GDPR Cookie Consent UK: What a Valid Banner Actually Needs
Many cookie banners look compliant and are not. Here is a plain guide to what UK rules expect, and how to check your own site in ten minutes.
GDPR cookie consent in the UK is governed by two overlapping sets of rules: the UK GDPR and the Privacy and Electronic Communications Regulations, usually shortened to PECR. Between them they require that you obtain valid consent before storing or reading non-essential cookies and similar technologies on someone's device. Many banners look the part and still fall short. This is a plain-English guide, not legal advice, to what a sound banner involves.
Which cookies need consent at all?
Cookies that are strictly necessary to deliver something the visitor asked for, such as remembering the contents of a basket or keeping a person signed in, do not need consent. Almost everything else does, including most advertising and tracking cookies and, under the rules as they have stood, many analytics cookies. The Data (Use and Access) Act 2025 introduces some limited exemptions for certain low-risk uses such as basic statistics, so check the current guidance from the Information Commissioner's Office rather than relying on an old article, including this one.
Consent must be a real choice
The regulator expects consent to be freely given, specific, informed and unambiguous. In practice this means no pre-ticked boxes, no assuming consent because someone kept scrolling, and no hiding the reject option. Rejecting should be as easy as accepting, with a button of similar prominence on the first screen of the banner. A banner offering only "Accept all" and a link labelled "manage options" tucked away is the pattern most often criticised.
Nothing fires before the click
This is where many sites fail quietly. A banner can look perfect while analytics and advertising scripts are already running underneath. Consent has to come first: those scripts should not load, and their cookies should not be set, until the visitor agrees. Test by opening your site in a private window, declining the banner, and inspecting the cookies and network requests in your browser's developer tools. If you see tracking identifiers appear, the banner is decoration.
Describe the purposes in plain words
Visitors should be able to learn, without reading a legal document, what each category of cookie does, who sets it and how long it lasts. A short, specific description such as "measures how many people visit each page, so we can improve them" is better than "performance and optimisation". Link to a full cookie policy that lists each cookie by name, and keep the list accurate as your site changes.
Let people change their mind
Withdrawing consent must be as easy as giving it. A small, permanent link in the footer that reopens the choices is the usual approach. Honour the withdrawal immediately by stopping the relevant scripts and, where practical, deleting the cookies already set. Record the choice and when it was made, so you can demonstrate it if asked.
Do not forget the third parties on your pages
Embedded videos, maps, chat widgets, social buttons and booking tools all load their own scripts and often their own cookies. Each should either wait for consent or be replaced by a click-to-load placeholder. Audit the site page by page, because an old embed on a seldom-visited page is exactly the kind of thing that gets missed.
Penalties and priorities
Keep a record, and keep it simple
If a regulator or a customer asks how you obtain consent, you should be able to show what the banner said at the time, which version of your cookie policy applied and when a particular visitor made their choice. Most consent tools can log this. Make a note whenever you change a banner, a tool or a script, and review the whole arrangement at least twice a year, because small edits by well-meaning colleagues are the commonest way compliance quietly drifts.
Analytics without the headache
Many small organisations want only to know which pages are read. There are privacy-friendly analytics tools designed to work without cookies or personal identifiers, which can reduce the amount you must ask visitors to agree to and make your pages lighter. They are not magic, and you should read how each one stores data, but they are worth a look before deciding that a large banner is unavoidable. Whatever you choose, describe it honestly in your privacy notice.
The ICO can take enforcement action, and under the UK GDPR fines can reach £17.5 million or 4 percent of annual worldwide turnover, whichever is higher, although smaller organisations rarely face anything near that. The more realistic costs are complaints, reputational damage and lost trust. Start with an honest cookie audit, fix what fires early, rewrite your banner so rejecting is simple, and review the setup whenever you add a new tool. We build and test consent systems for sites across the region and would be glad to run a ten-minute check on yours.