Websites for UK businesses, explained
Do I Need a Cookie Banner on My Business Website?
7 November 2026
If your business website only uses cookies that are strictly necessary, you don't need to ask for consent, although you still need to explain them. If it uses advertising cookies, tracking pixels or most third-party tools, you need consent first, and a cookie banner is the usual way to get it. So do you need a cookie banner on your business website? It depends on what your site actually stores on people's devices.
Quick answer: Under PECR you must tell visitors about the cookies and similar technologies you use and get their consent unless an exception applies. Strictly necessary cookies are exempt. Some analytics and appearance cookies are exempt if you explain them and offer a free, simple way to object. Advertising cookies always need consent.
Key Takeaways
The rules cover cookies and similar technologies, including tracking pixels, local storage and device fingerprinting.
Strictly necessary storage, such as a shopping basket or a login, doesn't need consent.
Some analytics and appearance cookies are exempt, but only if you explain them and give a free, simple way to object.
Advertising cookies are never exempt and always need consent.
You can't set non-essential cookies before the visitor has agreed to them.
Which law applies
Cookies are covered by the Privacy and Electronic Communications Regulations, usually called PECR, which the Information Commissioner's Office (ICO) regulates. UK GDPR also applies whenever the cookies involve personal data.
The ICO's guidance doesn't just cover cookies. It covers "storage and access technologies" in general, which includes tracking pixels, local storage, scripts and tags, and device fingerprinting. If a tool on your site stores or reads information on a visitor's device, the same rules apply.
The basic rule: when your business website needs a cookie banner
You must tell people what you store on their device and why, in clear and comprehensive terms. Then you must get their consent, unless one of the exceptions applies.
Consent has to be freely given, specific and informed, and it has to involve a clear positive action. Carrying on browsing the website doesn't count. The ICO also says you can't set non-essential cookies on your homepage before the visitor has consented to them.
The exceptions
The ICO lists five exceptions to the consent rule. Three of them matter for most business websites.
Strictly necessary
Storage that's essential to give the visitor the service they've asked for doesn't need consent. Examples are remembering what's in a shopping basket and keeping a customer logged in. It has to be necessary from the visitor's point of view, not just useful to you, and advertising never counts.
Statistical purposes
The ICO lists an exception for storage used solely for statistical purposes, such as collecting statistics about how your site is used so you can improve it. This only applies if that's the sole purpose. You have to explain it clearly and give people a simple, free way to object, and you must stop if they do.
The data must be used to improve your site, not to track or profile individuals or to show adverts. If an analytics provider uses the data for its own purposes as well, this exception won't cover it.
Appearance and functionality
Storage that only adapts how your site looks or works to suit the visitor, such as remembering a language choice or a dark-mode preference, is also exempt. The same conditions apply: explain it and give a free, simple way to object.
Where advertising fits
The ICO is clear that online advertising has never been exempt from the consent rules and still isn't. That includes advertising pixels, retargeting and measuring adverts. If your site uses them, you need consent before they run.
A quick audit of your own site
Before you choose a banner, find out what your site actually sets. Your web developer can list every cookie and script, or you can open your browser's developer tools and look at the storage for your site. You might also like our article Who Owns My Website.
It's worth removing anything you don't use, because every extra script also slows the page down. Our guide to Core Web Vitals explains how that's measured. You might also like our article Does My Business Website.
What it does | Example | Consent needed? |
|---|---|---|
Keeps a basket or login working | Shopping basket, account login | No, strictly necessary |
Counts visits to improve the site | Simple, first-party analytics | Not if the exception's conditions are met |
Remembers display choices | Language or dark mode | Not if the exception's conditions are met |
Tracks people for adverts | Advertising pixels, retargeting | Yes, always |
If you're also reviewing what you tell visitors elsewhere, our business website checklist covers the other essentials in one place.
What a fair cookie banner looks like
If you do need consent, the banner should make accepting and refusing equally easy, and nothing non-essential should load until someone chooses. Explain each type of cookie in plain English, and let people change their mind later through a link in the footer.
Make sure the banner works with a keyboard and doesn't hide the item someone is on. Our guide to website accessibility law explains why that matters.
The exceptions still need explaining, so a short cookies page is worth having even if you don't need a banner at all.
Related guides
Cookies are one part of looking after visitors' data. Our guide to HTTPS and SSL certificates covers keeping the connection to your site secure.
If a designer is building or rebuilding your site, ask them which tools they're adding, and read our guide to who owns your website before you sign.
If you have a question, get in touch with our team.
There is more advice on our blog.
Frequently asked questions
Do I need a cookie banner if I only use Google Analytics?
It depends on how it's set up. The statistical exception only covers storage used solely to improve your site, with a clear explanation and a free way to object. If the provider uses the data for its own purposes too, you'll need consent.
Is a banner that says "by using this site you accept cookies" enough?
No. The ICO says consent needs a clear positive action and that simply continuing to use the website isn't enough.
Do the rules apply to tracking pixels as well as cookies?
Yes. The ICO's guidance covers storage and access technologies in general, including tracking pixels, local storage and device fingerprinting.
Can I set analytics cookies before the visitor responds to the banner?
Only if they fall under an exception. Anything that needs consent mustn't be set until the visitor has given it.
Your next step
List what your site sets today, sort each item into one of the rows in the table above, and remove anything you don't use.
For the official wording of each exception, read the ICO's guidance on the exceptions.