← Blog · · Rules and security · 10 min read
The ICO changed its cookie guidance in 2026. Here's what UK cookie law now asks of a small business website, from banners to analytics, and what you can skip.
Updated October 2026. I first wrote this in June and have refreshed it to reflect what’s actually in force now. It’s practical guidance from a web developer, not legal advice.
If you’ve had an email from your cookie consent provider this year telling you something’s changed, you’re not imagining it. UK cookie law did change. And if you’ve been ignoring it hoping it’ll sort itself out, it won’t.
The good news is that for most small business websites, the actual work involved is pretty small, and you might be able to drop your cookie banner altogether. The bad news is that a few things need sorting, and one of them has been a legal requirement since June.
Three things landed in quick succession. The cookie changes in the Data (Use and Access) Act 2025 took effect on 5 February 2026. The ICO published its final guidance on cookies and similar tracking on 29 April. And since 19 June 2026, every business that handles personal data has needed a proper way to take data protection complaints. None of it has been explained particularly well to the people who actually need to know.
If you’ve already read my GDPR guide for small businesses, this picks up where that left off. The GDPR stuff hasn’t gone away. This is on top of it.
The Data (Use and Access) Act became law in June 2025, but it’s been switched on in stages. The part that matters here updated PECR (the Privacy and Electronic Communications Regulations), which is the bit of law that specifically covers cookies. Those changes came into force on 5 February 2026.
The short version: there are now five situations where you don’t need to ask for consent before setting a cookie. Three of them are genuinely new. And the maximum fines for getting cookies wrong have jumped significantly.
The rules also cover tracking pixels, local storage and fingerprinting, but I’ll say “cookies” because that’s what everyone calls them. The exemptions first, because they’re the part most people care about.
Previously, you needed consent for almost everything except “strictly necessary” cookies. The ICO’s guidance now lists five exceptions:
1. Analytics cookies (with conditions). The law calls this the statistical purposes exception. If a cookie is only used to collect statistics about how people use your website, so you can improve it, you don’t need consent. This is a big deal. It means properly configured, privacy-respecting analytics can run without a cookie banner.
The conditions matter, though. You have to give people clear information about what you’re collecting and why, and a simple, free way to object. Usually that’s an opt-out switch on your privacy page. And the data can’t be shared with anyone else unless they’re only helping you improve your site.
That last condition is where Google Analytics falls down. In its normal setup, Google can use the data for its own purposes, which isn’t the same as just helping you improve your website. I’d treat GA4 as needing consent. Privacy-friendly tools are a different story, and I’ll come back to those.
2. Cookies needed to send a communication. If a cookie is technically necessary to carry a message across a network, consent isn’t required. This one isn’t new.
3. Strictly necessary cookies. Also not new, but the law now spells out what counts. Shopping baskets, login sessions, remembering what someone typed into a form, and security cookies used to prevent fraud, block attacks or spot technical faults. Anti-bot protections and CSRF tokens live here. The test is still “strictly necessary for a service the person asked for”, and it’s still strict.
4. Appearance and preference cookies. New. Cookies that remember how someone wants your site to look or work, like a language choice, text size or dark mode. Same conditions as analytics: clear information and an easy way to object. It doesn’t cover personalising content based on what you think someone’s interested in. That still needs consent.
5. Emergency assistance. New, and almost certainly irrelevant to you. It’s for locating someone who’s asked for emergency help.
If you’re running a small business website with privacy-friendly analytics, no advertising tracking, and no third-party widgets that set cookies, you might not need a cookie banner at all now.
Some analytics tools don’t set cookies in the first place. Plausible, Fathom and Cloudflare Web Analytics all work without them. My own site uses Cloudflare Web Analytics and has no cookie banner. If you’d rather run something that does use cookies, like self-hosted Matomo, the analytics exception can cover it as long as you meet the conditions above.
That’s a genuine improvement. Cookie banners annoy visitors, slow down page loads, and for a lot of small business sites they were always overkill. If you can legitimately drop yours, do it. Just make sure your privacy policy is honest about what you do measure.
But. And this is important. If you’re using Google Analytics, Facebook Pixel, embedded YouTube videos, third-party chat widgets, or any advertising cookies, nothing has changed for you. You still need consent. The banner stays.
Mixed-use cookies are the trap. If you set a cookie for analytics but that same cookie also gets used for advertising targeting, the analytics exemption doesn’t apply. The whole cookie needs consent. The exemptions are specific and conditional. You can’t just claim “analytics” and wave away the consent requirement.
Under the old rules, the maximum fine for cookie breaches was £500,000. Since 5 February 2026, it’s £17.5 million or 4% of global annual turnover, whichever is higher. That’s the same ceiling as UK GDPR.
