Cookies, Consent, and Compliance: What UK Websites Need to Get Right

Quick answer: Most UK websites need a cookie banner because non-essential cookies (analytics, marketing pixels, embedded video) are covered by PECR, the UK's cookie-specific law, not just UK GDPR. You need clear information about what each cookie does, and you need a genuine "reject" option that's just as easy to click as "accept". If your banner only offers "Accept All" with rejection buried two clicks deep, it isn't compliant, no matter how nice it looks.

Why Most Cookie Banners Aren't Actually Compliant

Here's an uncomfortable fact: a huge number of the cookie banners you click through every day are breaking the law. Not because the businesses behind them are trying to get away with something, but because "add a cookie banner" got treated as a box-ticking job for whoever built the website, rather than a compliance decision.

The most common problem is the one-click trap: a bright, easy "Accept All" button, and rejecting cookies buried under "Manage Preferences," then another menu, then a toggle for each vendor. That's not a technicality. The ICO has been explicit that making rejection harder than acceptance is itself a compliance failure.

The second most common problem is even simpler: cookies get set before the visitor has made any choice at all. Analytics starts tracking, the marketing pixel fires, and the banner is really just decorative at that point.

What Cookies Are, and Why They Trigger UK GDPR and PECR

A cookie is a small file a website stores on a visitor's device. Some are genuinely necessary, like the one that remembers what's in a shopping basket. Others exist purely to track behaviour: which pages someone visited, what they clicked, which ads they saw elsewhere on the internet before landing on your site.

Non-essential cookies usually process personal data (an identifier tied to a specific device or browsing pattern counts), which brings UK GDPR into play. But the specific rule that "you must get consent before setting most cookies" doesn't actually come from GDPR. It comes from the Privacy and Electronic Communications Regulations, known as PECR, which sits alongside UK GDPR and governs electronic communications and tracking technologies specifically.

UK GDPR vs PECR: Which Law Applies to Your Cookies

Think of it this way: PECR decides whether you're allowed to set the cookie in the first place, and UK GDPR governs what happens to any personal data that cookie then processes. For most non-essential cookies, you need both PECR consent and a lawful basis under UK GDPR, and in practice that lawful basis is nearly always consent too, covered under Article 6 of UK GDPR.

Strictly necessary cookies (the ones needed to deliver a service the visitor actually asked for, like remembering login state during a session) are exempt from the PECR consent requirement. Everything else, analytics included, generally isn't.

For full detail on how the two regimes interact, the ICO's guidance hub is the primary reference point, and it's worth bookmarking rather than relying on secondhand summaries (including this one).

What Valid Consent Actually Looks Like Under UK Law

Consent under UK GDPR has four requirements, and cookie banners have to satisfy all of them or the consent isn't valid. It needs to be freely given, meaning no one's blocked from using the site if they say no. It needs to be specific, meaning "yes to everything" isn't good enough if there are genuinely different categories of cookie doing different jobs. It needs to be informed, meaning visitors can actually find out what each cookie does before deciding. And it needs to be unambiguous, meaning a pre-ticked box or a banner that assumes consent if someone scrolls past doesn't count.

That last point catches people out constantly. Scrolling isn't consent. Continuing to browse isn't consent. Only a clear, affirmative action, an actual click on "accept", counts.

How to Categorise Your Cookies Properly

Before you can build a compliant banner, you need an honest inventory of what's actually running on your site. Most businesses are surprised by what they find once they check properly. It usually breaks down into four buckets.

• Strictly necessary, cookies needed to deliver something the visitor asked for, like session tokens or a shopping cart. No consent required, but you still have to tell people about them.
• Functional, cookies that remember preferences like language or region, nice to have but not essential. Consent required.
• Analytics, cookies that track how visitors use the site, including most Google Analytics set-ups. Consent required.
• Marketing/advertising, cookies used for targeted ads and cross-site tracking, including the Meta Pixel and most ad platform tags. Consent required, and this is usually where the most cookies live.

