Does my website need a cookie banner?

20 October 2026

The short answer

You need visitors to agree before your site stores or reads anything on their device, unless it is for one of a handful of purposes the law allows without asking. Advertising, tracking pixels and most social media embeds still need consent. Since 5 February 2026, simple statistics about how your own site is used do not, as long as you tell people and give them an easy way to say no.

So a brochure site with no adverts, no tracking and simple visit counts can usually do without a banner. A site running advertising pixels cannot.

This is a plain guide, not legal advice. If a lot rides on it, check with a solicitor or the ICO.

It is not only about cookies

The rule, in the Privacy and Electronic Communications Regulations, covers anything that stores or reads information on a visitor's phone or computer: cookies, local storage, tracking pixels and device fingerprinting. The ICO now calls them all "storage and access technologies". Swapping cookies for something else does not get round it.

When you do not need to ask

The ICO lists five exceptions. Three matter for most small business sites.

• Strictly necessary. Things the site cannot work without for something the visitor asked for, such as keeping a basket full or keeping someone signed in.
• Statistics. Counting how your site is used so you can improve it. The results must be totals that cannot identify anyone, nobody may be profiled or followed from site to site, and any company that helps must work only for you. You still have to explain it and offer a simple, free way to object.
• Appearance. Remembering a choice the visitor made about how the site looks or works, such as text size or dark mode. Again, explain it and let people object.

The other two, sending a message across a network and helping in an emergency, rarely apply to a business website.

When you still need a banner

• Advertising and retargeting pixels, including the ones that measure whether your adverts worked.
• Analytics that follow individual visitors, build profiles, or that the provider also uses for its own purposes.
• Embedded content from other sites, such as videos, maps and social posts, when it sets its own tracking. Many offer a privacy mode, or you can load them only when someone taps to play.

Getting it wrong became more expensive too. From 5 February 2026 the maximum fine for breaking these rules rose to £17.5 million or 4% of worldwide turnover, the same as data protection law.

Check your own site

Three questions about what your site runs. If you are not sure, whoever built it will know.

If you do need a banner, what it has to do

• Nothing loads first. Pixels and trackers wait until the visitor says yes.
• Saying no is as easy as saying yes. A Reject button as plain and as close as Accept, not hidden behind a settings page.
• No boxes ticked in advance, and carrying on scrolling does not count as agreeing.
• Clear about what each thing is for, and who else gets the data.
• Easy to change your mind later, with a link that is always there, usually in the footer.

How this site does it

This site sets no cookies and runs no advertising or tracking. It counts visits as anonymous daily totals, with no visitor id and nothing stored on your device, so there is nothing to agree to. The only thing it remembers is that you closed the notice saying so. For most small business sites, that is a simpler and cheaper place to be than a banner.

If you want help working out where your own site stands, that is part of our security and compliance advice. We tell you what we find and what to change first; we do not give legal advice.

Where this comes from

• The five exceptions and their conditions: the ICO's guidance on storage and access technologies.
• The change in the law and its start date: section 112 of the Data (Use and Access) Act 2025, in force from 5 February 2026.
• The higher maximum fine: PolicyPros' guide to the cookie changes.