Let me be realistic. The ICO isn’t going to fine a three-person business £17.5 million for having a dodgy cookie banner. Fines are meant to be proportionate to the size of the business and how serious the breach is. But the ceiling being that high tells you the government is taking this more seriously than before.
The more practical risk for small businesses is the same as it’s always been: complaints. If a customer complains to the ICO about your cookie practices, they can investigate. And the ICO has more teeth than it used to.
One note on the name. On 30 September 2026 the Information Commissioner’s Office became the Information Commission, run by a board. It’s still called the ICO and you don’t need to do anything about it.
This one is easy to miss, and it’s been the law since 19 June 2026.
If you process personal data (and if your website has a contact form, you do), people need a way to make data protection complaints directly to you. When one comes in, you have to acknowledge it within 30 days, look into it without undue delay, keep the person updated, and tell them the outcome.
You also have to tell people they can complain to you, and the ICO suggests doing that in your privacy policy. If yours doesn’t mention it yet, you’re behind. Fix it today.
It doesn’t need special software. The ICO lists an email address, a complaint form or a phone line as perfectly good routes. Add a section to your privacy policy that says something like:
“If you’re unhappy with how I’ve handled your personal data, you can complain to me at [email address]. I’ll acknowledge your complaint within 30 days, keep you updated while I look into it, and let you know the outcome. If you’re not satisfied, you can also complain to the ICO at ico.org.uk.”
That’s all most small businesses need. A contact point, a clear process, and a pointer to the ICO for escalation.
Here’s the practical bit. If you’ve got a small business website, work through this:
Check whether you still need a cookie banner. Look at what cookies your site actually sets. If it’s just strictly necessary cookies and privacy-friendly analytics, you may be able to remove your cookie banner entirely under the new exemptions. If you’re not sure what cookies your site sets, open it in Chrome, press F12, go to the Application tab, and look under Cookies and Local storage.
If you’re keeping the banner, check it actually works. A lot of cookie banners on small business sites don’t actually do anything. The banner is there, but the tracking scripts load regardless of what the visitor clicks. That’s worse than no banner. Test it yourself: decline all cookies, then check the Network tab in your browser’s developer tools to see if analytics scripts still load.
While you’re there, check the basics the ICO’s guidance asks for. “Reject all” should be as easy to find as “Accept all”. Nothing optional should be switched on by default. And “by continuing to browse, you agree” has never counted as consent.
Update your privacy policy. Two things to add: a cookies section that reflects the current rules, and the complaints procedure. If you’re relying on the analytics or appearance exceptions, explain what you collect and how to opt out.
Review your analytics setup. If you’re running Google Analytics purely because it was set up years ago and nobody’s questioned it, this is a good time to ask whether you actually need it. For most small business sites getting under a thousand visitors a month, a tool like Plausible gives you everything you need without cookies, without consent requirements, and with a much simpler setup. Cloudflare Web Analytics is free if your site already runs through Cloudflare.
Check your third-party embeds. Embedded YouTube videos set cookies. Google Maps embeds can set cookies. Social media widgets set cookies. If you’ve got any of these on your site, they need to be covered by your consent mechanism or loaded only after consent is given. Showing a placeholder image until the visitor clicks works well for videos and maps. The ICO also suggests YouTube’s privacy mode, a note under the video saying that playing it sets cookies, or just linking to it instead.
I see a lot of small business owners paying £30, £50, even £100 a month for cookie consent management platforms. For a five-page business website, that’s almost always unnecessary.
If you do need a cookie banner, free options handle it perfectly well. Cookiebot’s free plan covers one domain with up to 50 subpages, and there are decent open-source banners too. If your site is built properly, the implementation takes about an hour.
And if the new exemptions mean you can drop the banner altogether, that’s one less thing to maintain, one less thing to pay for, and a better experience for your visitors.
The cookie rules got a bit better for small businesses in some ways and a bit stricter in others. The new exemptions are sensible and might let you get rid of your banner. The higher fines are unlikely to affect you directly, but they signal that the ICO is paying more attention. And the complaints requirement has been in force since June, so if your privacy policy doesn’t cover it, that’s the first thing I’d fix.
None of this requires spending money. None of it requires a consultant. It’s an afternoon’s work for most small business sites, and it’s the kind of thing that’s easy to put off until you get that one email from a customer or, worse, the ICO.
Not sure whether your site’s cookie setup is still compliant? Drop me a message and I’ll take a look. Takes five minutes and there’s no charge. I’d rather tell you it’s fine than have you worry about it.
Other posts on the same ground.
