Cookie Consent for UK and EU Websites: PECR, ePrivacy and What to Do

The Short Answer

In the UK and the EU you generally need a visitor's consent before setting cookies that are not strictly necessary, such as analytics, advertising and social media tracking cookies. Strictly necessary cookies, such as those that keep items in a basket, do not need consent. This is general information, not legal advice.

Which Rules Apply

In the UK, the Privacy and Electronic Communications Regulations, known as PECR, cover cookies and similar technologies, alongside UK GDPR when cookies collect personal data. In the EU, the ePrivacy Directive does the same job, as implemented by each member state, together with the GDPR.

They can apply to any website that targets visitors in those places, wherever the site owner is based.

Cookies That Need Consent and Those That Do Not

Need consent: analytics cookies, advertising and remarketing cookies, social media embeds that track visitors and most third-party widgets that set cookies.

Do not need consent: cookies that are strictly necessary to provide something the visitor asked for, such as a shopping basket, a login session or a security feature.

When unsure, check what each cookie actually does and who sets it.

What Good Consent Looks Like

- Do not set non-essential cookies until the visitor agrees.

- Explain clearly what each category is used for.

- Make refusing as easy as accepting, with equally clear buttons.

- Do not use pre-ticked boxes.

- Let people change their mind later, with a link in the footer.

- Keep a record of consent choices.

Step-by-Step Setup

1. List every cookie and tracker your site uses, including those added by plugins and embedded videos.

2. Group them as necessary, analytics, marketing and so on.

3. Choose a consent tool that blocks scripts until consent is given, rather than only showing a banner.

4. Update your cookie policy with the list and the purpose of each cookie.

5. Test with a browser's developer tools to confirm nothing non-essential loads before consent.

Analytics Without Cookies

Some analytics tools are designed to work without cookies or personal data, which can reduce how much consent you need to collect. Check the tool's documentation and the guidance of your local regulator, because the rules depend on exactly what is collected.

Frequently Asked Questions

Is a banner that only says "We use cookies" enough?

No. Visitors need a real choice, and non-essential cookies should not load until they agree.

Do I need a cookie banner on every page?

The choice should be available across the site, but you only need to ask once, then remember the answer.

Does my hosting provider set up consent?

Usually not. Consent is part of your website, so you or your developer need to add it.