UK Cookie Consent: Four Cookie Types to Block Before Choice
Non-essential cookies need prior, valid consent in the UK, and you must run a cookie banner and cookies page that meet ICO and GOV.UK standards. Consent means a clear positive action, never silence or a pre-ticked box. Users must be able to choose by purpose and withdraw as easily as they agreed. Follow the ICO’s guidance and the GOV.UK patterns, and you remove most of your enforcement risk.
TL;DR:
- Strictly necessary cookies, such as login sessions, security, and shopping baskets, are exempt; analytics, marketing, personalization, and embedded social media cookies need prior consent.
- A valid banner offers accept all, reject all, and purpose based preferences, with every nonessential toggle off by default and rejection as prominent as acceptance.
- The cookies page must list each cookie’s purpose, expiry, and recipients, while the site keeps consent records and works on mobile without JavaScript.
- Nonessential scripts must remain blocked until consent, rejected choices must persist across visits, and withdrawals must stop processing immediately rather than waiting for another session.
- No law sets a fixed consent lifetime, but teams should ask again when purposes change or new nonessential cookies are added.
Table of Contents
- Which laws apply and who enforces them
- When consent is required and the strictly necessary exemption
- What valid consent looks like under UK GDPR
- Cookie banner and cookies page requirements
- Technical implementation checklist and recordkeeping
- How long consent lasts and when to ask again
- Common mistakes, ICO enforcement concerns, and red flags
- Why good consent design protects conversion too
- Get your cookie consent set up properly with our team
- FAQ
- Sources
Which laws apply and who enforces them
The relevant laws work together. The Privacy and Electronic Communications Regulations (PECR) govern storing or reading information on a visitor’s device, which is what cookies and similar technologies do. UK GDPR supplies the definition of consent and the tests that consent must pass. The Information Commissioner’s Office (ICO) enforces both, publishes the guidance most teams work from, and has written to organizations whose banners fell short.
Practically, that gives you several duties. You need consent before setting non-essential cookies. You must be transparent about what each cookie does and who receives the data. You must keep records that show how consent was given. The sections below turn each duty into something your team can build and test.
When consent is required and the strictly necessary exemption
The first job is sorting your cookies. Strictly necessary cookies are exempt from consent. Think of the session cookie that keeps a user logged in, the cookie that remembers a shopping basket, security cookies, and load-balancing cookies that keep the site responding. These exist because the user asked for a service and the service cannot work without them.
Everything else needs consent before it is set:
- Analytics cookies that measure traffic or behavior
- Marketing and advertising cookies, including retargeting pixels
- Personalization cookies that tailor content or layout
- Social media cookies from embedded plugins
The exemption is narrow. The GOV.UK Design System is explicit that helpful or convenient cookies that are not essential to the core functionality of the requested service still require user consent. A cookie that improves your reporting, speeds up a checkout experiment, or remembers a preference the user never asked you to save does not qualify just because it is useful to you. When you are unsure which side a cookie falls on, treat it as non-essential and gate it behind consent.
What valid consent looks like under UK GDPR
The ICO’s consent guidance sets the standard. Consent has to be freely given, specific, informed, unambiguous, and demonstrable, and it must come from a clear positive action. Silence, inactivity, or continued scrolling does not count.
Turn that into design rules:
- No pre-ticked boxes. Every non-essential toggle starts off.
- No bundling. Cookie consent cannot be folded into your terms and conditions. The ICO’s cookie banner concerns document says banners must offer granular, distinct options for different types of processing.
- Purpose-level choices. Let people accept analytics without accepting advertising.
- Named third parties. Tell users who else receives data through your cookies.
- Equal prominence. A reject option must be as visible and as easy to use as accept.
- Easy withdrawal. The ICO expects consent to be as easy to withdraw as to give, so link to your cookie settings from a cookies page or footer link.
- A consent log. Keep proof of what each visitor agreed to, and when.
If your banner highlights “Accept” in a bright button and renders “Reject” as small grey text, it fails this test.
Cookie banner and cookies page requirements
The GOV.UK Design System gives commercial teams a ready blueprint, and the ICO’s checklists line up with it. Build to this specification:
- Offer three clear actions on the banner: accept all, reject all, and a route to manage preferences by purpose.
- Load every non-essential toggle set to “no” on the first visit.
- Keep the banner on screen until the visitor makes a choice, then show a short confirmation message.
- Publish a cookies page listing each cookie’s name, purpose, expiry, and third-party recipients.
- Store the visitor’s choice in a preference cookie so you are not asking again on every page. The GOV.UK cookie banner component gives storing preferences for up to one year as an example.
