A UK business website needs a cookie banner only if it sets cookies that are not strictly necessary, such as advertising pixels, most third-party analytics or embedded maps and videos, because regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR) requires consent before they load. Separately, UK GDPR requires a privacy notice whenever you collect personal details, which includes a simple contact form. Since 5 February 2026, the Data (Use and Access) Act 2025 also lets some first-party analytics run without consent, provided visitors are told and can object easily.
Two different laws, two different pages
Owners often mix these up, so separate them first. PECR is about storing or reading anything on a visitor’s device: cookies, pixels, local storage, fingerprinting. It decides whether you need a banner. UK GDPR and the Data Protection Act 2018 are about personal information: names, phone numbers, emails, booking details. They decide what your privacy page must say.
A one-page site with no tracking and no form may need neither a banner nor much of a privacy page. Add a contact form and you need a privacy notice. Add an advertising pixel and you need a banner too. Most small sites end up needing both, but for different reasons, and the Information Commissioner’s Office (ICO) regulates both.
Which cookies need consent and which do not?
The ICO’s guidance on cookies and similar technologies says consent must come from a clear positive action, and that simply carrying on using the site is not consent. Its examples of cookies exempt as strictly necessary are narrow: remembering what is in a shopping basket, security for a service the visitor asked for (such as a login), and load balancing so pages stay fast. Anything that is merely helpful, or that mainly serves your own purposes, still needs consent unless a newer exemption applies.
| What is on the site | Consent before it loads? | Notes |
|---|---|---|
| Shopping basket or checkout session | No | Strictly necessary for the service the visitor asked for |
| Login and security cookies | No | Exempt when they protect a service the visitor requested |
| Remembering the visitor’s cookie choice | Generally no | Needed to respect the choice they made |
| First-party analytics used only to improve the site | Possibly not, since 5 Feb 2026 | Only with clear information and a simple, free way to object; advertising use excluded |
| Third-party analytics that shares data for other purposes | Yes, in most set-ups | The new exemption is narrow; check the tool’s settings |
| Social media or ad network pixels | Yes | Advertising and tracking are outside every exemption |
| Embedded maps, videos and chat widgets | Often yes | Many set cookies; load them only after consent or on click |
What changed for analytics in 2026?
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Its section 112 amended PECR to add new exceptions, and legal commentary reports that this part came into force on 5 February 2026. The headline change for small businesses: storage or access whose only purpose is collecting statistics about how your site is used, so you can improve it, can be exempt from consent.
The conditions matter more than the headline. Visitors must get clear information about it and a simple, free way to object. Advertising and profiling are excluded. Commentators disagree on how far third-party analytics tools fit, and the ICO says it is still finalising updated guidance on storage and access technologies. The safe reading for a small business: privacy-friendly, first-party statistics with a visible opt-out can likely skip the banner; a big ad-linked analytics suite almost certainly cannot.
The same Act raised the maximum PECR fine from £500,000 to UK GDPR levels: £17.5 million or 4% of global annual turnover, whichever is higher. That is a maximum for the most serious cases, not a typical figure for a small business. It is still a sign that cookie rules are no longer treated as a minor matter.
💡 The cheapest cookie banner is the one you do not need. Every tracking script you leave off the site is one less thing to ask permission for, and the site usually loads faster too.
What does a compliant cookie banner do?
PECR does not dictate a design, but the ICO’s requirements add up to a clear checklist. Use it to test your current banner, or any banner a provider offers you:
- 1Nothing non-essential loads before the visitor chooses. That includes the homepage: the ICO says non-essential cookies must not be set there before consent.
- 2The visitor takes a positive action to accept. No pre-ticked boxes, and no treating scrolling or clicking around as a yes.
- 3Rejecting is as easy as accepting. A clear option to refuse, on the first layer, not hidden behind a settings maze.
- 4Each purpose is named in plain English: statistics, advertising, embedded videos. Not a wall of cookie names.
- 5The visitor can change their mind later, from a link that stays available on every page.
- 6The banner links to a cookie section or page listing what is set, by whom and for how long.
A common fault on small sites is a banner that looks correct but does nothing: the tracking scripts load anyway, before or regardless of the click. Test it yourself. Open your site in a private browser window, do not touch the banner, and use the browser’s developer tools (Application, then Cookies) to see what has already been set. If ad or analytics cookies are there before you chose, the banner is decoration.
What must a UK privacy policy include?
The ICO calls this “the right to be informed”. When you collect details directly from people, through a form, a booking system or an order, your privacy notice must tell them, in plain language:
- 1Who you are: the business name and contact details, plus your data protection officer’s details if you have appointed one.
- 2Why you use their details and your lawful basis for each purpose, for example contract (to fulfil a booking) or legitimate interests (to answer an enquiry).
- 3Which legitimate interests you rely on, if that is one of your bases.
- 4Who receives the data: your email provider, booking system, payment provider or accountant, by category.
- 5Whether any data goes outside the UK, and the safeguard that covers it.
- 6How long you keep it, or how you decide.
- 7Their rights: access, correction, erasure, restriction, objection and portability, with the right to object stated clearly and separately.
- 8That they can withdraw consent at any time, where consent is your basis, and that withdrawing is as easy as giving it.
- 9Their right to complain to the ICO, with the ICO’s contact details.
Two items on that list trip up template policies most often. First, recipients: a template rarely names the actual services your site uses, so it describes a site that does not exist. Second, retention: “we keep data as long as necessary” is not a period. Write something real, such as “enquiries that do not become work are deleted after 12 months”.
