Cookie banner UK: do you need one in 2026 and how to design it

Most UK sites with advertising tags still need a cookie banner in 2026. Some sites can drop it. Since 5 February 2026, strictly limited first-party analytics no longer needs opt-in consent, according to PolicyPros' guide to the changes. Advertising pixels still do.

If you need a banner, make it plain: one layer, equal buttons for accept and reject, and no blocking of the page. Expect fewer people to accept. That affects your tracking data far more than it affects your sales, though we found no solid research on small-business conversion either way.

Do you still need a cookie banner in 2026?

The law behind this is PECR, the UK rules on storing or reading information on someone's device. The Data (Use and Access) Act 2025 changed it. A law-firm summary reports that the ICO published its finalised guidance on 29 April 2026. The new exemptions and higher fines took effect on 5 February 2026, says PolicyPros.

The ICO's page lists five exceptions to the consent rule: communication, strictly necessary, statistical purposes, appearance and emergency assistance. Here is how that works in practice.

What needs no consent

• A basket or checkout cookie that remembers goods. The ICO calls this strictly necessary.
• First-party analytics used only to improve your own service. PolicyPros says this needs clear information and a simple, free way to object.

What still needs consent

• Advertising. The ICO says advertising purposes "are not exempt from PECR's consent requirements and never have been".
• Cross-site and social media tracking, which the ICO also says need consent.
• Analytics that shares data with a third party for its own purposes, per PolicyPros.

So if you run a Meta pixel, Google Ads tags or similar, you need a banner. If you only run limited first-party analytics and a basket cookie, you may not. Check the settings of each tool before you decide.

The stakes have risen. PolicyPros reports the maximum PECR fine went from £500,000 to £17.5 million or 4% of worldwide turnover, whichever is higher. That figure comes from a secondary summary, so check it against the Act if it matters to you. The ICO has also been active: a law firm reports that its first sweep of 200 top UK websites led to 134 being contacted, and the review then extended to the top 1,000 sites.

What a compliant banner must do

Check the ICO's guidance chapter on consent mechanisms for the exact wording. The working rules below follow the ICO's approach, and our checklist treats them the same way.

• Offer "Reject all" as easily as "Accept all". Same layer, same size, same prominence.
• Leave optional boxes unticked.
• Set no optional cookies or tags until the visitor agrees.
• Make it as easy to withdraw consent as it was to give it.

How banner design changes what visitors choose

Design shapes the answer. In a USENIX Security 2024 experiment with 3,947 participants in France, a design that highlighted the decline option had a substantial effect on decisions, and it carried over to later choices.

A CHI 2023 study of 14 consent interfaces, with US and UK participants, found the first set of options on the banner had the largest effect. UK participants felt more negative about the process, and mobile users understood the information less.

Wording matters too. A CHI 2022 study of 1,557 participants found it changes opt-out rates. It also cites earlier work in which just 0.4% of users opted out under a common banner design.

Banners that block the page push people to accept. A 2025 literature review reports higher acceptance when banners blocked content, with users accepting quickly to remove the text and often not reading it. That may look good in your numbers. It is not real consent, and it is the kind of lopsided design regulators dislike.

Does the banner cost you sales or enquiries?

We found no primary data on how banners change a small business's conversion rate. Anyone who gives you a firm figure is guessing. The evidence points to two separate effects.

1. Lost tracking. More visitors reject, so your ad platforms and analytics see fewer of them.
2. Friction. A banner that covers a form, a buy button or the first screen can stop a visitor acting at all.

The first is a measurement problem. The second is a real UX problem you can fix. Our guide to why a website isn't converting covers other causes to rule out.

For scale, trade press on UK publishers is the only source we found. Digiday and Press Gazette reported that adding a Reject all button raised non-consent by about 20% for one publisher, and that up to 20 to 25% of users click reject all. Both articles are older, from around 2023, and cover news ad audiences. Treat them as anecdotes, not as figures for your shop.

What happens to your analytics when people reject

Analytics is the most common tracking category, found on 64% of websites in the 2025 Web Almanac. Google Analytics is on 53% of sites and Facebook Pixel on 16%. Many of you will have gaps in this data.

• Visits will look lower than they are, because rejecting visitors go unseen.
• Ad platforms will report fewer conversions, so campaigns can look worse than they are.
• Compare trends over time rather than treating one number as exact.
• Use figures you hold regardless of consent: orders in your shop, enquiries in your inbox, calls logged on your phone.

