Cookies and PECR for UK Business Websites

Cookies are a PECR issue, not just a GDPR one

Most small businesses assume cookie rules come from GDPR. They actually come mainly from PECR — the Privacy and Electronic Communications Regulations — which sit alongside UK GDPR and are enforced by the ICO. PECR is the reason you see consent banners everywhere, and it is stricter than people expect: for most cookies, you need consent before they are set, not after.

The rules are not limited to “cookies” in the narrow sense. They cover any technology that stores information on, or reads it from, a visitor’s device — cookies, tracking pixels, local storage, device fingerprinting and similar. If it drops a tracker or reads one, PECR applies.

What needs consent, and what does not

There is one key exception to the consent rule: strictly necessary cookies. These are the ones essential to provide a service the user has actively asked for. Think of remembering what is in a shopping basket, keeping someone logged in during a session, or security and load-balancing. You can set these without asking — though you should still describe them in a cookie or privacy notice.

Everything else needs consent before it loads, including:

• Analytics (such as Google Analytics) — measuring traffic is useful to you, but it is not strictly necessary to the visitor.
• Advertising and remarketing cookies.
• Social media buttons and embedded feeds that track.
• Embedded media, such as a YouTube video that sets cookies when the page loads.
• Personalisation and A/B testing tools.

A common mistake is treating analytics as “basic” and letting it fire automatically. Under PECR it is not necessary, so it needs consent like the rest.

What a compliant cookie banner looks like

The ICO has been clear, and public, about what fair consent means. The single biggest issue it raises is balance: it must be as easy to say no as to say yes.

A banner that only offers “Accept” — with no equally easy way to reject — is not consent. Under PECR, refusing must be as simple as agreeing.

A compliant approach generally includes:

• No non-essential cookies before consent. Nothing beyond strictly necessary should fire until the visitor opts in. This is the technical detail most home-made banners get wrong — the banner appears, but the analytics script has already loaded behind it.
• Equal choices. “Accept all” and “Reject all” should be equally prominent and equally easy — same page, same effort. No hiding “reject” behind extra clicks.
• Granular options. Let people accept some categories and not others (for example analytics but not advertising).
• No pre-ticked boxes. Consent must be a clear, affirmative action.
• Clear information. Say what the cookies do, who sets them, and how long they last, usually via a linked cookie notice.
• Easy to change your mind. Provide a way to withdraw or update consent later — as straightforward as giving it.

“By continuing to browse you accept cookies” is not valid consent. Neither is a wall of legalese with a single glowing “Accept” button.

Handling analytics without breaking the rules

You do not have to give up understanding your website. You have a few honest options:

1. Ask first. Load analytics only after the visitor consents. You will measure fewer people, but the numbers you get are lawful.
2. Use privacy-focused, cookieless analytics. Some analytics tools are designed to measure traffic without setting cookies or identifying individuals. Where a tool genuinely avoids storing or reading information on the device, the strict consent requirement may not bite in the same way — but check each tool’s specific claims rather than taking the marketing at face value, and always be transparent about what you use.
3. Keep it proportionate. A small brochure website often needs far less tracking than businesses assume. Measuring less can be simpler and safer.

Whichever route you take, describe it plainly in your privacy and cookie notices.

Cookies and your wider privacy duties

Cookies rarely sit alone. Once a cookie identifies or profiles someone, UK GDPR duties come into play as well — lawful basis, transparency and people’s rights. If you are still getting the fundamentals in place, our GDPR basics for UK small business is a good companion to this article, and it is worth making sure your privacy notice and cookie notice actually match what your website does.

It is also worth remembering that PECR governs more than cookies — it covers electronic marketing too, such as the rules around email and SMS campaigns. If you run newsletters or promotions, the same regulations shape how you can contact people and when you need consent.

Getting it right without the guesswork

Cookie compliance is one of those tasks that looks trivial and then quietly goes wrong in the technical detail — usually a banner that looks fine but lets trackers load before anyone clicks. As a managed IT and cyber-security provider in Leeds and Yorkshire, DACROS can audit what your website actually sets, configure a consent tool that blocks non-essential cookies until opt-in, and make sure your cookie and privacy notices reflect reality.

If you would like your site checked over, take a look at our services or get in touch — we will tell you plainly what needs fixing and what is already fine.