Do you still need a cookie banner in the UK? (2026 guide)

Probably, yes. As of September 2026, most UK business websites still need a cookie banner — because most run advertising pixels, and those still require consent. What changed on 5 February 2026, when the Data (Use and Access) Act's amendments to PECR came into force, is that cookies used solely for your own analytics, or for appearance and accessibility preferences, no longer need consent — provided you explain them clearly and give visitors a free, easy way to opt out. Advertising, retargeting and cross-site tracking cookies still need a banner, full stop.

Here's how to work out which side of the line your site sits on — and what a compliant banner actually looks like now that the ICO has finalised its guidance. (This is general information, not legal advice; check the ICO's own guidance for your specific setup.)

What changed in UK cookie law in 2026?

UK cookie rules live in PECR (the Privacy and Electronic Communications Regulations), the same law that governs marketing emails. The Data (Use and Access) Act 2025 amended PECR, and the cookie changes took effect on 5 February 2026. Two things happened at once, and they pull in opposite directions.

The rules got looser for low-risk cookies: new exemptions mean some cookies that previously needed an "accept" click no longer do. And enforcement got much sharper: the maximum PECR fine jumped from £500,000 to £17.5 million or 4% of global turnover — the same ceiling as UK GDPR. The ICO then published its finalised cookie guidance on 29 April 2026, spelling out how it expects banners to work in practice.

In short: the government made it easier to be compliant, and much more expensive not to be.

Which cookies no longer need consent?

Three categories were added to the "strictly necessary" cookies that were always exempt:

Analytics and statistics — with strings attached. Cookies used solely to collect statistical information about how your site is used, to improve it, no longer need prior consent. The conditions matter: the data must be used only for that purpose, you must tell visitors clearly what you're collecting, and you must give them a free, simple way to object. A third-party analytics tool only qualifies if it acts purely on your behalf and doesn't use the data for its own purposes — which is why a standard Google Analytics 4 setup is a grey area, and the cautious route is still to keep GA4 behind consent (or run it through consent mode) rather than declare it exempt.

Appearance and functionality preferences. Cookies that remember display choices — dark mode, font size, language, accessibility settings — are exempt, again with clear information and an opt-out. This does not stretch to personalisation based on browsing history.

Emergency assistance. A narrow exemption for things like sharing location with emergency services — rarely relevant to a small business site.

Which cookies still need consent?

Everything that made banners necessary in the first place: advertising and retargeting cookies (the Meta pixel, Google Ads and TikTok tags), affiliate tracking, cross-site or cross-device tracking, and profiling. Anything where data is shared with a third party for advertising purposes needs consent — no exemption applies, however the tool describes itself.

This is the part that catches e-commerce businesses. If you run paid ads — and if ads are working for you, you almost certainly run a pixel — your site needs a proper consent banner, and your pixels must only fire after consent. It's the same principle as UK email rules: consent first, contact second. We've covered the email side in UK email marketing rules in 2026 — the two regimes share a law, a regulator and, since February, a fine ceiling.

So does your website need a cookie banner?

Three common situations:

A brochure site with no tracking at all — no analytics, no pixels, just session and security cookies. You never needed a banner, and you still don't. A cookies notice in your privacy policy is good practice.

A site with analytics only — you watch visitor numbers but run no ads. Since 5 February 2026 you can potentially drop the consent banner, if your analytics setup meets the "solely statistical, own use" conditions and you offer a clear opt-out. If you're on standard GA4, treat the exemption with care for the reason above. This is the one genuinely new option small businesses have in 2026.

An online store running ads or retargeting — you need a consent banner. Not a decorative one: your Meta and Google tags must actually wait for the "accept" click. A banner that says "reject" while the pixels fire anyway is worse than no banner, because it documents that you knew.

What does a compliant cookie banner look like in 2026?

The ICO's April 2026 guidance is blunt about design tricks. "Accept all" and "Reject all" must have equal prominence — same size, same visual weight, both on the first layer of the banner. A giant green "accept" with a grey "manage preferences" link buried underneath is exactly what the regulator says it will act on. Consent must be a real choice: no pre-ticked boxes, no cookie walls for content that doesn't need them, and rejecting must be as easy as accepting.

On Shopify, the practical route is the built-in Customer Privacy settings plus a consent banner that's actually wired to your tags, so marketing pixels stay silent until consent is given. On any platform, the test is the same: open your site in a private window, reject everything, and watch (in the browser's developer tools) whether ad pixels fire anyway. If they do, your banner is a prop.

What happens if you get it wrong?

Until this year, the honest answer for a small business was "not much" — PECR fines were capped at £500,000 and mostly aimed at spam-callers. The February 2026 change to a £17.5m/4% ceiling puts cookies in the same enforcement bracket as data breaches, and the ICO has spent 2025 and 2026 writing to major UK websites about non-compliant banners. Small businesses aren't the first target — but "we're too small to matter" is a plan built on hoping, and fixing a banner costs an afternoon.

Mind the Shop is a UK studio founded by Andrea (mindtheshop.co.uk) that builds Shopify stores and lead-gen sites with the compliance basics done properly — consent, tracking and email rules included, at fixed published prices on our services page. If you'd like an existing store checked over, the store health check is a 20-point Shopify audit for £295 (mention consent and tracking when you book and it gets covered), and our conversion audit + action plan is £450. Questions first? Use the contact page — the 20-minute call is free.

Frequently asked questions

Do I legally need a cookie banner on my UK website in 2026?

Only if you set non-exempt cookies. Advertising, retargeting and cross-site tracking cookies always need prior consent, so most commercial sites still need a banner. Sites using only strictly necessary cookies — and, since 5 February 2026, sites using solely own-use analytics or appearance preferences with a clear opt-out — don't.

Do analytics cookies need consent in the UK now?

Not necessarily. Since 5 February 2026, cookies used solely for statistical purposes are exempt if the data is used only by you, visitors are clearly informed, and they can opt out easily and free of charge. A third-party tool qualifies only if it acts purely on your behalf — standard GA4 setups are a grey area, so many businesses keep analytics behind consent anyway.

Does the Meta pixel or Google Ads tag need cookie consent?

Yes. Advertising and retargeting cookies have no exemption under the 2026 rules, and the tags must only fire after the visitor accepts — a banner that ignores "reject" is itself a breach.

What are the fines for cookie breaches in the UK?

Since 5 February 2026, the maximum PECR fine is £17.5 million or 4% of global annual turnover, up from £500,000 — the same ceiling as UK GDPR.

Can "accept" be more prominent than "reject" on a cookie banner?

No. The ICO's guidance, finalised on 29 April 2026, requires "accept all" and "reject all" to have equal prominence on the first layer of the banner, with rejecting as easy as accepting.