Affiliate disclosure: I'm a CookieConfirm agency reseller and earn a commission if you subscribe through the clearly marked referral link in this guide. My practical guidance applies regardless of which platform you use.

This is practical information for business owners, not legal advice.

You've installed a cookie banner on your website. Visitors can click Accept all, Reject all or change their settings. Job done?

Not necessarily.

The banner is only the visible part of cookie consent management. What matters is what happens behind it: which cookies or trackers run before someone makes a choice, whether that choice reaches Google Analytics and advertising tags, and whether visitors can change their minds later.

The short answer: A UK website's cookie banner is not enough on its own. For technologies that require consent, visitors need clear information and a genuine choice, and the website must respect that choice in practice. Some strictly necessary and narrowly defined statistical uses can be exempt. The right answer depends on what each technology actually does, not the name of the cookie category.

If you own a WordPress website, run Google Ads or use Google Analytics 4 (GA4), this guide will help you check the basics without needing to become a privacy lawyer or developer.

What does a UK website actually need for cookie consent?

Two sets of rules matter. The Privacy and Electronic Communications Regulations (PECR) govern storing information on, or accessing information from, a visitor's device. Where personal data is involved, the UK GDPR and Data Protection Act 2018 also apply.

For cookies and similar technologies that are not exempt, the starting point is straightforward:

Explain what they do in language people can understand.
Obtain valid consent before using them.
Give visitors a real option to refuse as well as accept.
Make choices specific enough to cover different purposes, rather than bundling everything together.
Make consent as easy to withdraw as it is to give.
Ensure the website's tags, scripts and embeds respect those choices.

The Information Commissioner's Office (ICO) covers these requirements in its guidance on storage and access technologies.

Did the UK cookie rules change in 2025 and 2026?

Yes. The Data (Use and Access) Act 2025 introduced additional, limited exemptions, and the ICO published finalised guidance in April 2026.

In particular, there is a statistical purposes exception for technology used solely to collect statistics about how a website or service is used, with a view to improving it. To rely on that exception, a business must satisfy its specific conditions, including providing clear information and a simple, free means of objecting. An exception also exists for certain appearance or functionality preferences, again subject to conditions.

That does not mean all analytics tools are now exempt. Tracking individuals, using data for advertising, retaining individual-level data beyond what is necessary to produce aggregate statistics, or combining several purposes can take a setup outside the exception. You must assess the actual configuration and any third-party use of the data.

For a typical small business using GA4 alongside Google Ads, I would not assume the statistics exception applies without reviewing the setup. Keeping non-exempt analytics and marketing technology off until consent is a sensible, cautious starting point.

Read the ICO's explanation of the exceptions.

The purpose matters more than whether a cookie is first-party or third-party, or whether a banner calls it “functional”.

Purpose	Typical example	General approach
Strictly necessary	Security, shopping basket, login session, remembering a cookie choice	Usually exempt when genuinely essential for a service requested by the visitor
Website statistics	Aggregate visits and page-use statistics	May qualify for the limited statistical purposes exception, but only if all conditions are met
Analytics for broader uses	Analytics linked to advertising, audience-building or individual profiling	Assess carefully; consent will generally be needed for non-exempt storage or access
Marketing and advertising	Remarketing pixels, personalised ads, advertising measurement	Consent is required for advertising-related storage or access
Optional third-party content	Embedded videos, maps or external widgets	Depends on how the feature works and what is loaded; consider privacy-friendly or click-to-load options

For example, a cookie that remembers a visitor's consent preference can be strictly necessary for the consent mechanism. A remarketing cookie is not strictly necessary just because the business depends on advertising revenue.

Important: A cookie banner's “Functional” category must not become a hiding place for optional analytics or marketing scripts.

Seven cookie banner mistakes I see businesses risk making

1. Turning on analytics and marketing by default

A common mistake is to show a banner with Analytics and Marketing already switched on and expect visitors to turn them off.

