Do You Need a Cookie Banner? UK Rules for 2026
Which cookies, local storage and web fonts still need consent in the UK after the 2026 changes, when analytics is exempt, and how to check your own site.
· 7 min read
In the UK you need a consent banner only if your site stores or reads something on a visitor's device for a purpose the law doesn't exempt, such as advertising pixels, social media tracking or analytics that a provider also uses for its own ends. Since 5 February 2026, simple aggregate analytics, remembering a visitor's dark mode or language, and anything needed for a feature the visitor asked for (a basket, a saved form) can run without consent, as long as you explain them clearly and, for analytics and appearance, give people a free and simple way to say no. Checking your own site takes about half an hour; the steps are below. This is a practical guide, not legal advice.
What changed and when#
The rules sit in regulation 6 of the Privacy and Electronic Communications Regulations (PECR). The Data (Use and Access) Act 2025 rewrote them, adding new exceptions in Schedule 12 of the Act, and the Commencement No. 6 Regulations brought that change (section 112 and Schedule 12) into force on 5 February 2026. On 29 April 2026 the ICO finalized its guidance on storage and access technologies, which replaces its old cookie guidance and explains how it reads the new rules.
It's worth checking now because the run-up to Christmas is when small sites pick up new scripts: an ad pixel for a Black Friday campaign, a booking widget, a chat bubble, a newsletter pop-up. Each of those can quietly change your answer from "no banner needed" to "banner needed".
It's not just cookies#
The rules cover "any use of storage and access technologies", according to the ICO's page on
what the PECR rules are.
Its list of
storage and access technologies
names web storage ("also known as 'local storage', 'HTML5 storage' or 'DOM storage'"), tracking pixels and
fingerprinting alongside cookies. So a site that sets no cookies at all can still need consent if a script
on it writes to localStorage for advertising.
Where consent is needed it has to come first, and it must be a clear, positive action: carrying on browsing or a pre-ticked box doesn't count.
The five exceptions#
The ICO's page on the exceptions lists five cases where you don't need consent:
| Exception | What it covers | Examples on a small site |
|---|---|---|
| Communication | Storage needed only to send a communication over the network | A host's load-balancing session cookie |
| Strictly necessary | Storage essential to provide the service the visitor asked for, judged from the visitor's side | A shopping basket, a login session, security checks |
| Statistical purposes | Collecting aggregate statistics only to improve your site | Simple page-view counts |
| Appearance | Adapting how the site looks or works to the visitor's preference | Remembering dark mode or the language they picked |
| Emergency assistance | Finding a device's location after a request for help | Unlikely to apply |
The last three come with conditions. The analytics and appearance exceptions both need "clear and comprehensive information" about the purpose and "a simple means of objecting, free of charge", in the words of the Act. Strictly necessary doesn't need an opt-out, but the ICO says you should still explain it.
When analytics is exempt (and when it isn't)#
The statistical purposes exception is the big change for small sites. Under the ICO guidance, analytics qualifies when:
- its sole purpose is to improve your site, not to monitor or track individual visitors;
- the output is aggregate statistics you can't use to identify people;
- you tell visitors you collect it and give them a simple, free way to object;
- any third-party provider acts as your processor, not a joint controller, uses the data only to help you, and doesn't link it with other information it holds.
That last point decides most cases. If your analytics provider also uses what it collects for its own purposes, such as advertising, you need consent. Read the provider's data processing terms: a tool that offers you a processor agreement and keeps data out of advertising is a good sign; one whose terms let it share data with ad products is not. Cloudflare, for example, describes Web Analytics as "free, privacy-first analytics" that "does not collect or use your visitors' personal data". Whatever you pick, check its current terms rather than a blog post, including this one.
The ICO adds that you "must not solely rely on browser settings" as a sign that someone doesn't object, so the opt-out needs to be on your site. A link in the footer to a short page with an on/off switch is enough for most small sites.
