Almost every UK website has a cookie banner. A surprising number of them are wrong, and wrong in ways that manage to be both non compliant and bad for business at the same time.
The rules are less complicated than the banners suggest.
Two different laws, which is where the confusion starts
Cookies in the UK are governed by PECR, the Privacy and Electronic Communications Regulations, with UK GDPR sitting behind it for the personal data side.
PECR is the one that matters for the banner, and it is blunt: you need consent before setting any cookie that is not strictly necessary for a service the user has actively requested. Strictly necessary is narrow. It covers things like keeping someone logged in, remembering a shopping basket, and load balancing.
Analytics is not strictly necessary. Nor is advertising, heatmaps, session recording, or anything from a social network. Those all need consent first.
The three things most banners get wrong
Cookies fire before anyone clicks. This is the most common and the most serious. The banner appears, the visitor has not touched it, and analytics has already loaded. Consent that arrives after the fact is not consent. If you only fix one thing, fix this one.
There is no way to decline. A banner offering Accept and Manage Preferences, where declining takes three clicks through a settings panel, does not meet the standard. Refusing must be as easy as accepting. In practice that means a Reject All button sitting next to Accept All, the same size, the same prominence.
Continuing to browse counts as agreement. Some banners still say that scrolling implies consent. It does not, and has not for years.
The part nobody expects: rejecting is good for you
Businesses resist an honest Reject All button because they assume it destroys their analytics. In practice something more useful happens.
A banner offering a genuine choice gets a decision quickly, and a meaningful share of people accept. A banner that clearly makes declining difficult gets ignored, dismissed, or triggers the browser's own blocking. You end up with less data and a worse first impression.
The other thing worth knowing is that a large slice of your traffic is blocking these cookies at the browser level regardless of what your banner says. Safari and Firefox do it by default. Your analytics has never been complete, and treating it as directional rather than exact is the correct posture anyway.
Server side analytics changes the calculation
If what you actually need is page views, referrers and conversion counts rather than individual user journeys, there are analytics tools that do not set cookies at all and do not require a banner for that purpose.
That is worth considering seriously. It removes the compliance question, removes the banner friction, and gives most businesses the numbers they actually use. The businesses that genuinely need cookie based tracking are the ones running sophisticated remarketing, and they know who they are.
The privacy policy behind it
The banner is the visible part. The policy is the part regulators actually read.
It needs to say what you collect, why, how long you keep it, who else sees it, and how someone exercises their rights. Written plainly. A generic template naming a company in another jurisdiction and referencing laws that do not apply to you is worse than a short honest page.
If you collect enquiries through a form, that is personal data and the policy needs to cover it, including how long you keep enquiries from people who never became customers.
A short checklist
- Nothing but strictly necessary cookies fires before a choice is made.
- Reject All is as prominent and as easy as Accept All.
- The choice is remembered, and there is a way to change it later.
- The privacy policy is specific to your business and linked from the banner.
- You know what each cookie on your site is for. This one catches people out, because half of them arrived with a plugin.
None of this is expensive to get right. It is mostly a matter of configuring the banner properly rather than accepting the default, which is usually set up to maximise acceptance rather than to comply.
See how we work with UK businesses, or send us your site and we will tell you what fires before consent.
Building something in the UK?
United Kingdom — We design and build fast, search-ready websites and AI customer experiences for ambitious UK businesses. GDPR-conscious, accessible, and built to rank — with a fixed quote and senior people from first call to launch.
What we do in the UK
