What do the UK rules cover?
The Privacy and Electronic Communications Regulations (PECR) cover more than browser cookies. The ICO uses the wider term “storage and access technologies”, which can include pixels, local storage, scripts, tags, link decoration and device fingerprinting.
The basic rule is that storing information on, or accessing information from, a person’s device needs clear information and consent unless a defined exception applies. If personal information is involved, UK GDPR duties may also apply.
Which uses may not need consent?
ICO guidance updated after the Data (Use and Access) Act 2025 identifies five exceptions. Each has conditions and should be assessed by purpose.
| Exception | Plain-English purpose | Important condition |
|---|---|---|
| Communication | Transmitting a communication over a network. | The storage or access must be solely for that transmission. |
| Strictly necessary | Providing a service the user has requested, such as maintaining a basket or login. | “Useful” or convenient for the operator is not enough. |
| Statistical purposes | Collecting information solely to understand and improve use of the service. | Specific safeguards apply, including clear information and a simple free objection route. |
| Appearance | Adapting appearance or functionality to a user’s preference. | Clear information and a simple free objection route are required. |
| Emergency assistance | Identifying location to provide requested emergency help. | The purpose is narrow and unlikely to apply to an ordinary business website. |
Do not assume a tool is exempt because its supplier calls it “essential” or “analytics”. Review what it does, why it operates, what information it uses and whether every condition of the exception is met.
When is a consent banner required?
You need a suitable consent mechanism before using non-exempt storage or access technologies. The ICO states that online advertising uses require consent, including associated tracking and profiling. Cross-site and cross-device tracking also require consent.
A compliant mechanism should provide a real choice, avoid pre-enabling non-exempt technologies, explain purposes clearly and make refusal or withdrawal workable. The design should not push visitors towards acceptance through misleading emphasis or unnecessary friction.
How to audit your website
- Discover
Scan and manually test representative pages and journeys. - Identify
Record provider, technology, duration, data and purpose. - Assess
Decide whether consent or a specific exception applies. - Control
Configure blocking, choice, records and withdrawal, then retest.
- Check analytics, advertising, embedded video, maps, chat, payment, booking and social tools.
- Test before a choice, after refusal, after acceptance and after withdrawal.
- Check logged-in and logged-out journeys where relevant.
- Make the cookie information match what the site actually does.
- Repeat the audit when tags, plugins, embeds or suppliers change.
Can a simple website avoid a banner?
Potentially. A site using only exempt technologies may not need a conventional accept-or-reject banner. Some newer exceptions still require clear information and a simple way to object. Removing unnecessary trackers and privacy-intrusive embeds can simplify both compliance and the visitor experience.
Limited companies should separately review the company information required on a UK website.
Do not decide from appearance. A plain website can load third-party scripts, while a complex service can use carefully controlled technologies. Probeck’s website compliance service can help identify and configure the practical website changes; legal interpretation remains for an appropriately qualified adviser.
Cookie banner FAQs
Does website analytics always require consent in the UK?
No. Current ICO guidance includes a statistical-purposes exception with specific conditions, including sole-purpose limitations, safeguards, clear information and a simple free way to object. Analytics that does not meet every condition needs another valid route, which may be consent.
Can cookies load while the visitor decides?
Technologies that require consent should not be enabled before valid consent. Exempt uses may operate where their conditions are met and the required information or objection route is provided.
Are embedded videos and maps relevant?
Yes. Third-party embeds may store or access information. Consider privacy-friendly configuration, click-to-load approaches, consent controls or an external link, depending on what the service does.
How often should we review the setup?
Review it whenever the website, plugins, tags or suppliers change, and on a regular schedule. The ICO guidance cited below was reviewed for this article on 22 September 2026.