- Make both the banner and the cookies page work on mobile and without JavaScript.
On that last point, the ICO’s guidance on managing consent in practice warns that a mechanism that is not functional or readable on mobile may make consent invalid. The same guidance says a banner should give clear information without being unnecessarily disruptive. Compliance is a balance between a usable experience and legally valid consent.
Pro Tip: Test your banner on a small phone screen first. If the reject option falls below the fold or needs a second tap, fix that before anything else.
Technical implementation checklist and recordkeeping
A compliant banner means little if scripts fire before the visitor clicks. Consent has to control what actually loads, so engineers and product leads should work through this list:
- Block or delay every non-essential script and tag until consent is given, using tag manager gating or server-side controls.
- Record each consent event in a secure log, whether in your consent management platform or your backend, showing what was agreed, when, and through which interface.
- Provide a no-JavaScript fallback so the choice mechanism still works for everyone.
- Check behavior in privacy-conscious browsers and on mobile, where blockers and storage limits can interfere.
- Confirm that rejected cookies stay blocked across page loads and return visits.
- Verify that withdrawals are honored immediately, not at the next session.
- Audit third-party tags, since a vendor script that ignores your consent state is still your problem.
Run these checks with your browser’s developer tools open, watching the cookies and network panels before and after each choice. If a non-essential cookie appears before any click, you have found a defect. If you are weighing options for measurement, an external roundup of analytics tools can help you compare platforms, though you should confirm each one can respect your consent signals.
How long consent lasts and when to ask again
There is no fixed statutory lifetime for cookie consent. The ICO points to factors you should weigh, such as the nature of your cookies and how your use of them changes, rather than a hard deadline. In practice, many teams re-request consent periodically, based on the nature of their cookies and how their use changes.
Ask again sooner when your purposes change or you add new non-essential cookies, because the earlier choice no longer covers what you do. When a user withdraws consent, stop the processing straight away and, where appropriate, remove the data collected under that consent. For email and communications consent, see our guide to UK GDPR email marketing.
Common mistakes, ICO enforcement concerns, and red flags
The ICO’s concerns tend to repeat. Banners bury the reject option or make it harder than accepting. Non-essential cookies are set even after the visitor says no. Third parties go unnamed, and consent is bundled with other terms. The ICO has stated that a banner emphasizing “agree” or “allow” over “reject” is a non-compliant approach.
Fixes follow directly. Give reject equal prominence, confirm scripts respect stored preferences, name every third party and purpose, and keep auditable consent logs.
Before an audit, run this short check:
- Is the reject button as visible as accept?
- Does any non-essential cookie load before a choice?
- Does a rejection persist after a refresh?
- Does withdrawal work from the footer link?
- Does every cookie appear on the cookies page?
Why good consent design protects conversion too
Compliance is not something to negotiate with the conversion rate. Block non-essential cookies by default, write banner copy that is clear without nagging, and then recover measurement through approaches that respect consent. Our posts on Consent Mode V2 and cookieless marketing show how. When you are unsure, A/B test within compliant options only, and bring in legal before trying anything aggressive.
— Alex
Get your cookie consent set up properly with our team
Many teams would rather hand this to specialists than juggle legal guidance, tag gating, and reporting alone. We build consent into your site and your measurement. Here is what we deliver:
- A consent audit that shows what your site sets today and where it falls short
- Banner and cookies-page builds that follow ICO and GOV.UK patterns
- Consent-mode and measurement implementation
- Technical integration with your tags, platforms, and consent logs
Ready to reduce your enforcement risk and keep your reporting useful? Explore our services.
FAQ
Is cookie consent required in the UK?
Yes, for non-essential cookies. PECR requires consent before you store or access information on a visitor’s device, unless the cookie is strictly necessary. Strictly necessary cookies, such as those for security or a shopping basket, are exempt, as the GOV.UK Design System explains.
What are the main cookie rules in the UK?
You must get prior consent through a clear positive action, offer granular choices, and explain each cookie’s purpose and third parties. You must also make withdrawal as easy as giving consent and keep records. The ICO’s cookie banner concerns describe what regulators flag as non-compliant.
Does GDPR require cookie consent?
UK GDPR does not create the cookie rule on its own, but it defines what valid consent means. PECR requires consent for non-essential cookies, and UK GDPR sets the standard that consent must meet: freely given, specific, informed, and unambiguous.
Can I refuse to accept cookies?
Yes. Visitors should be able to reject non-essential cookies, and the reject option must be as easy to use as accept. You should still be able to use the core service, because strictly necessary cookies are exempt from consent.
Sources
Recommended
Other posts
Stay ahead with better decisions.
Get business insights today.
