Cookie consent requirements in the UK and EU: the short answer
In the UK and the EU, a website needs consent before it stores or reads anything on a visitor's device, unless that's strictly necessary for what they asked for. Consent means a clear yes, given before the tag runs, with a reject option as easy as accept.
Since 5 February 2026, the UK also exempts some first-party analytics. The EU doesn't.
This guide is for founders and operations leads at UK and EU companies whose website runs analytics, advertising or chat tools. You probably have a banner already. The harder question is whether the tags wait for it. When the ICO checked the UK's 1,000 busiest websites, only 415 passed without the regulator stepping in.
We build websites for companies in the UK, France and Albania. Our own site runs Google Consent Mode v2, with analytics and advertising storage denied until a visitor clicks Accept. Below are the rules, the UK's 2026 changes and a test you can run in five minutes.
What needs consent, and what doesn't
The rule covers anything a website stores on a visitor's device or reads from it: cookies, local storage, tracking pixels, fingerprinting scripts. In the EU it's Article 5(3) of the ePrivacy Directive, which each country applies through its own law. In the UK it's regulation 6 of PECR, the Privacy and Electronic Communications Regulations.
Both share one core exception: storage that is strictly necessary for a service the visitor asked for, such as the basket or the log-in. It doesn't cover analytics or advertising, however useful they are to you.
The EU's highest court settled three points in the Planet49 case in 2019. A pre-ticked box isn't consent. The rule applies whether or not the information is personal data. And visitors must be told how long cookies last and whether third parties can reach them.
"Cookieless" doesn't mean exempt. In October 2024 the EDPB, the board of EU data protection regulators, adopted guidelines on the scope of Article 5(3). They bring tracking pixels, tracking links and scripts that send information back from the device under the rule. The UK text now says outright that it covers collecting information a device sends out on its own.
| What the storage or tag does | Examples | UK | EU |
|---|---|---|---|
| Keeps the site working as the visitor asked | Basket, log-in, security, the consent choice | No consent needed | No consent needed |
| Counts visits to improve your own site | First-party analytics | No consent if visitors are told and can object, and no one else uses the data for their own ends | Consent, apart from narrow national exceptions |
| Remembers how the visitor set up the page | Language, text size | No consent if visitors are told and can object | Usually exempt when the visitor chose the setting |
| Advertising and cross-site tracking | Ad pixels, remarketing tags | Consent | Consent |
| Third-party embeds that track | Video players, maps, social widgets, chat | Consent, unless an exception fits | Consent |
The EU preference row follows the EDPB's cookie banner taskforce, which recalled the long-standing view that cookies keeping a visitor's own preference count as strictly necessary.
What changed in the UK in 2026
On 5 February 2026 the cookie changes in the Data (Use and Access) Act 2025 took effect. The Act rewrote regulation 6 and added a new schedule of exceptions to PECR. It also raised the maximum PECR fine to match the UK GDPR's.
The exception most websites care about covers statistics. Under paragraph 5 of the schedule, analytics can run without consent when all four conditions hold.
- The only purpose is statistics about how people use your own service or website, to improve it.
- The data goes to no one else, except someone helping you improve the site.
- Visitors get clear and comprehensive information about it.
- Visitors get a simple way to object, free of charge, and haven't objected.
A second exception covers remembering how a visitor set up the site's appearance or functions, on the same terms.
Three limits matter. Advertising gets no exception: the ICO says every advertising purpose needs consent, ad measurement included. A third-party analytics tool qualifies only if its provider acts as your processor and keeps the data for your use, so read its terms and data-sharing settings first. And the exception doesn't cover collecting what a device sends out on its own, such as the signals used for fingerprinting.
The ICO's final guidance, published on 29 April 2026, works through each exception. It says the way to object can sit in your existing consent tool.
The ICO also tests sites. By December 2025, 564 of the UK's 1,000 busiest websites had fixed their cookie practices after first failing its checks. The ICO had sent letters, opened investigations and, in 17 cases, issued preliminary enforcement notices.
What a valid cookie banner needs
A banner is valid when the choice is real and the tags respect it. The ICO's guidance on managing consent in practice, the EDPB taskforce and the GDPR come down to eight points.
- Nothing that needs consent runs before the visitor chooses. Silence, inactivity and carrying on browsing aren't consent.
- Reject is as easy as accept. The ICO asks for a mechanism that makes it "as easy to refuse consent as it is to accept". Most EU regulators on the taskforce treat a banner with no reject option on the same layer as the accept button as an infringement.