Advertising, pixels and social embeds still need consent#
Nothing about advertising became exempt. The ICO is blunt: "There are no advertising purposes that meet the strictly necessary exception." Consent is still needed for:
- ad and remarketing pixels from social networks and search ads;
- social media tracking, whether or not the visitor is a member of that network;
- cross-site or cross-device tracking and fingerprinting;
- analytics that logs or profiles individual visitors.
If you run any of these, you need a banner, and the ICO's page on managing consent sets out how it should behave:
- Make refusing as easy as accepting. "Accept all" without "Reject all" is bad practice.
- Leave non-essential options switched off until the visitor turns them on.
- Load nothing that needs consent until the visitor agrees.
- Let people change their mind as easily as they agreed, for example from a link in the footer.
- If someone refuses, wait before asking again; the ICO suggests "six months is a suitable timeframe".
Web fonts count too#
Many templates load fonts from an external service, and every font request sends the visitor's IP address to that service. The ICO deals with this under the appearance exception: "external font libraries may collect information about your users, such as their IP address", and "where this occurs, you must explain this to your users and give them a simple and free way to object." Its suggested fix is simple: "You could consider self-hosting fonts by downloading them from an external service and uploading them to your server."
Freeframe's HTML templates load fonts from Google Fonts with a <link> in each page's <head> (see
Customizing: fonts). You have two options:
- Keep the link and mention it in your privacy notice: which fonts service you use, what it receives (the visitor's IP address) and why.
- Self-host the fonts. Download the font files (the fonts are under the SIL Open Font License, see
License), put them in
assets/fonts/, add@font-facerules to your CSS and remove the Google Fonts<link>tags. The@themefont stacks stay as they are, so the design doesn't change. Some of the Next.js versions already self-host their fonts.
Self-hosting is usually the tidier choice: one less third party to explain in your privacy notice.
What about the templates' saved data?#
Several Freeframe templates remember things in the visitor's browser with localStorage. The
Hearth template keeps a half-written enquiry and the walks a visitor saved, and
Launch remembers whether the visitor chose the dark or light theme. Measured against the
exceptions:
- Saved drafts, baskets and favorites are things the visitor asked for, so they fall under strictly necessary. The ICO's examples include "recording information or selections the user makes on an online service".
- A theme or language choice is the appearance exception. The ICO gives dark mode and a chosen language as examples; mention it in your privacy notice.
None of this is sent anywhere, and the templates keep working when storage is blocked. If you add your own scripts, the same test applies: what is the purpose, and does the visitor benefit from it?
Check your own site in half an hour#
- List what loads. Open your site in a private window, open the browser's developer tools and look at the Network tab, then Application (or Storage) for cookies and local storage. Click through the main pages and the contact form.
- Give each item a purpose. Fonts, analytics, maps, video embeds, booking or chat widgets, pixels. Look up anything you don't recognize.
- Match it to an exception. If everything fits one, you don't need a consent banner.
- Write the explanation. Add a short section to your privacy page listing each item, what it does and who provides it, with an opt-out for analytics. Link it from the footer of every page.
- Fix what doesn't fit. Self-host the fonts, swap an embedded map for a link or a static image, or click to load a video. If you keep an ad pixel, add a banner that loads it only after consent.
- Repeat when something changes. A new widget for the Christmas rush is the moment to run through the list again.
The short version#
- No banner is needed if everything on your site is strictly necessary, simple analytics or an appearance preference, provided you explain it and offer an opt-out where the law asks for one.
- Advertising, pixels, social tracking and analytics a provider uses for itself still need prior consent.
- Local storage and web fonts are covered as well as cookies. Self-hosting fonts removes one item from the list.
- These are UK rules; if you sell to customers elsewhere, check the rules there too.
Getting ready for the Christmas rush? Our posts on holiday opening hours and Black Friday sales cover the rest of the seasonal jobs.
