What Is a Cookie Banner and Do You Need One on Your UK Website?

A cookie banner — also called a cookie consent notice or cookie pop-up — is the notification that appears when a visitor arrives on your website, asking for their permission to set cookies on their device. You’ve seen them on almost every website you’ve visited; they’ve become a near-universal feature of the modern web.

But why are they required, what exactly do they need to say, and do all UK websites actually need one? Here’s a straightforward explanation.

What Are Cookies and Why Do They Need Consent?

Cookies are small text files that websites place on a visitor’s device to store information. Some cookies are essential — they keep you logged in, remember your shopping cart, or enable basic site functionality. Others are non-essential: analytics cookies that track your behaviour across the site, advertising cookies that build a profile of your interests, or personalisation cookies that remember your preferences.

UK law — specifically the Privacy and Electronic Communications Regulations (PECR), updated following the UK’s departure from the EU — requires that website operators obtain informed consent from visitors before setting non-essential cookies. “Informed” means the visitor must understand what cookies are being set, why, and who has access to the data, before they agree.

Essential cookies — those strictly necessary for a service the user has requested — are exempt from the consent requirement. You don’t need permission to set a cookie that keeps a user logged in or maintains their session. Every other category requires consent.

What a Compliant Cookie Banner Must Include

A compliant cookie banner must give visitors a genuine choice. This means providing a clear option to accept non-essential cookies, an equally prominent option to reject or decline them, and — if you use multiple categories of cookies — the ability to accept some categories while declining others. Pre-ticked boxes and consent buried in your privacy policy do not satisfy the requirements.

The banner must also link to a full cookie policy that explains what categories of cookies you use, what each cookie does, how long it lasts, and who sets it (first-party or third-party). Hiding this information or making it difficult to access invalidates the consent you collect.

Critically, non-essential cookies must not be set before consent is given. A banner that appears after analytics cookies are already loaded on the page is not legally compliant, regardless of what it says. The technical implementation matters as much as the wording.

Choosing a Cookie Consent Tool

For most small business websites, a cookie consent management platform (CMP) is the most practical solution. Tools like Cookiebot, CookieYes, and Usercentrics scan your website, categorise the cookies in use, generate a compliant banner, and block non-essential cookies until consent is given. Many integrate directly with Google Analytics and Google Tag Manager.

Free tiers exist for smaller websites. Cookiebot’s free plan covers sites with up to 50 pages; CookieYes offers a generous free tier for small sites. Paid plans typically add features like detailed consent logs, multi-language support, and deeper analytics integrations.

Avoid building a custom cookie banner from scratch unless you have specialist legal and technical expertise. The compliance requirements are nuanced and evolving — a dedicated CMP tool is updated to reflect regulatory changes in a way that a custom solution likely won’t be.