For technologies that require consent, pre-enabled settings do not provide the positive action needed for valid consent. Merely continuing to browse or scrolling the page is not an appropriate substitute.

What to do: Keep consent-required categories off initially. Only change their status after the visitor actively agrees. If you believe a particular statistical technology is exempt, document why and provide the required information and objection mechanism.

2. Giving people an obvious Accept button but hiding Reject

Visitors should be able to make a free, informed choice. A bright Accept all button alongside a difficult-to-find rejection route can undermine that choice.

What to do: Make Accept all and Reject all clear and easy to use. Provide a separate way to select categories. Avoid wording that pressures people into agreeing.

I prefer a simple first layer with three obvious actions: Accept all, Reject all and Customise.

3. Loading Google Ads or other trackers before consent

This is the biggest reason I say a banner can look right while the implementation is wrong.

Imagine a plumber's website in Essex. The cookie banner appears, but a remarketing tag runs as soon as the page loads. The visitor rejects marketing cookies afterwards. The banner worked visually, yet the site may already have used a technology for a purpose requiring consent.

What to do: Check when each advertising tag, analytics script, tracking pixel and third-party widget loads. Configure blocking or consent-aware behaviour appropriate to the technology. Test actual network activity, not just the banner design.

There is an important distinction here: Google's advanced Consent Mode can send cookieless pings while consent is denied. Those requests are not the same as setting an advertising cookie, but they still require a considered privacy assessment. I explain the difference below.

4. Assuming a cookie banner automatically configures Google Consent Mode v2

A consent banner collects a choice. Google Consent Mode v2 communicates relevant parts of that choice to Google's tags. They are related, but they are not the same thing.

Google uses four key consent signals:

Signal	What it tells Google
`analytics_storage`	Whether analytics-related device storage is permitted
`ad_storage`	Whether advertising-related device storage is permitted
`ad_user_data`	Whether user data may be sent to Google for advertising purposes
`ad_personalization`	Whether personalised advertising is permitted

For a consent-based setup, these should start at the appropriate denied defaults and update according to the choices made. The defaults need to be available before the relevant Google tags use them.

What to do: Use Google Tag Assistant to check the initial and updated consent states. If you use Google Tag Manager (GTM), make sure the consent solution runs at Consent Initialization, and test each relevant tag's trigger and consent settings.

Google's own consent setup guidance explains the implementation requirements.

5. Publishing a cookie policy that does not match the website

A policy might mention “analytical and marketing cookies” without telling visitors which providers are involved, why they are used or how preferences can be changed. Some websites retain an old cookie list years after changing analytics plugins or adding new widgets.

What to do: Scan the site, review the results and maintain a cookie declaration that matches the technologies actually used. Give visitors straightforward access to your cookie information and your wider privacy notice.

On my own site, I keep the Cookie Policy separate from the Privacy Policy so visitors can find the information relevant to them.

6. Forgetting that people can withdraw consent

A visitor might accept cookies today and change their mind next week. That choice should not be permanent or difficult to reverse.

What to do: Make Cookie settings accessible, often in the footer or through a small persistent control. When a visitor changes a choice, update the consent state and stop future non-essential processing covered by the withdrawal. Consider any existing cookies or identifiers and what further action is needed.

Deleting browser cookies is not a substitute for providing a proper withdrawal mechanism.

7. Only testing the homepage

Your homepage may have no videos, booking calendars or lead forms. Your service pages, contact page, blog posts and thank-you pages might load quite different scripts.

What to do: Test several page types, particularly those with YouTube videos, maps, review widgets, forms, payment features or Google Ads conversion tracking. Repeat the test after installing a plugin, changing your theme or updating GTM.

A monthly scan is useful, but it does not replace testing whether consent is applied correctly.

How to test your website's cookie consent in 10 minutes

You do not need to write code to perform a useful first check. Start with these steps.

Step 1: Open a clean browsing session

Use a private window, or clear your site's cookies and stored consent choices, then load the homepage. You should see the banner as a new visitor would. Check mobile as well as desktop.

