Does your small business website still need a cookie banner?

Probably yes. Since February 2026 UK law lets a website run basic analytics without asking for consent, but only when the data is used purely to improve your own site and visitors can opt out. Standard Google Analytics, advertising pixels and most embedded videos and maps do not meet that test, so most small business sites still need a banner. What changes is that a lean, well built site may not need one at all.

What changed in the UK cookie rules in 2026?

The rules on cookies come from the Privacy and Electronic Communications Regulations, usually shortened to PECR. The Data (Use and Access) Act 2025 amended them, and the cookie changes came into force on 5 February 2026 .

The Information Commissioner's Office, the UK data regulator, then published its final guidance on storage and access technologies on 29 April 2026 . "Storage and access technologies" is the ICO's term for cookies plus anything that does a similar job, such as tracking pixels, local storage and device fingerprinting.

Two things changed at once. There are new situations where you do not need consent, and the maximum fine for getting it wrong went from £500,000 to £17.5 million or 4% of global annual turnover .

Which cookies no longer need consent?

Five kinds of storage and access are now allowed without consent, according to Brodies' summary of the guidance . Two are old and three are new.

• Communication. What is needed to send a message across a network.
• Strictly necessary. What is needed to provide the service the visitor asked for, such as keeping items in a basket or keeping someone logged in. This must be necessary from the visitor's point of view, not just useful to you.
• Statistical purposes. New. Analytics used only to understand how your site is used, so you can improve it.
• Appearance. New. Adapting the site to the visitor's preferences or device, such as remembering a language choice, fitting the page to the screen or following a dark mode setting .
• Emergency assistance. New. Finding a device's location to send emergency help.

The statistical exception is the one that matters for most small businesses. Osborne Clarke lists the kind of measurement it covers: total visits, scroll depth, device types, browser versions, referral sources, page load speeds and exit pages. In other words, the numbers most owners actually look at.

Does Google Analytics fall under the analytics exception?

Standard Google Analytics usually does not. CookieYes puts it plainly: "Standard Google Analytics, in its default configuration, may not meet this exception" , because Google can use the data for its own purposes.

The reason is in the conditions. The ICO says a third party analytics provider can only be covered if it acts on your behalf as a processor and uses the information only to help you improve your service . Brodies summarises it as "the third party cannot use the information for its own purposes."

There is also a sole purpose rule. If a tool does one thing that qualifies and another that does not, such as analytics plus advertising audiences, consent is required for the whole thing . A Google Analytics property linked to Google Ads is the common example.

Privacy focused analytics tools that only count visits for you, and do not build profiles or share data for their own use, are much more likely to qualify. Check the provider's terms rather than its marketing page.

What you still have to do without a banner

Dropping the consent banner does not mean dropping the obligations. The exceptions for statistics and appearance do not remove transparency obligations , so two duties remain.

First, tell visitors clearly what you store and why. A cookie or privacy page that names your analytics tool and explains what it measures does this.

Second, give visitors a simple, free way to object, and stop when they do. CookieYes notes that if a user objects, the storage or access must stop immediately . A visible "turn off analytics" switch in the footer or on the cookie page is the usual answer.

If the analytics collect personal data, UK GDPR applies as well, and the ICO expects that data to be aggregated.

When does a small business website still need a cookie banner?

A small business website still needs a consent banner as soon as anything on it falls outside the five exceptions. In practice that means any of these:

• Google Analytics in its default setup, or linked to Google Ads
• A Meta, TikTok, LinkedIn or Google Ads pixel
• Embedded YouTube videos, Google Maps or social media feeds that set their own cookies
• Live chat or booking widgets that track visitors across sites
• Personalising content based on what someone has browsed before

The new exceptions do not apply to online advertising at all. The ICO has advised the government on a possible future exception for advertising, but nothing has changed in law yet.

Where a banner is still needed, the old standards still hold. Refusing must be as easy as accepting , which means "Reject all" as prominent as "Accept all", and nothing non essential loading until someone says yes.

A checklist for your own site

You can check most small business sites in under an hour with this list.

1. List what actually loads. Open your site in a private browser window, then look at the cookies and network requests in the browser's developer tools. Many sites carry scripts from old campaigns or plugins nobody remembers adding.
2. Sort each one. Strictly necessary, covered by the statistical or appearance exception, or needing consent.
3. Remove what you do not use. An old pixel from a campaign two years ago is risk with no benefit.
4. Decide on analytics. Either keep Google Analytics behind consent, or switch to a tool that genuinely acts only for you and run it under the exception.
5. Replace heavy embeds. A map or video can show a static preview and only load the real thing when someone clicks.
6. Update your cookie page. Name every tool, say what it does, and add the opt out switch.
7. Test the banner if you keep one. Click "Reject all" and confirm nothing non essential loads afterwards.

If everything ends up in the first two groups, you may be able to remove the banner entirely. That tends to be easier on a site built with this in mind than on one assembled from plugins, which is one of the things we plan for when we build websites and web apps .

How much is a cookie mistake likely to cost?

For most small businesses the realistic risk is a complaint and a letter from the ICO rather than a large fine. The higher ceiling still matters, because PECR has no small business exemption .

The ICO is also clearly paying attention. It reviewed the UK's top 1,000 websites and reports that 99% met its cookie checks by April 2026 , and it plans to keep testing. As large sites tidy up, smaller sites that still auto load trackers stand out more.

There is a commercial angle too. Every extra script slows your pages, and a banner is one more thing between a visitor and your phone number. A site that genuinely does not need one is faster and cleaner to use.

If you want a second pair of eyes on what your site is loading and whether you could drop the banner, book a free 15 minute call and we will tell you straight.

Frequently asked questions

Do I need a cookie policy if I remove the banner?

Yes. The analytics and appearance exceptions only remove the need for consent, not the need to explain what you store. You still need a clear page that names each tool, says what it does and tells visitors how to switch it off.

Does the cookie law apply to sole traders and very small businesses?

Yes. PECR applies to any website that stores or reads information on a visitor's device, whatever the size of the business behind it. There is no exemption based on turnover or headcount.

Is Google Consent Mode a way to avoid a cookie banner?

No. Consent Mode changes how Google tags behave depending on the visitor's choice, so it works alongside a consent banner rather than replacing one. It can reduce what Google collects before consent, but you still need to ask.

Do I need a banner if my site uses no cookies at all?

Not for consent, provided nothing else on the site stores or reads information on the device either. The rules cover pixels, local storage and fingerprinting as well as cookies, so check what your plugins and embeds load before you assume the site is clean.