Does My Website Need a Cookie Banner? The UK Small Business Guide

If you have ever landed on a website and been greeted by a pop-up asking you to accept cookies, you have already seen cookie consent in action. But if you run a small business website, you might be wondering whether you actually need one of those banners yourself, or whether it is just something the big companies do.

The short answer is: probably yes. But the longer answer is a bit more nuanced, and getting it wrong is more common than most business owners realise.

What actually is a cookie?

Before we get into the legal stuff, it helps to understand what a cookie actually is. A cookie is a small file that gets stored on a visitor's device when they land on your website. That file can track all sorts of things, from whether someone is logged in, to what they put in their shopping basket, to which pages they visited and how long they stayed.

Some cookies are essential. If you run an ecommerce store, you need cookies to keep track of what someone has added to their basket. If your site has a login, cookies keep users logged in as they move between pages. These kinds of cookies are necessary for the site to function.

But other cookies go further. Google Analytics, for example, uses cookies to track visitor behaviour across your site and across the web. Facebook Pixel does the same, sending data back to Facebook so it can target ads at people who visited your site. These are not essential to your site working. They are tracking tools, and under UK GDPR, using them without the right consent is a compliance issue.

What does UK law actually say?

The rules around cookie consent in the UK come from two places: the UK GDPR and the Privacy and Electronic Communications Regulations, usually called PECR. Between them, they set out when you need consent and what that consent has to look like.

The basic rule is this. If your website uses any cookies that are not strictly necessary for the site to function, you need to tell visitors about them and give them a genuine choice about whether to accept them.

That means a few things in practice. You cannot drop tracking cookies before someone has given their consent. You cannot pre-tick the accept box and call that consent. And you have to make it just as easy to say no as it is to say yes.

The Information Commissioner's Office, which is the UK regulator that enforces these rules, is pretty clear on this. Consent must be freely given, specific, informed and unambiguous. A banner that says "by continuing to use this site you agree to our cookie policy" does not meet that standard.

So when do you actually need a cookie banner?

You need a cookie banner if your site uses any of the following:

• Google Analytics or any other analytics tool. Even if you are just using it to see how many people visit your site, it uses tracking cookies that require consent.
• Facebook Pixel or any other advertising or remarketing tracker. These are some of the most commonly found tracking scripts on small business websites, and almost none of them have proper consent in place.
• Any live chat tools like Intercom or Tidio. Most of these set their own cookies.
• Social media embeds, like a Facebook feed or a YouTube video embedded on your site. These can set third party cookies even if you did not deliberately add a tracker.
• Affiliate tracking scripts. If you run an affiliate programme or use one, the tracking usually relies on cookies.

If your site genuinely only uses essential cookies, for example a simple brochure site with no analytics and no third party scripts, you might not need a full consent banner. But in practice, most business websites use at least one of the tools above, which means most business websites do need one.

What does a compliant cookie banner actually look like?

This is where a lot of businesses go wrong. Slapping a banner on your site that says "we use cookies" is not enough. A compliant cookie banner needs to do several things.

It needs to explain what cookies you use and why. It needs to give visitors a genuine choice to accept or decline non-essential cookies. It needs to record that consent so you can demonstrate it if the ICO ever asks. And it needs to let people change their mind, which means having a way to update cookie preferences after the initial choice.

The banner also needs to appear before any non-essential cookies are loaded. This is a technical point that a lot of banner implementations get wrong. If your Google Analytics tag fires the moment someone lands on your page, before they have had a chance to click accept, you are already in breach regardless of whether you have a banner at all.

What happens if you get it wrong?

The ICO has the power to fine businesses up to £17.5 million for serious GDPR violations, though in practice most fines handed out to small businesses are much lower. What is more likely for a small business is a formal warning or enforcement notice, which requires you to fix the issue within a set timeframe.

What often catches small business owners off guard is that complaints can come from anyone. Any visitor to your site can report you to the ICO for free, and the ICO is required to investigate. Last year alone the ICO received over 35,000 complaints. You do not have to be a big company to be on the receiving end of one.

How do you know if your cookie setup is actually compliant?

Honestly, this is hard to assess yourself because it involves both what is visible on your site and what is happening under the hood technically. A banner that looks fine on the surface can still be non-compliant if it is loading trackers before consent is given, or if it does not properly block cookies when someone declines.

The most reliable way to check is to scan your site properly. At ClearlyCompliant we built a free GDPR compliance checker specifically for UK businesses that checks your cookie consent setup as part of a full 23-point scan. It looks at whether you have a banner, whether you have a cookie policy, whether tracking scripts are present, and a range of other factors that the ICO looks for.

You can run a free scan at clearlycompliant.co.uk and get your results in minutes. If your cookie setup has gaps, the scan will flag them so you know exactly what needs fixing.

The bottom line

If your website uses Google Analytics, Facebook Pixel, or any other third party tracking tool, you need a cookie banner. Not a basic notice, but a proper consent mechanism that gives visitors a real choice and does not load trackers until they have said yes.

It is one of the most commonly failed checks we see when scanning UK business websites, and it is also one of the easiest to fix once you know the problem is there. The first step is knowing where you stand.