Step 2: Look at the available choices

Are the purposes explained? Can you reject non-essential tracking without hunting through several screens? Are optional categories enabled before you choose? Can you find a way to reopen settings later?

Step 3: Reject non-essential cookies

Choose Reject all. Then use the browser's developer tools to inspect Application → Storage → Cookies in Chrome, or the equivalent tools in your browser. Check which cookies exist and why.

Do not assume that every cookie is a problem. Some are essential. Also do not assume that an empty cookie list means no tracking happened: scripts can send requests or use other storage methods.

Step 4: Check scripts and network requests

In Developer Tools, inspect the Network tab for calls to advertising platforms, analytics services and other tracking vendors. A request alone is not conclusive proof of unlawful tracking, especially if advanced Consent Mode is configured, but unexpected activity warrants investigation.

Step 5: Check Google Consent Mode with Tag Assistant

Start a fresh session in Google Tag Assistant. Look for the earliest consent event and review the defaults for ad_storage, analytics_storage, ad_user_data and ad_personalization. Then accept or reject categories and check whether the state updates accordingly.

In basic Consent Mode, Google tags can be completely blocked before consent, so Tag Assistant may not connect until consent has been granted. That is expected in some implementations. Google's troubleshooting guide explains what to inspect.

Step 6: Repeat with Accept all and selected categories

Clear the test state and repeat. Check that consent-required tags activate only when the relevant categories are accepted and that rejecting marketing while accepting analytics does not grant advertising permissions.

Step 7: Test other important pages

Open a page with an embedded video, your main contact form and a thank-you page after a test enquiry. Review what changes. If your website runs WooCommerce, check the basket and checkout journey too.

When to investigate further: A marketing cookie appears before agreement, a tag fires regardless of a rejected choice, the four Google consent signals never update, or an embed sets tracking identifiers before the visitor interacts with it.

What should you look for in a cookie consent management platform?

A consent management platform (CMP) helps collect, record and apply visitors' choices. The tool is useful only when it is configured around the actual scripts on your website.

For most WordPress and small business websites, I would look for:

Clear Accept, Reject and preference controls, with an accessible way to change choices later.
Categories and descriptions that match the website's real tracking purposes.
Cookie and tracker scanning, with a declaration you can review and keep current.
Control over scripts and embedded content that require consent.
Google Consent Mode v2 support if you use Google tags.
Useful records of consent choices and straightforward configuration.
Compatibility with your WordPress setup, Google Tag Manager and third-party tools.
Documentation and support that explain what still needs manual testing.

Do not buy a CMP because a marketing page says “GDPR compliant” and assume the matter is settled. The ICO is clear that organisations using a CMP must consider the roles and responsibilities of the provider and the business itself.

The platform I use: CookieConfirm

Advertisement / affiliate recommendation. I am a CookieConfirm agency reseller and receive a commission when a business subscribes through the link below. My commission is separate from any SEO or website services I provide.

For my own website, I've chosen CookieConfirm to manage cookie preferences and provide a cookie declaration. I wanted something practical for a WordPress-based business website rather than another complicated dashboard.

Based on CookieConfirm's published documentation, its useful features include:

A customisable consent banner and preference controls.
A WordPress/WooCommerce plugin and a Google Tag Manager template.
Support for Google Consent Mode v2 and several other consent integrations.
Automated cookie scans and an automatically generated declaration.
Tools to control scripts and iframes, with consent records available for review.

A useful detail if you already use GTM: CookieConfirm recommends loading its template on Consent Initialization – All Pages. Its documentation also explains that some tags need their triggers configured using the cookie_consent_update event. In other words, installing the banner is not a reason to skip tag testing.

See the CookieConfirm GTM installation guide and WordPress plugin guide.

Explore CookieConfirm (affiliate link) ↗

If you sign up through that link, I earn a commission. Use the platform only if it suits your site and the level of control you need. You can also ask an independent developer or privacy adviser to assess the implementation.

