Privacy Policy and Cookie Consent Basics

Which rules apply to you

• UK: the UK GDPR and the Data Protection Act cover personal data. A separate law, the Privacy and Electronic Communications Regulations (PECR), covers cookies and similar technologies. The regulator is the Information Commissioner's Office (ICO).
• EU: the GDPR covers personal data, and national laws based on the ePrivacy Directive cover cookies. The European Data Protection Board (EDPB) publishes guidance shared by all EU regulators.
• California: the California Consumer Privacy Act (CCPA), as amended by the CPRA, applies to businesses that meet certain thresholds (see below).

A business outside a region can still be covered. The ICO notes, for example, that an organisation based outside the UK that monitors or offers services to people in the UK may need a UK representative. UK rules are also changing: the ICO says its guidance is under review because of the Data (Use and Access) Act, so check its current pages.

What a privacy policy must say

A privacy policy (or privacy notice) tells people what you do with their data. The ICO's guidance on what privacy information to provide lists what you must always include when you collect data from people:

• Your organisation's name and contact details.
• The purposes for using the data, such as answering enquiries, processing orders or sending newsletters, with each purpose made clear.
• The lawful basis for each purpose, for example consent, a contract, or legitimate interests.
• How long you keep the data, or the criteria you use to decide.
• People's rights, such as access, correction, erasure and objection. The right to object must be brought to their attention clearly and separately.
• The right to complain to a supervisory authority.

Depending on your situation, you also need to name who you share data with (including service providers such as your email or analytics tools), any transfers outside the UK or EU and the safeguards for them, how to withdraw consent, and your data protection officer if you have one. Describe what your site really does: a copied template rarely matches your forms and tools.

Cookies: the basic rule

The ICO's guide to cookies and similar technologies sets out the basic rule. You must:

1. tell people the cookies are there;
2. explain what the cookies are doing and why; and
3. get the person's consent to store a cookie on their device.

The rule covers any technology that stores or reads information on a visitor's device, not only cookies, and it also applies to apps.

Which cookies need no consent

The ICO describes two exemptions: cookies used only to carry out the transmission of a communication, and cookies that are strictly necessary to provide a service the user has requested. It must be essential to the user's request. Cookies that are helpful or convenient, or only essential for your own purposes, still need consent. The ICO gives these examples of cookies unlikely to need consent:

• remembering what a visitor has put in their shopping basket;
• security cookies essential for a service the user has asked for, such as online banking;
• load-balancing cookies that spread traffic across servers.

The ICO says it is still good practice to tell users about these cookies. Analytics and advertising cookies are not on this list. The ICO is revising this guidance after the Data (Use and Access) Act, so check its current pages for any change to analytics cookies.

What valid consent looks like

Under both the ICO guidance and the EDPB's Guidelines 05/2020 on consent, consent must be freely given, specific, informed and unambiguous, and given by a clear positive action. In practice, for a cookie banner:

• No cookies before consent. The ICO says you cannot set non-essential cookies on your homepage before the user has consented.
• No pre-ticked boxes. The EDPB says pre-ticked opt-in boxes are invalid, and silence or simply carrying on using a service is not consent.
• Scrolling is not consent. The EDPB says scrolling or swiping through a page will not under any circumstances count as a clear and affirmative action.
• No cookie walls. The EDPB says that blocking access to content unless the visitor clicks "Accept cookies" does not give a genuine choice, so the consent is not freely given.
• Easy to change. The ICO says users should be able to enable or disable non-essential cookies easily, and the ICO's privacy guidance says consent must be as easy to withdraw as it is to give. A link to cookie settings in the footer is a common way to do this.

California: CCPA

The California Privacy Protection Agency's FAQ says the CCPA applies to for-profit businesses that do business in California, decide why and how personal information is processed, and meet any of these thresholds:

• gross annual revenue of $26.625 million or more in the preceding calendar year (the figure effective from 1 January 2025);
• buying, selling or sharing the personal information of 100,000 or more California residents or households; or
• deriving 50% or more of annual revenue from selling or sharing California residents' personal information.

The California Attorney General's CCPA page lists the rights it gives consumers: to know what is collected and how it is used and shared, to delete, to correct, to opt out of the sale or sharing of their information, to limit use of sensitive information, and not to be discriminated against for using these rights. Covered businesses that sell or share personal information must provide a clear "Do Not Sell or Share My Personal Information" link, and the Attorney General says a browser opt-out signal such as the Global Privacy Control (GPC) must be honoured as a valid request.

Unlike the UK and EU cookie rules, the CCPA works mainly through opt-outs rather than consent in advance. If you meet a threshold and sell or share personal information, you need the opt-out link and must honour GPC signals.

Handling requests from people

People can ask to see, correct or delete their data. The EDPB's data protection guide for small business advises being prepared with a simple procedure, making it easy for people to know their rights and how to contact you, and answering within one month. If you need more time, tell the person within that month. Know where your site's data lives: form submissions, the database, your inbox and your newsletter tool.

Putting it into practice on your site

1. List what the site collects: forms, orders, analytics, embedded videos and maps, chat and advertising tags. Check the cookies it actually sets.
2. Write the privacy policy from that list, and link it in the footer and next to every form.
3. Set up consent properly. Load non-essential tags only after consent. Make "reject" as easy as "accept", and keep a link to change settings.
4. Make the banner usable with a keyboard and a screen reader, and on a phone. Our guide to website accessibility basics covers the essentials.
5. Review it when the site changes, such as a new plugin, form or marketing tool. Our website launch checklist includes a privacy and consent check before go-live.

Frequently asked questions

Does a small business website need a privacy policy?

If it collects personal data, through a contact form, sign-up, order or analytics, UK and EU GDPR require you to tell people what you collect, why, how long you keep it and their rights. A privacy policy is the usual way.

Do I need a cookie banner if I only use analytics?

Under the ICO's current cookie guidance, analytics cookies are not among the exemptions, so they need consent. The ICO is revising its guidance after the Data (Use and Access) Act, so check its current pages.

Can I just say that continuing to use the site means consent?

No. Both the ICO and the EDPB say consent needs a clear positive action. Simply continuing to use a site, scrolling or staying silent does not count, and pre-ticked boxes are invalid.

Does the CCPA apply to my business?

Only if you are a for-profit business doing business in California that meets at least one threshold: revenue of $26.625 million or more, buying, selling or sharing the data of 100,000 or more California residents or households, or earning 50% or more of revenue from selling or sharing their data.

Is this guide legal advice?

No. It summarises official guidance to help you understand the basics. Your obligations depend on your business, your data and where your visitors are, so check the details with a qualified adviser.

Want your forms, analytics and consent set up so they match what your privacy policy says? See how we handle website development and website care, or email info@creahive.com. We set up the technical side. For the wording of your policy, talk to a legal adviser.