A proper audit means checking your actual site, not just your assumptions about it. It's genuinely common to find tracking scripts that a marketing agency added two years ago and nobody remembers.

What a Compliant Cookie Banner Actually Looks Like

A compliant banner has a few non-negotiable features. "Accept All" and "Reject All" need to be equally prominent, same size, same visual weight, one click each. There needs to be a genuine way to choose category-by-category, not just an all-or-nothing toggle dressed up as choice. Non-essential cookies shouldn't fire until a choice has been made. And visitors need an easy way to change their mind later, not just on their first visit.

It also needs to actually explain what it's asking for in plain English, not "we use cookies to enhance your experience," which tells the reader nothing. Say what the cookies do and who gets the data.

Google Analytics, Meta Pixel, and Other Common Culprits

Two tools show up in almost every audit Trust Keith runs, and both need proper consent handling. Google Analytics sets cookies that track individual visitor behaviour across sessions, which makes it a consent-required analytics cookie in almost every configuration businesses actually use. The Meta Pixel is arguably the bigger risk: it's built specifically to track visitors across sites for ad targeting, and it typically fires the moment a page loads, well before any consent decision, unless it's been properly gated behind your consent tool.

The fix isn't complicated in principle: these scripts should only load after consent is given, and your consent management platform needs to actually block them beforehand, not just record a preference while the scripts run regardless. It's the gap between "we have a cookie banner" and "our cookie banner actually does anything," and it's where most real-world compliance failures live.

What the ICO Is Actually Doing About Cookie Compliance

Cookie compliance isn't a theoretical risk. The ICO has run active enforcement sweeps against websites with non-compliant banners, and its enforcement action listing shows it's willing to act, not just issue guidance and hope. Fines under UK GDPR can reach the levels set out in Article 83, though for most scale-ups the bigger practical risk is reputational: a cookie banner is one of the few compliance failures a customer, journalist, or competitor can spot in about four seconds, with no technical knowledge required.

That visibility is exactly why cookie compliance tends to be the thing that trips a wider conversation. Get asked about it in due diligence once, and it's usually a sign someone's about to look a lot harder at everything else too. 

Frequently Asked Questions

Do I legally need a cookie banner on my UK website?

If your site uses anything beyond strictly necessary cookies (which covers most sites using analytics, marketing pixels, or embedded third-party content), then yes, PECR requires you to get consent first, and a banner is the standard way of doing that.

Is Google Analytics GDPR compliant by default?

Not automatically. Google Analytics can be used compliantly, but only if it's properly disclosed, only fires after consent, and your configuration doesn't send more data than you've told visitors about.

What happens if my cookie banner isn't compliant?

In practice, most businesses get a warning or a request to fix it rather than an immediate fine, but persistent non-compliance can lead to formal enforcement action, and it's a visible red flag during investor or customer due diligence.

Can I just use "Accept All" with no reject option?

No. The ICO has been clear that if accepting is one click and rejecting takes several, that imbalance itself makes the consent invalid.

How often should we review our cookie set-up?

At least annually, and any time you add a new marketing tool, analytics platform, or embedded widget, since each of those can quietly add new cookies without anyone updating the banner.

Cookie compliance is a genuinely good place to start if you're not sure where your wider data protection actually stands, because it's fast to check and it tends to reveal exactly how much (or how little) attention the rest of your compliance has had.

If you want the fuller picture, our guide to what UK GDPR actually requires is a good starting point, and our piece on building privacy into your product from the start covers a lot of the same "get it right once, not repeatedly" thinking that applies to cookies too.

If you're auditing more than just cookies, our GDPR compliance checklist for UK scale-ups is worth working through, and if you want to understand what's actually at stake beyond the fine itself, we've written about the hidden costs of getting data protection wrong.

And if cookie compliance has come up because someone's asking harder questions, our guide on preparing for an ICO investigation covers what that process actually looks like.

If any of this still feels uncertain, or you'd like someone who's actually done this before to take a proper look at your site, you're welcome to book some time with our team. We're happy to see how we can help.