UK Cookie Law FAQs: GDPR, PECR and Consent Rules for 2026

If you have searched for “cookies and GDPR” this year, you are not alone. UK website owners face a tangle of rules that combine PECR, the UK GDPR and the Data Protection Act 2018, and the Information Commissioner’s Office has made cookie compliance a clear priority. The ICO announced in January 2025 that it would scrutinise the UK’s top 1,000 websites, and its revised guidance on storage and access technologies is expected to shape enforcement throughout 2026.

Table of Contents

By the end of this guide, you will know exactly what the UK cookie law requires, when you need a banner, and how to comply without overcomplicating it. We answer the six most common cookie consent questions, grounded in Regulation 6 of the Privacy and Electronic Communications Regulations. For many sites, a dedicated compliance plugin can automate much of the heavy lifting, and we link to one recommended WordPress tool below.

The short answer is yes, unless your site only uses strictly necessary cookies. The legal basis sits in PECR Regulation 6, not the UK GDPR alone, and the ICO enforces this alongside the Data Protection Act 2018. The ICO’s January 2025 announcement that it would tackle cookie compliance across the UK’s top 1,000 websites means enforcement risk is real and ongoing into 2026.

Close-up of Scrabble tiles spelling 'data breach' on a blurred background
Photo by Markus Winkler on Pexels

The rules apply to cookies and similar technologies, including local storage, fingerprinting and app SDKs. If your site uses analytics, advertising or social media embeds, a banner is the safest route. If you only use essential cookies, such as a session cookie for login or a shopping basket, you can skip the banner, but you still need a privacy notice explaining those cookies.

Technically you can install it, but practically the answer is no. Google Analytics cookies are not strictly necessary, so they require prior consent under PECR. The ICO’s position is clear: analytics cookies are subject to the consent requirement unless they are genuinely essential to the service the user requested.

Laptop displaying a security lock icon on a table with a potted plant and clock.
Photo by Dan Nelson on Pexels

Consent must be freely given, specific and informed. A pre-ticked box or implied consent by scrolling does not count. Consider alternatives such as cookieless analytics or privacy-friendly tools, or configure Google Analytics to anonymise IP addresses, though anonymisation alone does not remove the consent requirement. If you use Google Analytics, your cookie banner must clearly list the cookies, their purpose and the third-party processor involved.

The exemption under Regulation 6(4) PECR is narrow. It covers cookies needed for the sole purpose of carrying out a communication over an electronic network, or cookies strictly necessary to provide a service the user explicitly requested. Examples include shopping basket cookies, login session cookies, security cookies for online banking and load-balancing cookies.

The GOV.UK Design System provides a useful model: a session cookie expiring in 20 hours and a cookie_policy cookie expiring in one year. Strictly necessary does not include analytics, advertising or personalisation cookies, even if you consider them useful. Legitimate interest cannot be used as a legal basis for non-essential cookies; it only applies to essential ones.

Yes. UK guidance is clear that consent must involve a clear positive action. Giving users only an “Accept” button is not compliant. The ICO expects the reject option to be as easy to find and use as the accept button, with no dark patterns. Legal practitioners advise that accept and reject buttons should look the same visually to avoid steering users toward acceptance.

Silence, inactivity or scrolling does not constitute valid consent. Users must actively choose. A “Reject All” button should be available on the first layer of the banner, not buried in settings or behind multiple clicks.

Do Cookies Count as Personal Data Under the GDPR?

Often yes. Cookies that can identify a user, directly or indirectly, are personal data under the UK GDPR. The ICO has confirmed that the rules apply even to anonymous data if the technology stores or accesses information on a user’s device. IP addresses, device IDs and browsing behaviour can all be personal data when linked to an individual.

This means you need a lawful basis under the UK GDPR in addition to PECR consent. In practice, consent usually covers both. Your privacy notice must state what data cookies collect, why, and how long it is retained.

Yes. Consent must be as easy to withdraw as it is to give, and this is a core requirement of the UK GDPR. Provide a visible “Cookie Settings” or “Manage Consent” link in your site footer, or use a floating widget. Users should be able to change preferences without clearing their browser data or navigating a maze of settings.

Withdrawal of consent must be honoured promptly. The cookies should stop tracking from that point onward. Keep a record of consent, including who, when and what version of the policy, as a consent management plugin can automate this logging.

How to Make Your Site Compliant in 2026

Start with a full cookie audit. Identify every cookie and similar technology on your site, its purpose and its expiry. Categorise cookies into strictly necessary, functional, analytics and marketing, and document them in a clear table.

Implement a compliant banner with equal-weight accept and reject buttons, plus a link to your cookie policy. Draft a clear, comprehensive cookie policy that explains what cookies do, why they are used and how users can manage them.

For WordPress sites, the thetechspert Privacy Compliance Tools for UK GDPR plugin can automate scanning, consent logging and policy updates. This removes much of the manual work and helps you stay current as ICO guidance evolves. You can find the plugin linked in this article.

Frequently Asked Questions

Do I need a cookie banner? Yes, unless you only use strictly necessary cookies.

Can I use Google Analytics? Only with prior consent. It is not exempt.

What is a necessary cookie? One required for a service the user explicitly requested.

Do I need a reject button? Yes, and it must be as prominent as accept.

Are cookies personal data? Usually, yes. Treat them as such.

Can users change consent later? Absolutely. Make it easy and honour it promptly.