Most small business websites still need some form of cookie choice, but the rules are now more forgiving than they were. Cookies that make the site work, and basic analytics used only to count visits and improve the site, can be set without asking first, as long as you explain them and give visitors a simple, free way to switch analytics off. Anything used for advertising, cross-site tracking or social media pixels still needs clear opt-in consent, with "reject" as easy as "accept". Separately, if your site has a contact or quote form, you need a privacy notice that tells people what happens to their details.

The two sets of rules that apply

Two pieces of law sit behind this, and they cover different things.

  • PECR (the Privacy and Electronic Communications Regulations) controls storing or reading information on someone's device. That covers cookies, but also tracking pixels, device fingerprinting and similar tools. The ICO now calls these "storage and access technologies".
  • UK GDPR covers personal data: names, emails and phone numbers from your forms, plus anything in your analytics that relates to an identifiable person.

The Data (Use and Access) Act 2025 changed the cookie rules, and the ICO published its final guidance on storage and access technologies on 29 April 2026, incorporating those changes (ICO, 29 April 2026). If your banner was set up a few years ago, it is worth a fresh look.

What you can set without asking first

PECR now has five exceptions where you don't need prior consent (ICO, What are the exceptions?):

  1. Communication, for technology whose only purpose is transmitting a communication, such as load-balancing session cookies.
  2. Strictly necessary, for things the visitor has asked for, such as a shopping basket, staying logged in, security, or remembering their cookie choice.
  3. Statistical purposes, for analytics used only to understand how the site is used and improve it.
  4. Appearance, for adapting how the site looks or works to the visitor's preference, such as language choice or screen size.
  5. Emergency assistance, for locating someone who needs emergency help. Few business sites will use it.

The ICO is clear that "strictly necessary" is judged from the visitor's point of view, not yours. Advertising cookies are never strictly necessary, even if ads pay for the site.

For the statistical purposes and appearance exceptions there are two conditions. You must give clear information about what you use, and you must give people "a simple means of objecting, free of charge". The ICO suggests one way to do this is an analytics toggle in your cookie settings that is on by default and can be switched off at any time.

External fonts are a common example of the appearance exception. The ICO lists using an external font library to display your chosen font as likely to meet it, provided the provider uses the information only to serve that font and not for advertising or profiling. Some font services collect information about visitors, such as their IP address. Where that happens, you must say so and give visitors a simple, free way to object. The easy fix is to self-host your fonts: download them and serve them from your own server.

What the analytics exception covers, and what it doesn't

This is the part most small businesses care about, because it can remove the need for a consent pop-up just to see visitor numbers.

The ICO says the exception covers aggregate statistics about how your site is used, for example:

  • total visits page by page and how people move through the site;
  • scroll depth and clicks on sections of a page;
  • device, browser and operating system types;
  • how people arrived, such as from search, an email campaign or another site;
  • A/B tests comparing two versions of a page;
  • city or region-level location that can't identify anyone;
  • page speed, bounce rates and exit pages.

It does not cover monitoring individuals. You still need consent for recordings of individual visitor sessions (unless for security), for measuring whether someone saw or clicked an advert, for linking a visitor ID to a purchase and sharing that with advertising partners, and for profiling visitors by things like IP address or the pages they viewed.

You can use a third-party analytics tool under the exception, but only if the provider acts on your behalf as a processor, uses the information only to help improve your site, and doesn't combine it with other data. You also have to tell visitors you use that provider and what it does with the information (ICO, What are the exceptions?). In practice that means checking how your analytics tool is configured, particularly any advertising or audience features, rather than assuming the brand name settles it.

Several common additions to small business sites fall outside every exception:

  • Advertising pixels and conversion tracking, including ad measurement, frequency capping and retargeting. The ICO says no advertising purpose meets any exception.
  • Cross-site or cross-device tracking.
  • Social media pixels and tracking, which always need consent, whether or not the visitor is a member of that network.
  • Social media plugins, such as share or like buttons, unless you set them up so they only work for people logged in to that network.
  • Embedded videos and maps that set cookies as soon as the page loads. For video, the ICO suggests configuring the embed so nothing is set until the visitor presses play, using a privacy mode where available, and telling them underneath what will happen.

