Cookie Consent and UK Law: A Practical Guide

Almost every business website uses cookies, and almost every one needs some form of consent banner. But the rules are widely misunderstood, and a lot of sites are either over-doing it or quietly breaking the law.

This is a plain-English look at what UK law expects, written for business owners rather than lawyers. It is general guidance, not legal advice — but it will help you ask the right questions.

What the law actually says

In the UK, the rules come from the Privacy and Electronic Communications Regulations alongside UK GDPR. The short version: you can set strictly necessary cookies without asking, but for anything else — analytics, advertising, tracking — you generally need clear consent first.

Consent must be a positive action. Pre-ticked boxes do not count, and neither does carrying on browsing. Visitors also need to be able to say no as easily as they can say yes, which is why a banner with only an Accept button is not enough.

What consent mode does

Consent mode is a way for tools like Google Analytics and Google Ads to adjust their behaviour based on whether a visitor has agreed. If someone declines, the tools collect far less, relying on privacy-friendly modelling instead of personal data.

It matters because it lets you respect a visitor's choice while still getting some useful, anonymised insight. Done properly, your consent banner talks to your analytics and advertising tools so that no tracking fires until permission is given.

Getting it right without the annoyance

A good cookie banner is clear, honest, and easy to dismiss either way. Tell people what you use cookies for, give a genuine choice, and remember their decision so you are not asking on every page.

Pair it with a proper privacy and cookie policy that explains what you collect and why. If you use a consent management tool, keep it updated as you add new tracking. The aim is a setup that is compliant, respectful, and not a barrier to people actually using your site.