The new exemption may help. If you use first-party analytics solely to improve your service, and you tell visitors and let them object easily, you may recover some of that data without consent. Check your tool's settings first, because many send data on for the provider's own use, which still needs consent. Our guide to what a good conversion rate looks like explains how to read the numbers you do have.

Designing the banner well

• Use one layer. Put Accept all and Reject all side by side, in the same style.
• Keep it small. A strip at the bottom of the screen is enough. Don't cover the headline or the main button.
• Don't block the page. Let people scroll and read while they decide.
• Test it on a phone. The CHI 2023 study found mobile users understood banners less, so keep the words short.
• Never cover a checkout, basket or contact form. Check these pages on your own phone.
• Make the controls usable by keyboard and readable, with enough contrast.
• Add a link in the footer so visitors can change their choice at any time.

Consent scripts can also slow the page. The 2025 Web Almanac says consent provider scripts are usually loaded on the critical path. Pick a light banner. Our guide on how fast a website should load gives the targets. For banner controls and contrast, see our website accessibility guide.

A 10-minute check

1. Open your site in a private browser window, on a phone if you can.
2. Don't click anything on the banner. Check whether any ad or tracking tags have already fired.
3. Reload, click Reject all, and browse a few pages, including the basket or contact form.
4. Open your browser's developer tools and look at the stored cookies. List any that are not strictly necessary.
5. Find the footer link and change your choice. Check that it works.
6. Ask: did the banner cover anything important at any point?

If advertising or social cookies appear after you reject, fix that first. It is the most common failure and the one that attracts attention.

Common mistakes, and when to get help

• Removing the banner entirely while ad pixels still run.
• Treating all analytics as exempt. Only limited first-party use qualifies.
• Making Reject all smaller, greyer or buried a layer deeper.
• Setting tags before the visitor chooses.
• Forgetting the footer link to change a choice.

Ask for help if you run paid ads across several platforms, or if you can't tell which tags your site loads. A developer or your consent tool's support team can list them. For legal certainty on borderline cases, read the ICO guidance or take advice.

For a wider look at friction on your site, see our small business website checklist.

A free AgoraScan check gives your site a score and the top problems with screenshots in about 2 minutes, including a banner that gets in the way. A full audit lists every issue with the fix.

Questions people ask

Do I need a cookie banner for Google Analytics in the UK?

It depends on how you set it up. First-party analytics used only to improve your service can be exempt since 5 February 2026, if you give clear information and an easy way to object. If data is shared for the provider's own purposes, you still need consent.

Does the cookie banner need a Reject all button?

If you need consent, rejecting should be as easy as accepting. Put Reject all on the same layer as Accept all, with the same prominence. Check the ICO's consent mechanisms guidance for its exact wording.

Do I need a banner for a basket or checkout cookie?

No. The ICO lists a cookie that remembers goods in a basket as strictly necessary, so it needs no consent. Any advertising or cross-site tracking on the same page still does.

Will a cookie banner lower my conversion rate?

We found no solid data on this for small businesses. The clearer effect is on tracking, because fewer visitors consent. A banner that covers a button or form can cause real friction, so keep it small and out of the way.

How big are the fines for getting cookies wrong?

PolicyPros reports the maximum PECR fine rose from £500,000 to £17.5 million or 4% of worldwide turnover, whichever is higher. That comes from a secondary summary, so check the Act or the ICO. Small sites are unlikely to see the maximum, but the ICO has been contacting sites.

Sources

1. ICO sets out approach to storage, access and online tracking, A&O Shearman (2026)
2. What are the exceptions?, ICO (2026)
3. Cookie consent changes under the DUAA: guide, PolicyPros (2026)
4. ICO's cookies enforcement strategy: what businesses need to know in 2025, Foot Anstey (2025)
5. Bright patterns and cookie banner decisions (USENIX Security 2024), USENIX Security Symposium (2024)
6. Study of 14 consent interfaces (CHI 2023), ACM CHI (2023)
7. Cookie banner wording and opt-out rates (CHI 2022 Late-Breaking Work), ACM CHI (2022)
8. Literature review on cookie consent banners, ScienceDirect (2025)
9. Web Almanac 2025: Privacy, HTTP Archive (2025)
10. Web Almanac 2025: Third Parties, HTTP Archive (2025)
11. U.K. publishers and the ICO still grapple with offering a reject all cookies option, Digiday
12. ICO reject all button threatens free news consent pay, Press Gazette