If you do need consent, the ICO's checklist for consent mechanisms is the benchmark (ICO, How do we manage consent in practice?). Your banner should:

  • make refusing as easy as accepting, with "reject" given the same prominence as "accept";
  • require a positive action to opt in before any non-exempt technology is set;
  • actually work, so nothing non-exempt loads before consent;
  • offer separate choices for different purposes, such as analytics, social media and advertising;
  • name the third parties involved;
  • tell people how to change their minds later, and let them withdraw as easily as they agreed.

The ICO's examples of bad practice include banners that say "by continuing to use our website, you consent" with only an "OK" button, and banners that tell people to change their browser settings to opt out.

Your privacy notice: the contact form matters too

Cookies get the attention, but most small business sites collect personal data through enquiry, booking or quote forms. UK GDPR requires you to tell people certain things when you collect their data. The ICO's list includes (ICO, What privacy information should we provide?):

  • who you are and how to contact you;
  • why you use the data, listing each purpose;
  • the lawful basis you rely on, and your legitimate interests if that is the basis;
  • who you share it with, including any processors such as your email, CRM or form provider;
  • details of any international transfers;
  • how long you keep the data, or the criteria you use to decide;
  • people's rights, including the right to complain to the regulator.

The ICO has flagged this page as under review following the Data (Use and Access) Act, so check it again before you finalise your wording.

A short line next to the form ("We'll use these details to reply to your enquiry. See our privacy notice.") with a link to the full notice is a sensible pattern. You can see how we do it in our own website privacy notice.

An afternoon audit for your own site

You can get a long way with a simple check:

  1. Open your site in a private browser window and, before clicking anything, look at which cookies and scripts load. Your browser's developer tools will show this.
  2. List every tool you find, such as analytics, chat widgets, ad pixels, video embeds, maps and fonts, and write down what each is for.
  3. Remove anything nobody uses any more. Old pixels from a past campaign are common.
  4. Sort the rest into exempt (necessary, aggregate analytics, appearance such as fonts) and consent-needed (advertising, tracking, social pixels, and social plugins that aren't limited to logged-in members).
  5. Check your banner against the ICO checklist above, then test that "reject" really stops the consent-needed tools from loading.
  6. Read your privacy notice next to your forms and confirm it names the services that actually receive the data.

If you are planning a rebuild anyway, it is far easier to design this in from the start. Our website services and small business website redesign guide cover how we approach it.

Frequently asked questions

Only if you use non-exempt technologies such as advertising pixels, social media pixels and tracking, social plugins that aren't limited to logged-in members of that network, or embeds that set cookies on load. If your site uses only necessary cookies and analytics that meet the statistical purposes exception, you need clear information and an easy way to object to analytics rather than an opt-in pop-up.

Is my analytics tool covered by the new exception?

It can be, if it only produces aggregate statistics to improve your site, the provider acts as your processor and doesn't combine the data with anything else, and you tell visitors about it and let them object. Advertising features, conversion sharing and visitor profiling take it outside the exception.

Can I use pre-ticked boxes or "by continuing you agree" wording?

No. The ICO expects a positive action to opt in before non-exempt technologies are set, and gives "by continuing to use our website" banners as an example of bad practice.

Does a simple contact form need a privacy notice?

Yes. If the form collects names, emails or phone numbers, UK GDPR requires you to explain who you are, why you use the data, your lawful basis and who receives it.

Sources

  • ICO, Final storage and access technologies guidance published (29 April 2026): https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/04/final-storage-and-access-technologies-guidance-published/
  • ICO, What are the exceptions? (storage and access technologies guidance): https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions
  • ICO, How do we manage consent in practice?: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-we-manage-consent-in-practice/
  • ICO, What privacy information should we provide?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide
  • ICO, The Data (Use and Access) Act 2025: what does it mean for organisations?: https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations