Cookie banners and GDPR: what a small site really needs

Most small business sites run a cookie banner that does one of two wrong things. Either every tracking script fires the moment the page loads, banner or no banner, or the wording is so vague that nobody can tell what they're actually agreeing to. Under UK GDPR and PECR, both count as non-compliant, and as of 2026 the penalties for getting it wrong look a lot more like a data breach fine than a slap on the wrist.

What the rules actually require

PECR, the Privacy and Electronic Communications Regulations, governs cookies and similar tracking technologies, and it sits alongside UK GDPR rather than replacing it. Between the two, the baseline is simple: any cookie that isn't strictly necessary for the site to function needs informed, opt-in consent before it loads. Not after a click, not on a delay, before.

• No pre-ticked boxes, and no 'by continuing to browse you accept cookies' banners
• Analytics, advertising, embedded video and social widgets all need a genuine yes first
• Rejecting has to be just as easy as accepting, same visibility, same number of clicks
• The site needs a record of what was agreed to, and a way to change that choice later

The fines are not theoretical any more

Most small businesses will never see a fine anywhere near that figure, but the direction of travel matters more than the headline number. Cookie and tracking enforcement now carries the same maximum penalty as a personal data breach, and the ICO finalised updated tracking-technology guidance on 29 April 2026, moving away from warning letters toward active monitoring of common platforms and plugins. A five-page trades site and a national retailer's checkout run on the same legal baseline. The difference is that fixing a small site costs a correctly configured banner, not a legal team, which is exactly why there's no real excuse to leave it half-done.

What a compliant banner actually has to do

The legal text matters less than the behaviour behind it. A banner can read perfectly and still fail an audit if the scripts underneath it don't actually respect the answer a visitor gives.

Where most small sites actually go wrong

• Installing a cookie banner plugin once and never checking what it actually blocks
• Google Analytics or a Meta Pixel firing on page load regardless of the visitor's answer
• A banner with a prominent Accept button and a Reject buried in a settings submenu
• No privacy policy link next to the banner, or a policy that doesn't name the tools actually loading cookies
• A new booking widget, chat tool or embed added later that was never wired into the consent setup

Who should own this

Getting the banner wording right is the easy part. Most of the actual risk lives in the implementation underneath it: confirming tracking scripts are routed through the consent tool rather than sitting loose in the page template, testing that Reject genuinely blocks loading rather than just hiding the banner, and keeping the policy text current when a new tool gets added. That's maintenance work, not copywriting, and it needs rechecking every time the site changes, not just once at launch. Our maintenance and support plans include a consent-tool check as standard, because it's one of the easiest things to quietly break when a site evolves and nobody remembers to look.

A cookie banner that looks right but doesn't behave right is worse than having no banner, because it hands visitors a false sense of control while the tracking scripts carry on regardless. If nobody has checked what your banner actually blocks since the day it went live, that's a 20-minute job worth doing this week, before a regulator or a competitor does it for you.