A practical cookie consent checklist for business owners

Before calling the job finished, check the following:

I know which cookies, scripts and similar technologies my website uses.
I have assessed which purposes genuinely qualify for a PECR exception.
I provide clear information and a meaningful choice where consent is required.
Consent-required technology is not used before the relevant consent is obtained.
Analytics and marketing preferences are not automatically treated as accepted.
My Google tags behave as intended for accepted and rejected choices.
Visitors can reopen settings and withdraw consent without difficulty.
My cookie declaration and privacy information match the actual site.
I have tested the homepage, key landing pages, embeds, forms and thank-you pages.
I retest when plugins, GTM tags or advertising tools change.

For a typical local service business, the biggest priorities are usually accurate consent choices, correctly controlled conversion tracking and an honest cookie declaration. You do not need an elaborate legal page. You need a process that works.

Frequently asked questions about UK cookie consent

Is a cookie banner legally required for every UK website?

Not necessarily. What matters is whether your website stores or accesses information on visitors' devices and for what purposes. Some activities are exempt. If you use non-exempt cookies or similar technologies, you generally need clear information and consent before using them.

Can I use Google Analytics without cookie consent in the UK in 2026?

Possibly, but only if the specific technology and your use of it satisfy an applicable exception, or another lawful configuration is available. The new statistical purposes exception is narrow, with information and objection requirements. Do not assume a standard GA4 installation, particularly one linked to advertising, is automatically exempt.

Do I need a Reject all button?

Where you are asking for consent to non-exempt technologies, visitors need a genuine and straightforward way to refuse. An obvious Reject all option is generally a sensible way to achieve that on a banner offering Accept all. The overall design should not push people towards acceptance.

Does Google Consent Mode v2 make my website GDPR compliant?

No. It passes consent information to Google tags and changes their behaviour. You still need appropriate consent collection, cookie information, vendor assessment and correct control of non-Google technologies.

Does rejecting cookies stop Google Analytics completely?

It depends on the implementation. With basic Consent Mode, Google tags are blocked before consent. Advanced Consent Mode can send cookieless pings while consent is denied. You need to know which mode your site uses and whether it fits your legal assessment.

Are cookie rules different for WordPress and WooCommerce?

The underlying legal rules are the same. WordPress and WooCommerce simply have different plugins, embeds, checkout features and marketing scripts to audit. A plugin that adds a cookie or tracker is not automatically exempt.

Is a cookie banner a Google ranking factor?

There is no established rule that merely installing a cookie banner improves Google rankings. Cookie consent is primarily a privacy and implementation issue. An intrusive, poorly designed banner can affect the user experience, while a broken implementation can interfere with analytics and conversion data. Do not buy a CMP expecting an SEO ranking boost.

How often should I scan my website for cookies?

There is no universal monthly legal interval. Run scans when the site changes, and use periodic checks to catch newly added scripts. Scanning is only one part of testing; confirm that scripts actually respect choices.

Can I manage cookie consent myself?

Yes, especially on a straightforward website. However, if you use GTM, GA4, Google Ads, Meta pixels and embedded tools together, testing the actual tag behaviour matters more than how quickly you installed the banner.

What I would do next

If you've had a cookie banner for years, don't immediately replace it. Test it first. Confirm the choices are clear, inspect what loads before and after consent, and check Google Consent Mode if you use Google tags.

If it passes, great. If not, fix the setup or choose a consent platform that gives you the necessary control. Either way, a working implementation matters more than the badge on the banner.

I'm George Papatheodorou, an independent digital marketing consultant based in Leigh-on-Sea, Essex. I work directly with UK businesses on SEO, Google Ads and WordPress websites. For broader website help, see my WordPress support services or get in touch.

Sources and further reading

Legal and platform information checked 7 November 2026. As guidance, technology and vendor features change, review the live sources and your site's actual configuration before making compliance decisions.

Cookie Consent in the UK: Is Your Cookie Banner Actually Working?