The ICO notes that this guidance is under review following the Data (Use and Access) Act, so expect wording changes. The core list above comes from Article 13 of UK GDPR and is not going away.
Do I need to pay the ICO data protection fee?
Probably. The ICO says organisations, including sole traders, that use personal information must pay a data protection fee unless they are exempt, under the Data Protection (Charges and Information) Regulations 2018. For micro organisations (Tier 1: turnover under £632,000 or no more than 10 staff) the fee rose from £40 to £52 in February 2025, with £5 off for direct debit. The ICO’s fee self-assessment tells you whether an exemption fits. Paying the fee is separate from your website; it does not make the site compliant on its own.
Worked example: a two-van dog grooming business in Bristol
Picture a mobile dog groomer with a five-page site: home, services and prices, areas covered, about, and a booking request form. The owner wants to know which pages are busy and runs a small social media advert now and then. Here is how the rules apply.
- 1Booking form: collects name, phone, address and the dog’s details, so a privacy notice is required. Lawful basis is contract (taking the booking). Recipients are the email provider and the diary app.
- 2Visitor statistics: a first-party analytics tool used only to see which pages people read can likely rely on the 2026 exemption, with a short note in the cookie section and an opt-out link.
- 3Social media advert pixel: advertising tracking, so it needs consent through the banner. It must not fire until the visitor accepts.
- 4Google map of the service area: an embedded map can set cookies, so show a static image of the area with a “view on map” link, or load the map only after consent.
- 5Result: a banner is needed only because of the advert pixel. Drop the pixel and the site can run without one.
What else should every UK business site show?
Separate from privacy law, companies and LLPs must show their registered name, registered number, place of registration and registered office address on their website under the Companies Act 2006 and the 2015 trading disclosure regulations, as Trading Standards’ Business Companion explains. A footer line is the usual place. Sole traders have no registration number to show, but a real address and a working email build trust and are what your privacy notice should point to anyway.
For the full list of pages a small business site benefits from, see our guide below. For the legal side, the minimum set is a privacy notice, a cookie section (or page) if you set any cookies, and company details in the footer if you are incorporated.
Should I write these pages myself or use a generator?
You can write them yourself from the ICO’s guidance in an afternoon. Free generators help, but they cannot see that your booking plugin sends data to another company; the work is keeping the policy matched to what the site really does.
Adyft Sites includes these pages. The Privacy and Contact pages are free on every plan, and we write the privacy page for you to match the forms and services the site uses. When you add a new tool later, you can ask by WhatsApp for the privacy page to be updated with it. We include the page; if your data handling is anything beyond simple enquiries, check the wording with your adviser. The Starter plan in the UK is £999 plus £49 a month and goes live in under 7 days.
Where we are not the right fit: a business processing health records, children’s data or large customer databases needs advice from a data protection specialist, not just well-written website pages. We will build the site; the legal assessment of your wider data handling is a job for an adviser.
Questions about cookie banners and privacy pages in the UK
Does every UK website need a cookie banner?
No. PECR only requires consent for cookies and similar technologies that are not strictly necessary. A site that sets only essential cookies, and from February 2026 possibly only exempt first-party analytics with an opt-out, may not need a banner at all. It still needs to tell visitors what it sets.
Do analytics cookies need consent in the UK in 2026?
Not always. The Data (Use and Access) Act 2025 added an exemption for statistics collected only to improve your site, provided visitors are clearly told and can object simply and for free. Analytics used for advertising, or shared with others for their own purposes, still needs consent.
Is a contact form enough to need a privacy policy?
Yes. A contact form collects personal data such as a name and email, so UK GDPR requires you to tell people who you are, why you use it, your lawful basis, who receives it, how long you keep it and their rights, including the right to complain to the ICO.
Must the cookie banner have a reject button?
The ICO requires consent to be freely given and says users must be able to control non-essential cookies easily. In practice, refusing should be as easy as accepting, on the first screen. A banner with only an accept button makes it hard to show consent was freely given.
What is the maximum fine for breaking the UK cookie rules?
The Data (Use and Access) Act 2025 raised the PECR maximum from £500,000 to £17.5 million or 4% of global turnover, whichever is higher. That is a maximum, not a typical figure, and the ICO is still finalising updated guidance on storage and access technologies.
Do sole traders have to pay the ICO fee?
The ICO says organisations including sole traders that use personal information must pay unless exempt. The micro organisation fee is £52 a year, or £47 by direct debit. The ICO’s online self-assessment tells you whether you are exempt.
Sources: ICO, cookies and similar technologies — https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/ · ICO, what privacy information should we provide — https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/ · ICO, data protection fee — https://ico.org.uk/for-organisations/data-protection-fee/ · Lewis Silkin, ICO fee increase 2025 — https://www.lewissilkin.com/insights/2025/02/06/fee-payable-to-the-ico-to-increase-in-february-102jzb9 · Mayer Brown, Data (Use and Access) Act and PECR — https://www.mayerbrown.com/en/insights/publications/2025/06/the-data-use-and-access-act-pecr-reform-rules-relating-to-electronic-marketing-and-cookies-in-the-uk · Bratby Law, DUAA commencement — https://bratby.law/data-use-and-access-act-2025-commencement/ · Business Companion (Trading Standards), company names and disclosures — https://www.businesscompanion.info/en/quick-guides/miscellaneous/company-and-business-names
A website with the Privacy page written for you
We write every page, including Privacy and Contact, to match what your site uses. Starter is £999 plus £49 a month, live in under 7 days.