- No pre-ticked boxes, and no "legitimate interest" switches turned on by default. The taskforce agreed that legitimate interest can't be the legal basis for placing or reading cookies.
- Clear information: what each tool does, which third parties receive data, and how long cookies last.
- A separate choice for each purpose, such as analytics and advertising.
- A way to change your mind that's as easy as saying yes. Article 7(3) of the GDPR requires it, and the ICO says a mechanism that can't do this doesn't comply. The taskforce suggests a small, permanent icon or a link in a standard place.
- Fresh consent when you add a tool for a new purpose. The ICO's example is a social media plugin added later.
- Records. Under Article 7(1) of the GDPR you must be able to show that a visitor consented. Google's EU user consent policy asks for records too.
The banner is also part of the page, so it has to work with a keyboard, a screen reader and a small screen. If you sell to consumers in the EU, our guide to the European Accessibility Act and your website covers what that law asks of every page, the banner included.
Where cookie banners fail: the tags don't wait
The failures that reach regulators are often about timing, not wording. The banner appears, and the tags run anyway.
In September 2024 the ICO reprimanded Sky Betting and Gaming. Its site shared visitors' data with advertising technology companies as soon as they arrived, before they could accept or reject. A year later France's regulator, the CNIL, sanctioned SHEIN for advertising cookies placed the moment visitors arrived. After a click on "Refuse all", the site still set new cookies and kept reading old ones.
Both sites had a banner. Neither banner controlled everything.
Tags reach a site from several places: the page template, Google Tag Manager, a plugin, a chat widget, a script pasted in for one campaign. The banner controls only the tags wired to it. The rest run on page load, and the banner looks the same either way.
So a banner on screen proves only that the banner loaded. It proves nothing about what waited for it. The evidence is the browser's own record of what was stored and sent, before and after each choice.
The EDPB taskforce found a related habit: cookies labelled "essential" that serve other purposes. A label is a claim. What the cookie does is the test.
How to test your cookie banner in five minutes
You need a desktop browser and its developer tools, not a specialist. These steps use Chrome; Firefox and Safari have the same panels under similar names.
- Open a private window, open the developer tools (F12, or Cmd+Option+I on a Mac) and choose the Application tab. Then load your homepage. Don't touch the banner.
- Under Storage, open Cookies and Local storage. Your own strictly necessary items are fine. Analytics or advertising cookies such as
_ga,_gcl_auor_fbpare a fail, unless you rely on the UK analytics exception and tell visitors so. - Switch to the Network tab and reload. Type each tool's name into the filter, for example
google-analytics,doubleclick,facebookorhotjar. A request before any choice means that tag isn't waiting. Google's advanced consent mode sends cookieless requests by design; the next section explains them. - Click Reject and browse three pages. Nothing new should appear in either tab.
- Open a fresh private window, click Accept, and check that your analytics cookie now appears. If it doesn't, the banner blocks everything, and your analytics miss even the visitors who agree.
- Find the link that reopens your choices. Withdraw consent, browse on, and check the tags stop.
- Repeat the first four steps on a phone, where a cramped layout can push the reject button out of sight.
For Google's tags, Tag Assistant shows the default consent state and every update, event by event. Save dated screenshots. They're your record, and the baseline for the next check, which belongs after every new tool anyone adds. Put it in your website maintenance routine, next to backups and updates.
Google Consent Mode v2: what it does, and what it doesn't
Consent Mode is how Google's tags read a visitor's choice and change what they do. It shows no banner and collects no consent. Google's documentation says the site owner is responsible for obtaining consent, through a banner or a consent management platform.
Version 2 added two signals to the existing ones: ad_user_data, for sending user data to Google for advertising, and ad_personalization, for personalised ads. Google requires them from advertisers who want ad personalisation and measurement for visitors in the EEA. Its user consent policy also covers the UK and Switzerland.
The choice that matters is basic or advanced mode.
| Basic mode | Advanced mode | |
|---|---|---|
| Google's tag before a choice | Doesn't load | Loads, with storage set to denied |
| Before a choice, or after Decline | Nothing is sent | Cookieless pings with a timestamp, browser details, the referring page and the consent state |
| Filling gaps in your reports | Google's general model | A model built for your site |
Our own site runs advanced mode. Google's tag loads with advertising, analytics, functionality and personalisation storage all denied; only security storage starts as granted. The banner asks one question, because analytics is the only thing we run that needs asking.
