Cookie Consent and PECR Compliance

What the rules require

In the UK, cookies and similar technologies are governed by the Privacy and Electronic Communications Regulations (PECR), enforced by the Information Commissioner's Office. The basic rule: you need consent to store or access information on someone's device, unless an exemption applies. Consent must be freely given, specific and informed, which in practice means:

• a clear choice to accept or reject, with rejecting no harder than accepting;
• no pre-ticked boxes and no "by continuing to browse you agree";
• non-essential scripts blocked until the visitor agrees;
• an easy way to change your mind later, such as a cookie settings link in the footer;
• a cookie policy that matches what the site actually does.

What changed with the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 amended PECR. It allows some low-risk storage and access to happen without consent, including certain uses for statistical purposes, website functionality and security, provided conditions are met: typically that people are told clearly and given a simple way to object. The ICO has published updated guidance on storage and access technologies explaining these exceptions.

Two points matter for small businesses. First, the exemptions are narrow. Advertising and cross-site tracking, such as the Meta Pixel or Google Ads remarketing, still need consent, and a third-party analytics tool that shares data with its provider for its own purposes is unlikely to fit. Read the ICO guidance before relying on an exemption. Second, the ICO's PECR fining power rose to the UK GDPR level of up to £17.5 million or 4% of global turnover, according to the ICO's statement on the Act's commencement in February 2026.

Our cookie audit

We start by loading your site in a clean browser and recording every cookie, local storage entry and third-party request before and after consent. Typical findings:

• Google Analytics, Meta Pixel, Hotjar or TikTok Pixel firing on page load, before any choice.
• YouTube embeds and Google Maps setting cookies; these can be swapped for privacy-enhanced embeds or click-to-load placeholders.
• Old tracking codes from previous agencies still in the theme header.
• A banner plugin installed but not connected to anything, so it changes nothing.

You get a list of everything found, which category it falls into, and what we recommend.

Setting it up properly

We install or reconfigure a consent management platform suited to your site, such as Cookiebot, CookieYes, Complianz for WordPress, or Shopify's built-in customer privacy settings. We then:

1. categorise each cookie and script as necessary, functional, analytics or marketing;
2. block non-exempt scripts until consent, ideally through Google Tag Manager consent settings;
3. connect Google Consent Mode v2 so GA4 and Google Ads receive the visitor's choice through the four consent signals; see Google Ads support;
4. style the banner so Accept and Reject are equally prominent and it works on mobile without hiding the page;
5. update the cookie policy to list what actually runs.

Finally we retest in a clean browser to prove scripts only load after consent.

Common mistakes we fix

• Banner installed twice, once by a plugin and once by a theme, so visitors see two pop-ups and neither works properly.
• Tags hard-coded in the theme, bypassing the consent tool entirely.
• Consent not remembered, so the banner reappears on every page because a caching plugin serves stale pages.
• Reject button styled as a faint link under a bright Accept button.
• Consent Mode set to "granted" by default, which defeats the point.

Each is quick to put right once spotted.

Pricing

A cookie audit and banner setup for a typical small business website takes a few hours, charged at £45 an hour + VAT. Some consent platforms have their own subscription for larger sites, which we explain before you sign up. Cookie compliance is one part of data protection; for the wider IT side, see GDPR IT compliance. We do not give legal advice, but we make sure your site does what your policy says.

What it costs

Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.

Related