Does a small business website need a cookie banner?

Corven guide, 7 October 2026

It depends on what your cookies do. Regulation 6(1) of the Privacy and Electronic Communications Regulations 2003 prevents a website from storing information on a visitor's device, or reading it, except as Schedule A1 allows. Consent is one of those routes, but since 5 February 2026 Schedule A1 also sets out several exceptions that need no consent.

When consent is needed

Paragraph 2 of Schedule A1 allows storage or access where the visitor is given clear and comprehensive information about its purpose and gives consent. Cookies that fall outside every exception, such as advertising cookies, need that consent, which is what a cookie banner asks for.

The exceptions that need no consent

Paragraph 4 covers storage or access that is strictly necessary to provide a service the visitor has asked for, such as keeping a shopping basket, protecting security or preventing fraud.

Paragraph 5 covers cookies whose sole purpose is to collect statistics about how your service or website is used, with a view to improving it. The information must not be shared except with someone helping you make those improvements, the visitor must be given clear and comprehensive information, and the visitor must be offered a simple, free way to object and must not have objected.

Paragraph 6 covers cookies whose sole purpose is to adapt how the website looks or works to the visitor's preferences, or otherwise to enhance its appearance or functionality, again with clear information and a simple, free way to object.

What this means for your website

A site that uses only strictly necessary cookies needs no banner at all. A site that uses statistics or preference cookies needs clear information and a simple way to object. A site that uses advertising cookies needs consent before they are set.

This guide is general information about the law of England and Wales. It is not advice on your situation.