Do you need a cookie banner on your website? The 2026 UK rules for small businesses

If your website is a handful of pages and a contact form, you probably don’t need a cookie banner. You need one when your site stores or reads something on a visitor’s phone or computer that they don’t need for what they came to do. On most small business sites, the banner is there because of things added along the way, often without anyone really deciding to add them.

Where the banners come from

The law on cookies covers more than cookies. It applies to anything that stores information on someone’s device or reads it back, so tracking pixels and similar bits of code count too. Before any of that runs, you need the visitor’s permission, with a few exceptions.

Most banners trace back to a short list of extras:

• an analytics tool that follows visitors around
• a Facebook or other advertising pixel
• an embedded Google map
• embedded YouTube videos
• chat and booking widgets
• WordPress add-ons, each of which can bring cookies of its own

Take a cafe site with a map on the contact page, a video on the home page and a booking widget on the menu. Each of those can put something on a customer’s phone, so the site has to ask permission before a customer has even seen the menu.

A site with a handful of pages and a contact form needs none of them. A “Get directions” link to Google Maps does the job of an embedded map, and a link to your YouTube channel or booking page works the same way. The trade-off is that the visitor leaves your page for a moment, and once they’re on the booking company’s own site, its cookies are its business. For most small businesses we think that’s a fair swap for a page that loads quicker and asks nothing of anyone.

What counts as strictly necessary

Strictly necessary means your visitor needs it for what they came to do. What you’d find useful doesn’t come into it. A spam check that keeps bots off your contact form counts, because it protects the form they’re filling in. So does remembering what’s in a shopping basket, or keeping someone logged in to their account.

Anything for advertising never counts, however useful it is to you. Knowing which Facebook ad brought someone in might help you plan next month’s spend. They don’t need it to send you a message, so it needs their say-so first.

If everything on your site falls into this group, there’s nothing to ask permission for, so you don’t need a banner.

What changed in 2026

The simplest way to count visitors is a counter that stores nothing on anyone’s phone or computer, like the Cloudflare one we use. Nothing is stored, so there’s nothing to ask permission for. If your counter does use cookies, two exceptions that came in early 2026 may still let you do without a banner.

The first covers basic visitor statistics, used only to improve your own site. In practice that means a simple visitor counter that reports to you and nobody else. If the company behind the tool uses your visitors’ data for its own ends, the exception doesn’t cover you, so ask whoever set it up which kind you’ve got.

The second covers remembering how someone likes the site to look or work, such as a larger text size, or the fact that they chose Welsh on a bilingual site.

Both have a catch: you have to tell people plainly what you’re doing, and let them switch it off easily and at no cost. Neither lets you track individual visitors or build up a picture of a person. If all you want is to know how many people came and which pages they read, the first one may cover you. If your site feeds an advertising account, you still need consent.

How to check your own site

You don’t need to be technical for this.

1. Open your site in a private or incognito window, so your browser hasn’t remembered any earlier choices. If a banner appears, something on the site is asking for consent, so find out what. If none appears, that doesn’t prove nothing’s there, so carry on to step 2.
2. List everything that’s been added since the site went live: analytics, a Facebook pixel, maps, YouTube videos, chat or booking widgets, review feeds and any WordPress add-ons.
3. Ask whoever built or looks after the site: “What does our site store on visitors’ devices, and what for?” They should be able to answer in writing.
4. Go through the list and ask whether you still use each one. If nobody has opened the analytics in a year, take it out. That’s one less reason for a banner.

If you do need a banner

If you keep something that needs consent, the banner has to give people a real choice. One that nudges everyone towards “accept” collects consent that doesn’t count.

• Rejecting is as easy as accepting: same screen, same size of button.
• Nothing that needs consent runs until the visitor has chosen.
• Ignoring the banner, or carrying on browsing, is not a yes.
• Any optional tick boxes start unticked.
• Say plainly what each item does, who supplies it and how long it lasts.
• Put a link in the footer so people can change their mind later.
• Check it again whenever something new goes on the site.

If that looks like a lot of upkeep for an embedded map and a video, swap them for links and most of it goes away. If your site takes payments or runs adverts, the ICO’s guidance on cookies and similar technologies goes into far more detail, or ask someone qualified.

You still need a privacy notice

A contact form collects names and email addresses, and that falls under data protection law whatever your site does with cookies. Your privacy notice should say who you are, what you collect and why, how long you keep it, who else handles it, and what rights people have. It can be short and written in plain English. Our own privacy page is one example of how simple it can be.

If you keep customer details, you’ll probably owe the ICO a yearly fee too, about £50. Our guide to what a small business website costs covers it with the other running costs.

How we build ours

This site has no Google Analytics, no advertising pixels, no embedded maps and no YouTube videos. We count visitors with Cloudflare’s web analytics, which stores nothing on your phone or computer, and the contact form has a spam check to keep bots out. There’s nothing on it we’d need to ask permission for, so there’s no banner.

We design and build client sites the same way, so they don’t need one either. If a client wants a booking system or a video, we link to it from the page, and our hands-off website care keeps it that way after launch.

We’re in Ruthin and look after sites across North Wales and Cheshire, including Wrexham and Chester. If you’re not sure what your current site is running, get in touch and we’ll point you in the right direction, with no obligation.