Cookie Banners and Consent: What a Business Site Needs

The rule behind the banner

In the EU the rule comes from Article 5(3) of the ePrivacy Directive, which each country puts into its own law. Storing information on a visitor's device, or reading information already stored there, is only allowed if the person has given consent after receiving clear and comprehensive information about the purposes. There are two exceptions: storage or access needed only to transmit a communication, and storage or access strictly necessary to provide a service the person has explicitly asked for.

The rule is about any storage or access, not just cookies. The UK regulator's guidance on storage and access technologies lists tracking pixels, link decoration, device fingerprinting, web storage and scripts or tags alongside cookies. And the consent itself has to meet the GDPR standard set out in the EDPB's Guidelines 05/2020 on consent: freely given, specific, informed and unambiguous. Our privacy policy and cookie consent basics guide explains what valid consent means and what goes in a privacy policy; this guide builds on it.

What changed in the UK in 2026

The UK's cookie rule is in the Privacy and Electronic Communications Regulations (PECR). After the Data (Use and Access) Act, the ICO finalised its new guidance on 29 April 2026. It now lists five exceptions to the consent requirement: communication, strictly necessary, statistical purposes, appearance and emergency assistance.

The statistical purposes exception (also called the analytics exception) matters most for business sites. It covers storage or access whose sole purpose is collecting statistical information about how your service or website is used, with a view to improving it. The ICO's examples include page visit totals, scroll depth, device types, A/B tests and page load speeds. It does not cover tracking or monitoring individual visitors, and it does not cover advertising: the ICO lists measuring whether someone viewed or clicked an advert as needing consent.

The appearance exception covers adapting how the site looks or works to the visitor's preference. For both of these, the ICO says you must give clear and comprehensive information and a simple, free way to object. One way it suggests is a toggle for that purpose in your consent tool, on by default, that people can switch off at any time. If someone objects, you must stop. These two exceptions are UK law and are not in the EU directive, so a site serving EU visitors still needs to check the rules in the relevant country.

What a fair banner looks like

The ICO's checklist for consent mechanisms and the EDPB cookie banner taskforce report (January 2023) point the same way:

• Reject is as easy as accept. The ICO's checklist asks that refusing is as easy as accepting, and its good example shows equally prominent "accept all" and "reject all" buttons with a "more options" button. A banner with only "accept all" and "more options" is its bad example. In the taskforce, a vast majority of EU authorities considered a banner without a reject option on any layer that has an accept button to be an infringement.
• Reject is a real button. The taskforce said a "refuse" or "continue without accepting" link buried in the banner text, or placed outside the banner, without enough visual weight to draw attention, does not lead to valid consent.
• No trick colours. The taskforce judges colours case by case, but called a reject button with unreadably low text contrast manifestly misleading.
• Off by default. Non-exempt options in the settings layer start switched off. The taskforce confirmed that pre-ticked boxes do not give valid consent.
• Choices by purpose. The ICO expects granular options for different purposes, such as analytics, advertising and embedded content, so people can say yes to one and no to another.
• No "by continuing you agree". The ICO's bad examples include a banner saying that continuing to use the site means consent, and one that tells people to change their browser settings to opt out.
• Honest categories. The taskforce flagged sites that label non-essential cookies as "essential", and said the legal basis for placing or reading cookies cannot be the site owner's legitimate interests.

What may load before a choice

Before the visitor answers, only exempt technologies should run. The ICO's examples of strictly necessary uses include remembering a shopping basket, keeping someone logged in during a visit, security for a service they asked for, and the cookie that remembers their consent choice. Advertising never qualifies: the ICO says there are no advertising purposes that meet the strictly necessary exception.

Embedded content needs care too. For a video hosted on another platform, the ICO says you should configure the embed so it does not set anything the moment the page loads, use a privacy mode where available, and tell people under the embed that pressing play will use storage and access technologies.

To test, open the site in a private window, ignore the banner and check cookies, storage and network requests in the browser's developer tools. Analytics or advertising activity before a choice needs fixing, unless it is analytics deliberately run under the UK statistical purposes exception.

