Most small business owners do not think much about cookies. You built your website, added Google Analytics to track visitor numbers, and moved on. But if your site uses any kind of tracking or third-party tool — and most do — UK law requires you to tell visitors about it and, in many cases, ask their permission first.
This is not just a formality for big corporations. The rules apply equally to a sole trader with a five-page brochure site and a multinational with a team of lawyers. Here is what you need to know.
What Are Cookies?
A cookie is a small file that a website places on a visitor's device — usually their browser — to remember information about them. Some cookies are straightforwardly useful: they remember that you are logged in, keep items in your shopping basket, or save your language preference. Others track your behaviour across the web to build a profile for advertising purposes.
From a legal standpoint, the distinction that matters is not what a cookie does, but whether it is strictly necessary for the website to function.
What Does UK Law Require?
In the UK, cookies are governed primarily by the Privacy and Electronic Communications Regulations (PECR), which sit alongside UK GDPR. The headline rule is this: you need a visitor's consent before placing any cookie on their device that is not strictly necessary for the website to work.
Strictly necessary cookies — the ones that keep a form submission working or hold a shopping basket together — are exempt. You can place them without asking.
Everything else requires consent. That includes:
- Analytics cookies — such as those placed by Google Analytics to track visitor behaviour
- Marketing and advertising cookies — used by Facebook Pixel, Google Ads, or similar tools
- Social media cookies — placed by embedded share buttons or follow widgets
- Preference cookies — ones that remember settings beyond what the site needs to function
If your website has Google Analytics installed — and most websites do — your site is placing non-essential cookies, and you need to handle this correctly.
What You Actually Need
To comply with the rules, you need two things: a cookie notice (sometimes called a cookie banner) and a cookie policy.
The Cookie Notice
This is the banner or pop-up that appears when someone visits your site for the first time. It needs to:
- Tell visitors that your site uses cookies
- Explain what the non-essential cookies are used for
- Give visitors a genuine choice to accept or decline
- Not guilt them into accepting (so no dark patterns — no greyed-out "Reject" buttons)
- Record their consent so you are not asking again on every visit
The key word is genuine choice. A banner that only has an "Accept all" button, or that uses visual tricks to make accepting look like the obvious option, does not comply. Visitors must be able to say no just as easily as yes.
The Cookie Policy
Separate from the banner, your site should have a dedicated cookie policy page. This goes into more detail about what cookies you use, who sets them, how long they last, and how visitors can manage or delete them. It is typically linked from the cookie banner and from your footer alongside your privacy policy.
Your cookie policy should list each category of cookie your site uses — essential, analytics, marketing — along with a brief description of what each one does. You do not need to list every individual cookie by its technical name, but you do need to be honest about what is on your site.
Does Your Site Use Non-Essential Cookies?
The quickest way to check is to think about what tools you have installed. Common sources of non-essential cookies include:
- Google Analytics or Google Tag Manager
- Facebook Pixel or Meta Ads tools
- Google Ads conversion tracking
- Hotjar, Clarity, or similar session recording tools
- YouTube or Vimeo embedded videos
- Live chat tools like Intercom or Tidio
- Social media sharing or follow buttons
If any of these are present, your site needs a properly functioning cookie consent mechanism — not just a notice that assumes consent by continuing to browse.
How to Add a Cookie Banner
The easiest approach for most small businesses is to use a dedicated cookie consent tool. Several of these are available as plugins or embed codes that work with most website platforms:
- CookieYes — popular, has a free plan, and handles the consent records for you
- Cookiebot — more comprehensive, with automatic cookie scanning; free for small sites
- Complianz — particularly popular for WordPress sites
These tools scan your site for cookies, generate the appropriate consent banner and policy, and store records of consent so you can demonstrate compliance if needed. Most have free tiers that are adequate for a small business site.
If someone built your website for you, it is worth checking whether they included a cookie solution at the time — and whether it is actually configured correctly. Many sites have a token banner that does not block cookies before consent is given, which does not comply with the rules.
What Happens If You Do Not Comply?
The Information Commissioner's Office (ICO) is the UK regulator responsible for enforcing PECR. While large fines tend to be reserved for organisations that cause real harm at scale, the ICO does issue reprimands and enforcement notices to smaller businesses for cookie non-compliance — and the reputational damage from being investigated is rarely worth the time saved by ignoring the rules.
More practically, an increasing number of web users actively look for a cookie banner before engaging with a site. If yours is absent, some visitors will simply leave.
Keep It Simple
If this all sounds complicated, the practical steps are straightforward: install a reputable cookie consent tool, let it scan your site, follow its setup wizard, and make sure your cookie policy is linked clearly from your footer. The whole process takes an hour or two and most tools will guide you through it.
The goal is honesty with your visitors — telling them what data your website collects and giving them a real say in it. That is worth doing for the right reasons, not just the legal ones.
If you are not sure whether your current website handles cookies correctly, or you would like a new site built with compliance in mind from the start, get in touch — we will make sure everything is set up properly so you can focus on running your business.