Cookie banners and UK GDPR for small business websites.

This guide explains the basics in plain English. It isn’t legal advice. If you handle sensitive data, such as health information, or you’re unsure about your situation, check the Information Commissioner’s Office (ICO) guidance or speak to a professional.

Two sets of rules apply to most UK websites:

• UK GDPR and the Data Protection Act 2018 cover how you collect and use personal information, such as names, emails and phone numbers from your contact form.
• PECR (the Privacy and Electronic Communications Regulations) covers cookies and similar technologies, as well as electronic marketing such as emails and texts.

The ICO is the UK regulator for both.

Under PECR, you generally need consent before setting cookies that aren’t strictly necessary for the site to work. That usually includes:

• Analytics, such as Google Analytics.
• Advertising and tracking pixels, such as Meta or Google Ads.
• Some embedded content, such as videos or maps, that sets its own cookies.

Strictly necessary cookies, for example those that keep a shopping basket working, don’t need consent, though you should still explain them.

So if your site uses analytics or ad tracking, you’ll usually need a consent banner. If it genuinely uses no non-essential cookies, you may not need one at all.

• A real choice: accepting and rejecting should be equally easy. “Reject” shouldn’t be hidden behind extra clicks.
• No pre-ticked boxes.
• Nothing non-essential loads before consent. This is where many sites go wrong: the banner appears, but the tracking has already started.
• Clear wording about what each type of cookie does.
• A way to change your mind later, for example a link in the footer.

Keep it short and calm. A huge banner covering the whole page annoys visitors and hurts conversions.

If your site collects any personal information, including through a contact form, you need a privacy notice that explains, in plain language:

• Who you are and how to contact you.
• What information you collect and why.
• Your lawful basis for using it.
• Who you share it with, such as your email provider or booking system.
• How long you keep it.
• People’s rights, such as access and deletion, and how to complain to the ICO.

Link to it from your footer and near your forms.

• Only ask for what you need. Name, a contact method and a message are often enough.
• Don’t add people to a marketing list just because they sent an enquiry.
• Make sure form emails go somewhere secure, and delete old enquiries you no longer need.
• Use a spam filter that doesn’t make the form hard to use.

If you send marketing emails or texts:

• You generally need consent, though there’s a “soft opt-in” for existing customers who bought, or negotiated to buy, similar products and were given a chance to opt out.
• Every message needs a simple way to unsubscribe.
• Keep a record of how and when people signed up.

Rules for contacting businesses differ in some respects from rules for contacting individuals, so check the ICO guidance if you market to other businesses.

• Analytics loading before anyone clicks “Accept”.
• “Reject” hidden or missing.
• A copied privacy policy that doesn’t match what your site actually does.
• Forms that collect far more than needed.
• No record of marketing consent.

These are easy to fix when a site is built or redesigned. On every site I build, I keep tracking to a minimum and set up a clear privacy notice. If your current site needs tidying up, a website redesign or a new website is a good moment to get it right.

• Open your website in a private browser window. Does anything track you before you choose?
• Is “Reject” as easy to click as “Accept”?
• Is there a link to change cookie choices later?
• Does your privacy notice list the tools you actually use, such as your email provider, booking system and analytics?
• Does your contact form link to the privacy notice?
• Can you find and delete an enquiry if someone asks you to?

If you answer no to any of these, that’s where to start.

One practical way to reduce cookie headaches is to use fewer tracking tools. Many small businesses install several analytics and advertising scripts they never look at. Removing unused ones makes your site faster, your banner simpler and your privacy notice shorter.

Some privacy-focused analytics tools are designed to work without cookies or personal data. Check their documentation and the ICO’s guidance to understand whether they need consent in your set-up.

Privacy isn’t a one-off task. Each time you add a new tool to your website, such as a booking widget, a chat assistant, an embedded map or a new advertising pixel, ask three questions:

• Does it set cookies or collect personal information?
• Does it need consent before it loads?
• Does my privacy notice mention it?

Review your cookie banner and privacy notice at least once a year, and whenever you change suppliers. It takes less time than fixing a problem after a complaint, and it keeps your website trustworthy for visitors.

• Non-essential cookies, such as analytics and ads, generally need consent first.
• Make rejecting as easy as accepting, and load nothing before consent.
• Keep a plain-English privacy notice that matches what your site really does.
• Only collect the information you actually need.
• Check the ICO’s guidance, and get professional advice if you handle sensitive data.