether your analytics tool qualifies depends on its settings and on what it shares. With a common tool such as Google Analytics, check whether it's linked to advertising features or shares data with an ad platform. If it is, the exception doesn't cover it and you need consent. If you can't tell, we recommend asking for consent for analytics too.

Cookies that always need consent

Unlike analytics under the statistical purposes exception, anything used for advertising or to track people needs consent before it runs. That includes:

• advertising and retargeting cookies, which show visitors ads based on the pages they've already seen
• tracking pixels from social media and advertising platforms
• tools that link a visitor's activity across different websites or devices
• cookies that ad networks set when you're showing ads on your website

What a cookie banner must include

A banner only counts as valid consent if it gives visitors a real choice and does what it says. Yours should:

• explain what your cookies and similar tools are for, and link to a cookie policy that names each one and how long it stays on the device
• name any third parties, such as an analytics or advertising provider, that store or receive information
• make rejecting as easy as accepting, for example with "Accept all" and "Reject all" buttons that stand out equally
• let visitors choose per purpose, such as analytics or advertising, instead of all or nothing
• keep every cookie that needs consent switched off by default, until the visitor turns it on. Cookies under the statistical purposes or appearance exception may start switched on.
• show visitors how to change their mind later, and make withdrawing consent as easy as giving it

If your ad tags, or analytics tags outside the statistical purposes exception, still load before anyone clicks "Accept", the banner is only decoration, and your website doesn't meet the rules. Tags are the bits of code that load these tools on your pages. A message that says "by continuing to use this site, you agree to cookies" doesn't count as consent either.

Check which cookies your website sets now, and again whenever you add a plugin or a new tool. A cookie scanner, such as the one in a consent tool, lists them for you. You can also open your website in a private browser window and leave the banner alone, though Chrome's private window blocks cookies from other sites by default, so some ad cookies may not show. Your browser's developer tools then show which cookies are already set before anyone has agreed.

Opt-in or opt-out: which one applies?

For cookies that need consent, UK law requires opt-in. Opt-in means a cookie stays off until the visitor takes a clear, positive action, such as clicking "Accept". Pre-ticked boxes and switches that are already on don't count.

Opt-out means a cookie runs until the visitor switches it off. That only works for cookies under the analytics and appearance exceptions. For those, the ICO accepts a switch that's on by default, as long as visitors can turn it off at any time. For advertising and tracking, opt-out isn't enough.

Do you need a cookie policy on your website?

Yes, if your website uses cookies that need consent or relies on the analytics or appearance exception. In both cases you have to give visitors clear information about the cookies you use, and a banner has little room for it. The details usually go in a cookie policy, a separate page that lists each cookie and what it does. It also says who sets each cookie and how long it lasts. Your banner then links to that page.

You can also put this information in your privacy policy. Some cookies need no consent, such as a login cookie. If one of them involves personal data, you still have to explain it there.

What happens if you get it wrong?

If you get the cookie rules wrong in the UK, the ICO can take formal action against you. Its aim is to get organisations to comply, and its current policy reserves fines for serious breaches. The Data (Use and Access) Act is changing the way the ICO enforces PECR to match the UK GDPR. The ICO says it will update its guidance once the new rules are in force.

If your business is in the EU or targets customers there, the EU's GDPR applies as well, with its own fines and penalties. Under Article 83 of the GDPR, the highest fines reach €20 million or 4% of a company's worldwide annual turnover, whichever is higher.

Beyond any fine, collecting visitors' data without a proper consent banner can cost you their trust.

Choosing how to add a cookie banner

You can add a banner with a website builder that has one built in, with a consent tool, or by building your own. Which one fits depends on how your website is built and how many tools on it set cookies.

Our advice: for a new small business website, choose a builder with a built-in banner, so there's nothing extra to set up. If your website is already built or uses several marketing tools, choose a consent tool that scans for cookies, because it finds what each tool sets. Build your own only if you have a developer who will keep it up to date.

Use a website builder with a built-in banner

If you build your website with our Aida AI Website Builder, a consent banner is included from the start. You don't need a separate plugin or a third-party consent tool.

Add a consent tool such as Termly

A consent tool, also called a consent management platform, shows the banner and keeps a record of what each visitor chose. Termly is one of them, and it works with any website. It scans your website for cookies and generates your cookie banner, cookie policy and privacy policy. If your website is with us, you add Termly through the control panel. With another host, you install it yourself.

On WordPress, you connect Termly to your website with a free plugin. The plugin itself costs nothing, but the banner needs a Termly subscription:

1. Make sure you have a Termly subscription for your website.
2. Install the Termly plugin from your WordPress dashboard and activate it.
3. Copy your API key from the Termly dashboard.
4. Paste the key into the plugin to connect it to your Termly account.
5. Run a cookie scan, then switch the consent banner on. New visitors now see it.

Termly keeps your cookie banner, cookie policy and privacy policy up to date as your website changes.

Build your own banner

You can also build a consent banner yourself with HTML, CSS and JavaScript. Then it's up to you to make sure it sets no optional cookies before visitors consent. It also has to keep a record of their choices and let visitors withdraw consent as easily as they gave it. Each time you add a plugin, an ad or an analytics tool to your website, check what it stores and update the banner if its information or choices for visitors no longer fit.

Whichever way you choose, start with a list of the cookies your website sets, then make sure your banner asks before the optional ones run. If you want one tool that does both, add Termly to your website.