Cookie Consent Banners: What UK Law Actually Requires

Cookie banners are one of the most misunderstood bits of website compliance – most business owners know they need “one of those,” without being entirely sure what it actually has to do. Here’s the plain-English version.

What cookies are, briefly

Cookies are small files a website stores in a visitor’s browser – used for things like remembering login details, tracking visits for analytics, or powering advertising. Some are essential for the site to function; many others exist purely to gather data about the visitor.

What the law actually requires

Under UK data protection rules (built on the Privacy and Electronic Communications Regulations, alongside UK GDPR), non-essential cookies – most analytics and advertising cookies – require the visitor’s clear, informed consent before they’re set, not just a notice telling them cookies exist. Consent has to be a genuine choice, which means “accept” and “reject” need to be equally easy to select.

Where most banners go wrong

• A prominent “Accept All” button next to a hidden or fiddly way to decline
• Cookies being set before the visitor has made any choice at all
• No easy way to change your mind later
• No actual record kept of what was consented to and when

What a properly compliant setup looks like

Non-essential cookies (analytics, marketing, embedded video trackers) blocked by default until consent is given. A banner that offers “Accept,” “Reject” and ideally “Manage preferences” with equal visual weight. A record of consent kept, so you can demonstrate compliance if ever asked. A simple way for visitors to revisit and change their choice later.

This isn’t just a legal box to tick

Getting this right also builds trust – visitors increasingly notice when a site handles their data thoughtfully, and a clumsy, manipulative cookie banner is a small but real dent in first impressions.

What to check on your own site today

Open your site in a private browser window. Does anything load before you’ve made a cookie choice? Is declining actually as easy as accepting? If either answer is uncomfortable, it’s worth sorting sooner rather than later.

Every site under ChrisXCreative’s Compliance service includes a properly configured cookie consent system with a consent log kept automatically, so you’re covered without having to think about it. Get in touch if you’d like your current setup reviewed.