Cookie banners: what UK law actually asks of your website.

Most small business websites in Norwich have a cookie banner. Far fewer have one that does what the law asks. The visitor ignores the banner, and the tracking scripts have already loaded behind it. You annoy people with a pop-up and still fall short of the rules.

This matters more each year as retail moves online. ONS figures show internet sales were 27.4% of UK retail in 2025, up from 19.2% in 2019.

Online shops chasing that trade tend to add analytics, ad pixels and chat tools, and each one can set cookies. Here is what you need to know, in plain terms.

The rules in brief

Cookies are covered by the Privacy and Electronic Communications Regulations (PECR). Where cookies collect personal data, UK GDPR applies too. The core of it is simple:

• You must tell people what cookies you use and why.
• You must get consent before setting any cookie that is not strictly necessary.
• People must be able to change their mind later.

What counts as strictly necessary

Some cookies don't need consent because the site can't do what the visitor asked without them. Typical examples:

• Keeping items in a basket and taking someone through checkout
• Keeping a customer logged in to their account
• Security and fraud checks during payment
• Remembering the visitor's cookie choice itself

Things that usually do need consent: Google Analytics, the Meta Pixel, TikTok and other ad tracking, heatmap tools, and embedded content such as YouTube videos or social feeds that set their own cookies. Finding a tool useful doesn't make it necessary.

A change worth knowing about

The Data (Use and Access) Act 2025 relaxes the consent rule for some low-risk uses, such as basic analytics used to improve your own site, as long as people are told and can opt out. The changes are coming in stages, and advertising cookies still need consent. Check the ICO's current guidance before you change anything because of it.

Five mistakes we see on small business sites

1. Scripts fire before anyone clicks. The banner is decoration, and analytics and pixels load the moment the page opens. This is the most common fault and the most serious.
2. No Reject button on the first screen. Accepting is one click, saying no is buried in settings. The ICO has been clear that refusing should be as easy as accepting.
3. Pre-ticked boxes. A box ticked on the visitor's behalf is not consent.
4. 'By using this site you agree to cookies.' Carrying on browsing is not consent either.
5. No way back. Once the banner is dismissed, there's nowhere to change the choice. Put a 'Cookie settings' link in the footer.

A cookie banner that loads the tracking anyway is just a pop-up that annoys people.

Check your own site in five minutes

You don't need a developer to spot the main problem.

1. Open your site in a private or incognito window.
2. Don't touch the banner.
3. Right click, choose Inspect, and find the cookie list. It sits under the Application tab in Chrome and the Storage tab in Firefox.
4. If you see analytics or advertising cookies, such as ones starting _ga (Google Analytics) or _fbp (Meta Pixel), they have loaded without consent.
5. Now open a fresh private window, click Reject and browse a couple of pages. Those cookies should not appear.

Getting it right without hurting sales

A compliant banner doesn't have to be ugly or in the way.

• Keep it small on mobile. A banner that fills a phone screen, or sits over the Add to basket button, gets in the way of the people trying to buy.
• Use plain words. 'We'd like to use analytics to see which pages help people. Is that OK?' beats a paragraph of legalese.
• Give Accept and Reject equal weight. Same size, same colour, same place.
• Keep your cookie policy honest. List the cookies your site actually sets, not a template copied from someone else's site.
• Audit your scripts. Plenty of sites still carry tracking for tools nobody has logged into for years. Remove what you don't use and you have less to ask permission for.

That last point is how we prefer to set sites up: list every third-party tool at the start of a build, and load nothing non-essential until a visitor says yes. It keeps the site within the rules and keeps pages lighter too.

Yes, your visitor numbers may drop

Once people can genuinely say no, Google Analytics will show fewer visits. That can feel alarming, but analytics figures were never a perfect count anyway. Your orders, enquiries and bookings are still the numbers that tell you whether the site is working.

If you run a shop, café or holiday let anywhere in Norfolk and aren't sure what your website is loading behind the scenes, we're happy to take a look and tell you in plain English.