Cookie consent for UK websites

A cookie is a small text file that a website asks a browser to store. Cookies can remember that you are logged in, what is in your basket or your language choice. Others track what you do across pages or across different sites, to measure traffic or to show targeted advertising. The law covers cookies and similar technologies such as tracking pixels, local storage and device fingerprinting.

PECR is concerned with storing information on, or reading it from, someone's device. That is why it applies whether or not the cookie holds personal data. When cookies do involve personal data, UK GDPR applies as well, and the consent must meet the UK GDPR standard: freely given, specific, informed and unambiguous, given by a clear action.

The cookie policy sits behind the banner and gives the detail. For each cookie or group of cookies, it should state the name or provider, what it does, whether it is first party or third party and how long it lasts. Keep it understandable. A table works well, and many consent tools generate and update one for you after scanning the site.

Link it with your privacy notice, which covers wider personal data use, as described in our guide to UK GDPR for website owners. Revisit both whenever you add a plugin, an embedded video, a chat widget or an advertising pixel, because each can add cookies you have not yet disclosed.

Many small sites have a surprisingly short cookie list. A brochure site with no analytics, no embeds and no advertising may set only strictly necessary cookies, in which case no consent banner is needed, though you should still explain what is used in a short notice. Removing a tracking tool you rarely look at is often easier than building consent around it.

If you do want analytics, decide what you really need to measure. The 2025 Act added a "statistical purposes" exception, so some first-party analytics can run without consent. It is narrow: the cookies or similar technologies must be used only to improve your own website or service, and the information gathered must be aggregate statistics that cannot identify people. Using a third-party analytics provider does not widen it, and anything used for advertising, including ad measurement, still needs consent. The ICO sets further conditions in its guidance on exceptions, so read that rather than relying on a vendor's claim that a tool is "cookie-law compliant". When in doubt, take professional advice.