Is a cookie banner legally required on my website?

Short answer

Yes, if your website sets any non-essential cookies — including analytics, advertising, or social media tracking cookies. PECR requires prior, informed consent before those cookies are set. Strictly necessary cookies, such as session cookies that make the site work, do not need consent, so a site using only those needs no banner.

The legal test is not whether you have a website — it is whether your website sets non-essential cookies. Under the Privacy and Electronic Communications Regulations (PECR), any cookie that is not strictly necessary for the site to function requires prior, informed, and freely given consent from the visitor before it is set.

Which cookies need consent

Analytics cookies — including Google Analytics — are not strictly necessary and need consent, even if you only use one.
Advertising and remarketing cookies (Google, Meta and LinkedIn pixels) always need consent.
Social media embeds that set tracking cookies need consent.
Strictly necessary cookies — session cookies, shopping basket cookies, security cookies — do not need consent, though you must still tell users about them in your cookie or privacy notice.

So a brochure site with no analytics and only functional cookies does not need a banner at all. And some "cookieless" analytics tools, which use anonymised first-party data without setting tracking cookies, are designed to work without a consent banner — that is the main legitimate route to a banner-free site while keeping visitor statistics.

What a compliant banner looks like

If you do need consent, it must be real consent. The ICO is clear that pre-ticked boxes and "by continuing to browse you accept cookies" implied consent do not comply. Your consent tool must not use dark patterns that push people towards "accept all" — rejecting non-essential cookies should be as easy as accepting them, and cookies must not fire until the visitor has actually made a choice.

Alongside the banner, your site needs a privacy policy that accurately describes what data you collect, why, who you share it with, and how long you keep it — a generic template that does not match what your business actually does is not compliant. Review both at least annually and whenever you add a new tool.

Read the full guide: Privacy Policy and CookiesCovers eligibility, the process, deadlines, and next steps in depth.

Related guides

Data Protection Basics for SMEs

Almost every UK business handles personal data — whether collecting customer email addresses, managing employee records, or running a mailing list. UK GDPR and the Data Protection Act 2018 impose legal obligations on all organisations that handle personal data, regardless of size.

7 min

Small Business Compliance Checklist

Keeping on top of compliance as a small business owner can feel overwhelming. This checklist brings together the key obligations across company law, tax, employment, data protection, and health and safety so you can identify any gaps in your compliance.