Google tags and consent mode

If the site uses Google Analytics or Google Ads, Google's consent mode passes the visitor's choice to Google tags. Google says getting consent is your job, through your own banner or a consent management platform (CMP); many CMPs pass the choice to Google for you. Google's EU user consent policy also requires sites using its products to get valid consent from users in the EEA, the UK and Switzerland where the law requires it, and to keep records of it.

Consent mode has consent types including ad_storage, analytics_storage, ad_user_data (sending user data to Google for advertising) and ad_personalization. Google's setup guide says to set the defaults on every page before any tag sends data, for example:

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'analytics_storage': 'denied'
});

When the visitor makes a choice, the banner sends a gtag('consent', 'update', ...) command with the new values.

There are two ways to run it. In basic consent mode, Google tags are blocked until the visitor interacts with the banner, and nothing is sent to Google before then, not even the consent state. In advanced consent mode, the tags load straight away with consent denied by default and, while it stays denied, send measurements without cookies; Google uses these for more detailed conversion modelling. Advanced mode still sends data from the visitor's browser before any choice, so decide which mode to use with whoever advises you on privacy, not only on the measurement benefit.

Records, withdrawal and asking again

• Keep records. The ICO says you must be able to show that someone gave consent. A CMP can record choices; if a provider runs it for you, the ICO says to work out its role under the UK GDPR and have the right contract in place.
• Make it easy to change your mind. Withdrawing must be as easy as giving consent. The taskforce suggested a small, permanently visible icon or a link in a visible, standard place; a "cookie settings" link in the footer is common. When someone withdraws, the ICO says you must stop using the technologies, stop the related processing and tell any third parties involved.
• Do not nag. The ICO says not to keep asking people who have refused, and suggests six months as a general guideline before asking for fresh consent. You must ask again if you add tags or use cookies for a new purpose.

Visitors from the US

US state privacy laws mostly work through opt-outs rather than consent in advance. Under California's CCPA, covered businesses that sell or share personal information must offer ways to opt out, and the California Attorney General says a browser signal such as the Global Privacy Control must be honoured as a valid request to stop selling or sharing. Whether the CCPA applies depends on thresholds covered in our privacy basics guide. California also requires a conspicuously posted privacy policy, whatever your size; see our guide to website legal pages.

Checklist

• A list of every cookie, tag, pixel and embed on the site, with its purpose and owner.
• Nothing non-exempt runs before a choice; tested in a private window with developer tools.
• "Accept all" and "reject all" equally prominent on the first layer, plus settings by purpose, all off by default.
• If you rely on the UK analytics exception: a clear notice and a toggle or other simple way to object.
• Google consent mode defaults set before tags, and updates sent on every choice.
• Consent records kept; a footer link or icon to change choices; withdrawal actually stops the tags.
• The privacy policy matches the banner, and both are reviewed whenever a tool is added.

Consent choices affect what your reports show, so read our GA4 basics guide alongside this one, and our website launch checklist before a new site goes live.

Frequently asked questions

Do I need a cookie banner if I only use Google Analytics?

In the EU, analytics cookies generally need consent under the ePrivacy rules. In the UK, the ICO's 2026 guidance has a statistical purposes exception for analytics used only to produce aggregate statistics to improve your site, as long as you explain it clearly and give a simple way to object. It does not cover tracking individuals or advertising, so check how your analytics is configured.

Does the reject button have to be on the first screen?

The ICO's checklist says refusing must be as easy as accepting, and its good example puts accept all and reject all side by side. In the EDPB cookie banner taskforce, a vast majority of EU authorities treated a banner with no reject option on any layer that has an accept button as an infringement.

Is a cookie wall allowed?

The EDPB's consent guidelines say making access to content conditional on accepting cookies does not give a genuine choice, so the consent is not freely given. The ICO's guidance has a separate section on cookie walls and consent or pay models in online advertising; read it before using one.

What is the difference between basic and advanced consent mode?

In basic consent mode, Google tags are blocked until the visitor interacts with the banner and nothing is sent to Google before then. In advanced mode, tags load with consent denied by default and send measurements without cookies, which Google uses for more detailed modelling.

Want a consent setup that is fair to visitors and still gives you useful data? See how we approach website development, see all our services, or email info@creahive.com.