Cookie banners explained: do you need one?

Cookie banners feel like pointless friction, a box everyone clicks “accept” on without reading. But they exist for a real reason: UK and EU law says you must ask before you track. The genuinely tricky part isn’t the banner itself, it’s knowing which of your cookies actually need consent, and most owners are surprised to learn that running Google Analytics alone puts them on the hook.

You need a cookie banner if your website sets any non-essential cookies, such as analytics, advertising, or embedded media, for visitors in the UK or EU. If your site only uses strictly necessary cookies, you don’t legally need one.

What a cookie banner is for

A cookie banner is the consent notice that asks visitors whether they agree to non-essential cookies before those cookies run. Two UK laws apply:

• PECR (Privacy and Electronic Communications Regulations), governs cookies and tracking.
• UK GDPR, governs the personal data those cookies collect.

The EU equivalent is the ePrivacy Directive plus EU GDPR. Same principle: consent first, tracking second.

Which cookies actually need consent

This is where most sites get it wrong. “Strictly necessary” is a narrow category, not a loophole:

If you run Google Analytics, the Meta Pixel, or embed a YouTube video, you’re using non-essential cookies. That means you need a banner.

When you genuinely don’t need one

You can skip the banner only if every cookie you set is strictly necessary. In practice that means:

1. A simple brochure site with no analytics, no tracking pixels, and no embedded third-party content.
2. A site that uses only session cookies for core function, like a login or basket.

The moment you add Analytics to measure visits, which nearly every business wants, you cross the line. See things every website needs for where tracking usually creeps in.

How to do it properly

A compliant banner isn’t just a single “OK” button. The ICO has been clear that Reject must be as easy as Accept:

What it costs to get wrong

The headline penalty under UK GDPR is up to £17.5m or 4% of global turnover. The ICO rarely throws that at a small business, it usually warns first. The realistic risks for a small firm:

• Complaints to the ICO from privacy-aware visitors.
• Lost trust when people see tracking they didn’t agree to.
• Trouble if a larger partner or client audits your compliance.

This sits alongside the wider privacy picture, read what GDPR means for websites for the bigger obligations like privacy policies and data requests.

Cookie consent is fiddly because the cookies hide inside plugins, fonts and embeds you may not even know are running. We audit the full cookie list on the sites we manage, set up a compliant consent banner that blocks tracking until visitors agree, and keep a plain-English cookie policy in place, part of the done-for-you website service so you’re not left guessing.

Start with an honest audit: open your own site, check what loads before you click anything, and if analytics or pixels fire on arrival, your banner needs fixing.