UK Cookie Rules for Websites: What PECR Requires
The UK cookie rules for websites come from PECR, the Privacy and Electronic Communications Regulations. Before your site stores or reads non-essential cookies, you need the visitor's consent, unless a cookie is strictly needed to deliver a service they asked for. Refusing must be as easy as accepting.
Key takeaways
- PECR applies across the whole of the UK, and the Information Commissioner's Office (ICO) enforces it in England, Wales, Scotland and Northern Ireland alike.
- Strictly necessary cookies, such as those that keep a shopping basket or a login working, can be set without asking the visitor first.
- Analytics, advertising and social media cookies generally need consent before they are set.
- A banner with a bright "Accept" button and a hidden or faint "Reject" option fails the rule that refusing must be as easy as accepting.
- Pre-ticked boxes do not count as consent, and a site that blocks access until visitors accept tracking is a practice the ICO questions.
- Keep a cookie policy that lists what each cookie does, who sets it and how long it lasts, and keep a record of the choices visitors make.
- The Data (Use and Access) Act 2025 changed some details, so check ICO guidance before you finalise your banner and policy.
What counts as a cookie under PECR?
A cookie is a small piece of data that a website stores on a visitor's device, or reads back from it later. PECR covers cookies and similar technologies, so an audit that only looks for the word "cookie" will miss things. Local storage, tracking pixels, embedded tags and some software development kits in mobile apps can all store or read information on a device in the same way.
The rule is about access to the device, not only about the file type. If your website writes a value to a visitor's browser or reads one back, PECR is likely to apply. Where that information is personal data, such as an identifier that can single out a person, the UK GDPR applies as well. Two sets of rules therefore often run side by side. PECR governs the storing and reading, and the UK GDPR governs the personal data that results.
Many small business sites pick up cookies without the owner noticing. A booking widget, a live chat tool, a map embed, a video player and a review badge may each set cookies of their own. A proper audit includes every third-party script on the site, not only the tools you installed on purpose.
Which cookies are strictly necessary and can be set without consent?
Strictly necessary cookies can be set without consent when they are essential for a service the visitor has asked for. The test is narrow. A cookie does not become strictly necessary because it is useful to your business, and calling a marketing cookie "essential" does not make it so.
Typical examples include a cookie that holds the items in a basket during checkout, a session cookie that keeps a signed-in user logged in, a security token that protects a form against misuse, and a cookie that balances traffic between servers. Remembering the visitor's own consent choice is generally treated as acceptable too, because it is needed to respect that choice.
The table below shows the usual position for common cookie types. Treat it as a starting point for your own audit rather than a legal conclusion, because the purpose and configuration of each tool decide the answer.
| Cookie type | Usually needs consent? | Typical examples |
|---|---|---|
| Strictly necessary | No | Basket, login session, security token |
| Remembering consent choices | No | Records whether the visitor accepted or rejected |
| Analytics | Usually yes | Visitor counts, page journeys, measurement tools |
| Advertising and retargeting | Yes | Ad pixels, audience builders |
| Social media embeds | Usually yes | Share buttons, embedded feeds that track visitors |
Where one tool does more than one job, split the purposes. A language preference cookie may be acceptable while the same provider's tracking cookie is not. The ICO expects you to be able to explain each cookie on its own terms, so a single vague label such as "functional" for a whole group of tools is not enough.
How should a fair cookie banner work?
A fair banner gives visitors a real choice before any non-essential cookie is set. It should explain in plain words what you use cookies for, and it should offer accept and reject options that are equally easy to find and use. Visitors who want more control should be able to choose categories, such as analytics or advertising, rather than accepting everything at once.
The standard to check against is simple. If a visitor can accept with one click, they should be able to reject with one click too. A grey "Reject" link tucked under a bright "Accept" button, or a multi-step settings maze that only leads to refusal, is the kind of design that undermines consent. Equally, a banner that says "we value your privacy" and nothing else tells the visitor nothing useful.
An example of clear wording might read: "We use cookies to keep the site working and, with your permission, to measure visits and show relevant adverts. You can accept all, reject all or choose which types to allow." It says what the cookies do, it gives the options side by side, and it does not pressure the visitor.
Use this checklist when you review your banner:
- No non-essential cookies, tags or pixels load until the visitor has made a choice.
- Accept and reject carry equal visual weight and sit on the same screen.
- Categories are switched off by default, with no pre-ticked boxes for marketing or analytics.
- Visitors can change or withdraw their choice later through a visible link, such as one in the footer.
- The banner names the purposes in plain language, not only in general reassurance.
- Closing the banner without choosing does not count as accepting everything.
Cookie walls deserve special caution. A site that refuses to show content unless the visitor accepts tracking gives them little real choice. If you are considering one, get specific advice first, because the ICO scrutinises this approach closely.
What mistakes do small businesses make with cookies?
Most cookie problems come from assumptions rather than bad intent. The owner assumes a tool is essential, or assumes a web designer set things up correctly, or assumes that a banner which looks tidy is also compliant. Checking those assumptions is cheap compared with rebuilding a site after a complaint.
- Treating a cookie as strictly necessary because the site would be less convenient without it.
- Forgetting that a plugin, chat widget or embedded video added cookies after the site went live.
- Loading the analytics tag in the page header, so that it fires before the banner has even appeared.
- Copying a cookie policy from a template that lists tools the site no longer uses, or leaves out the new ones.
- Making the "Reject" option sit on a separate settings page that takes several steps to reach.
- Trusting a consent banner built by someone else without testing what happens when a visitor rejects.
The quickest test is to open the site in a private browser window with the developer tools running. Load the page, make no choice, and look at what has been stored. Then reject everything, reload, and check again. A tag that fires before any choice has been made is the clearest sign of a problem, because it means data is collected before consent exists.
Do you have to keep a record of consent?
You do not need a special form for consent records, but you should be able to show what a visitor agreed to, when, and under which version of your banner and policy. Good records are the difference between a compliance statement you can back up and a claim you cannot prove.
A practical record covers the date and time of the choice, the categories accepted or rejected, the version of the banner and cookie policy the visitor saw, and the page where the choice was made. Keep the record for as long as you need it to demonstrate compliance, and no longer. Avoid collecting more personal information than the record needs, because the record itself is personal data if it identifies the visitor.
Many businesses use a consent management platform (often called a CMP) to show the banner and log choices. These tools help, but they still need configuring. Default settings can be too permissive, and some tags ignore the CMP unless they are connected properly. Test the site after any change, and check the cookies set before and after a rejection each time.
Google's Consent Mode is one example of how a tag can be told about a visitor's choice so that it adjusts what it sends. It does not replace a lawful banner. You still need the visitor's choice captured properly, and you still need to pass the consent signal on accurately. If your web designer or agency describes consent in technical terms, ask them to explain what the visitor actually sees and what happens when they say no.
What should your cookie policy say?
A cookie policy is a separate page that explains, in plain English, which cookies your site uses and why. Link to it from the banner and from the footer of every page. Keep it up to date, because a policy that lists tools you have removed is as misleading as one that omits a tool you have just added.
A useful cookie policy covers the following points:
- What cookies and similar technologies are, in a sentence or two.
- Each cookie or tool, its purpose, who sets it and how long it lasts.
- Whether any cookies are set by third parties, and where to find their own policies.
- How visitors can accept, reject or change their choices at any time.
- How the cookie information links to your wider privacy notice.
- How to contact you with questions about cookies or personal data.
PECR does not set a fixed maximum life for a cookie. What matters is that the duration fits the purpose and that you state it honestly. A session cookie ends when the browser closes, while a longer-lived cookie needs a clear reason for lasting that long. If you cannot explain why a cookie needs to exist for a long period, that is a sign to shorten it or remove it.
Your privacy notice explains what personal data you collect through the site and how you use it. The cookie policy is narrower and focuses on the technology. For the wider duties, read the GDPR checklist for small businesses, which covers privacy notices, lawful bases and the rights that customers and visitors have.
How do the cookie rules differ across England, Wales, Scotland and Northern Ireland?
The cookie rules themselves are the same across the UK, because PECR is UK-wide legislation and the ICO regulates it everywhere. A business in Glasgow and a business in Cardiff face the same consent requirements for analytics and advertising cookies.