Accept grants analytics and functionality storage. Advertising storage stays denied whatever the visitor picks, because we don't run ads. Before a choice, and after Decline, the tag sends Google a cookieless signal for each page, and our privacy page says so.
That's a judgement, and you may judge it differently. The EDPB's guidelines read "gaining access" to a device broadly, so a regulator could see those pings as covered by Article 5(3). If you sell mainly into the EU, or want the lowest risk, choose basic mode and accept thinner numbers.
One website with UK and EU visitors
If EU visitors matter to your business, build the banner to the EU standard and show it to everyone. It's the stricter rule, and one setup is easier to keep right than two. Consent tools can show different banners by location, but location lookups misplace some visitors, and you'd have two setups to test.
If nearly all your visitors are in the UK, qualifying analytics need only a notice and a clear way to object. Advertising still needs the banner.
Inside the EU, each country applies Article 5(3) through its own law: in France, Article 82 of the data protection act; in Germany, section 25 of the TDDDG. Regulators differ at the edges.
France's CNIL lets some audience measurement run without consent. Its conditions include measuring one site only and letting visitors object. It also says most large analytics offerings don't qualify, however they're configured.
The EU rules may change, but not yet. On 19 November 2025 the Commission proposed a digital omnibus that would move the cookie rules into the GDPR. When the European Parliament's tracker was last updated, in August 2026, no text had been agreed.
The older plan for an ePrivacy Regulation was withdrawn in 2025. Build for the rules in force, not the ones proposed.
When you don't need a cookie banner
You need no banner if your site stores and reads nothing beyond what's strictly necessary. No analytics, no ad pixels, no embeds that track: then there's nothing to ask about. Your privacy information should still say what the site uses and why.
Small sites may not need a paid consent platform either. A banner that offers Accept and Decline side by side, passes the answer to your tags and remembers it can be a short script. Ours is 69 lines, comments included. Consent platforms earn their place on larger sites with many vendors and advertising partners.
Often the simplest fix is removing a tool. Every tracker is something to disclose, gate and re-test. Our websites come with analytics wired to a question you actually have. If nobody at your company has opened the heatmap dashboard this year, remove the script, and the banner gets simpler.
On a hosted platform, look in its privacy settings before hiring anyone. Several include a cookie banner.
What to ask whoever builds or runs your website
Ask for these in writing from any agency, including us.
- A list of every tool that stores or reads anything on a visitor's device, with its purpose, who gets the data and how long it lasts.
- For anything that runs without consent, the exception it relies on.
- The results of the five-minute test: before a choice, after Reject, after Accept and after withdrawing, on desktop and on a phone.
- A permanent link or icon that reopens the choices.
- Consent records, and where they're kept.
- Who re-runs the test when someone adds a tool, and who updates the banner.
- The analytics and tag manager accounts in your company's name, with the agency added as a user. Our guide to whether you own your website covers the other accounts.
Under the first two items sits one question: who else gets the data, and what may they do with it? The same question comes up when staff paste customer details into AI tools, as our guide to ChatGPT, GDPR and customer data explains. For a new site, put the tool list in your website brief, so every supplier quotes for the same banner.
This week, open your homepage in a private window with the developer tools open, and don't click the banner. Write down every cookie you see. If the list holds anything beyond the basket, the log-in and security, you've found your first fix.
Questions
Do the cookie rules apply to small businesses?
Yes. Neither PECR nor the ePrivacy Directive exempts small firms. The rules follow what your site does on a visitor's device, not the size of your company. The regulators' published checks have focused on the busiest websites, but any visitor can complain to the ICO or to their own national regulator.
How long does a visitor's choice last, and when can we ask again?
The ICO says neither PECR nor the UK GDPR sets a time limit. As a general guideline, it suggests waiting six months before asking again someone who said no, and it warns against asking repeatedly to get a different answer. You must ask again when you add a tool for a new purpose. EU regulators set their own expectations, so check the countries you sell to.
Do embedded videos, maps and chat widgets need consent?
Yes, when they store or read anything on the visitor's device, and many third-party embeds do. A common fix is a placeholder. Show a still image with a line on what loading the embed involves, and load it only when the visitor clicks.
Do tracking pixels in marketing emails count?
Yes. The ICO's guidance gives email tracking pixels as an example where regulation 6 of PECR applies, and the EDPB's guidelines say the same for the EU. If your newsletter tool tracks opens, cover it in the consent you collect at sign-up, or switch open tracking off.
How we wrote this: drafted with AI, then checked and edited by the people who build our projects. Figures come from our own work or from the linked sources.