What does vary is the wider legal framework around your business. Small claims procedures, for example, differ between England and Wales, Scotland and Northern Ireland. Those differences matter if a customer complains about how their data was used and the dispute goes further, so check the local position separately from the cookie question. If a dispute reaches a court, a solicitor can advise on which procedure applies to your case.
Rules change. The Data (Use and Access) Act 2025 altered some details of the consent regime, and the ICO continues to publish updated guidance. Check the ICO's website for the current position before you rely on any detail in this article.
What to do next if your website uses cookies
Start with a cookie audit, then fix the banner, then write the policy. Doing these in the wrong order wastes effort, because the policy has to describe what the banner actually does and what the site actually sets.
- List every script, tag, plugin and embedded widget on your site, including the ones added by your web designer or hosting provider.
- For each item, note whether it sets or reads a cookie, what it does and whether it is strictly necessary.
- Test the site in a private browser window and record which cookies appear before any choice is made.
- Rebuild the banner so that non-essential tools only load after consent, with equal accept and reject options.
- Write or update the cookie policy so that it matches the audit exactly.
- Set up a record of consent choices, and confirm that rejecting really stops the non-essential tools.
- Repeat the audit whenever you add a tool, change a plugin or move to a new host.
If you lack the in-house skills, a web designer who has built consent banners before can run the audit with you. Look through web designers in your area and ask them to show you how they test a reject choice. If your site relies on advertising or detailed measurement, marketing agencies can explain which tools they use and how consent changes the data you see. For a formal review of your privacy terms, a solicitor found through solicitors and legal advisers is the right person to ask.
When the website is in order, make sure your business details are accurate everywhere they appear. You can add your business to UKListingz for free from My Account, and the name, address and phone number you give should match your website exactly. For the other essentials, the small business website checklist covers contact details, mobile layout, speed and legal information.
Frequently asked questions
Do I need a cookie banner if I only use analytics?
In most cases, yes. Analytics cookies are not strictly necessary for the service a visitor asks for, so the usual position is that you need consent before they are set. Some first-party measurement setups may fall within narrow exemptions, and the Data (Use and Access) Act 2025 changed some details. Check the ICO's current guidance and confirm exactly how your analytics tool is configured before you decide.
Can I use a cookie wall that blocks the site until visitors accept?
This is risky and generally not advisable. A cookie wall offers visitors a choice between accepting tracking and not using the site at all, which makes it hard to say that consent was freely given. The ICO has scrutinised this approach, so if you are considering it, take specific advice first. A safer option is to let visitors read your content and use the core service while non-essential cookies stay switched off.
Do cookies that remember a visitor's language need consent?
Often not, provided the cookie is needed to deliver the language the visitor chose. If the cookie only keeps a preference the visitor has asked the site to remember, it can fall within the strictly necessary exemption. The position depends on what the cookie actually does, so describe its purpose in your policy and never reuse it to build marketing profiles without consent.
Is a pre-ticked box on a cookie banner valid consent?
No. Consent has to come from a clear action by the visitor, so a box that is already ticked for marketing or analytics does not count. The same applies to a banner that treats scrolling or closing the window as agreement. Set every non-essential category to off by default and let the visitor switch on what they want.
How long can a cookie last under PECR?
PECR does not set a fixed maximum life for a cookie. The test is whether the duration is proportionate to the purpose, and whether you explain it clearly in your cookie policy. A session cookie that ends when the browser closes is the simplest case. A longer-lived cookie should have a clear reason, and you should review it regularly.
What is the difference between PECR and UK GDPR for cookies?
PECR governs storing information on, and reading information from, a visitor's device, and it sets the consent rules for non-essential cookies. The UK GDPR governs the use of personal data, including the identifiers and profiles that a cookie can help build. Often both apply to the same cookie, so your banner, cookie policy and privacy notice need to agree with one another.
Sources and further reading
- Information Commissioner's Office – the regulator for PECR and UK GDPR, with guidance on cookies and consent.
- ICO for organisations – practical guidance for businesses on data protection and electronic privacy rules.
- Federation of Small Businesses – advice and support for small firms running websites and marketing.
This article is general information, not legal, financial or professional advice. Rules and prices change, so check the official sources above before you act.