European Union & United Kingdom
Website privacy and cookie consent
GDPR and cookies: What your website needs to do
Two separate checks decide what your website may do with cookies and tracking. Device rules cover storing or reading information on a visitor’s device, and GDPR covers what you do with personal data. Many tools trigger both at once, and the EU and UK now differ on some exceptions.
At a glance
- Who it can apply to
- Organisations established in the EU or UK, and organisations elsewhere that offer goods or services to people there or monitor their behaviour there.
- What it is
- Two layers of law: the EU GDPR and UK GDPR for personal data, plus device rules (national laws implementing Article 5(3) of the ePrivacy Directive in the EU, PECR in the UK).
- Choices to offer
- Opt-in consent before non-exempt cookies and similar technologies, with a clear way to refuse and to withdraw later. In the UK, some statistics and functionality uses need clear information and a free way to object instead.
- Website actions
- Map each tool’s purpose, data and recipients.
- Keep optional tracking off until the visitor consents.
- Make refusing and withdrawing as easy as accepting.
- Check EU and UK exceptions separately before relying on one.
- Retest after adding tools or entering a new market.
- Primary sources
- GDPR, ePrivacy Directive, PECR regulation 6 and the ICO’s guidance on storage and access technologies.
- Last reviewed
Two checks: device access and personal data
Check 1: storing or reading information on the device. In the EU, this rule comes from Article 5(3) of the ePrivacy Directive, as implemented in each country’s law; in the UK, from regulation 6 of PECR. Consent is needed unless an exception applies, whether or not the information is personal data. The EDPB’s Guidelines 2/2023 show that this can cover tracking pixels, tracking links and unique identifiers, not just cookies.
Check 2: processing personal data. The GDPR, or the UK GDPR in the UK, governs what you do with personal data: lawful basis, transparency, retention, sharing, transfers and individual rights. Cookie IDs and IP addresses can be personal data.
Both checks often apply to the same tool. An analytics script that sets a cookie and sends visit data to a provider must pass the device rules, usually through consent, and needs a GDPR lawful basis for what follows. Legitimate interests cannot replace consent that the device rules require, and cookie consent does not settle retention, transfers or later uses.
Does GDPR apply to your business?
The EU GDPR applies to processing in the context of an EU establishment, and to organisations elsewhere that offer goods or services to people in the EU or monitor their behaviour there. A website that can merely be opened in Europe does not settle the question. The UK GDPR uses the same model for the UK, so assess both if you serve both markets.
Size is not an exemption: a small business can process personal data through forms, accounts, analytics and advertising tools. The EDPB’s small business guide explains the need for a lawful basis for each purpose.
Where the EU and UK rules differ
The device rules started from the same EU directive, but the UK has since changed PECR. Check EU and UK visitors separately before relying on an exception.
| Topic | European Union | United Kingdom |
|---|---|---|
| Rule source | European UnionArticle 5(3) of the ePrivacy Directive as implemented nationally, plus the GDPR. | United KingdomPECR regulation 6 and Schedule A1, plus the UK GDPR. |
| Core exceptions | European UnionTransmitting a communication, and storage or access strictly necessary for a service the user requested. | United KingdomThe same two, with examples such as security, fraud prevention and remembering selections. |
| Analytics and preferences | European UnionNo separate exception in the directive; national approaches differ. | United KingdomConditional exceptions for statistics and for appearance or functionality, in force since 5 February 2026. |
| Regulator | European UnionNational data protection authorities for GDPR; cookie rules may sit with another national authority. | United KingdomThe Information Commissioner’s Office (ICO) for both. |
| Maximum fines | European UnionGDPR: up to €20 million or 4% of worldwide annual turnover. Cookie-rule penalties are set nationally. | United KingdomUp to £17.5 million or 4% of global turnover, under the UK GDPR and now also PECR. |
In the EU, the EDPB leaves the scope of the exceptions to national law and national authorities. Analytics shows the difference: the Danish authorities say website statistics require consent, while some regulators, such as France’s CNIL, accept a narrow exemption for limited audience measurement.
In the UK, the Data (Use and Access) Act 2025 added exceptions for statistics, for appearance or functionality and for locating a device in an emergency. The ICO’s guidance sets the limits: the purpose must be the only one, visitors need clear information and a free, simple way to object, and an objection stops the storage or access. Profiling, tracking across services and anything related to online advertising still need consent.
October 2026: the European Commission’s Digital Omnibus proposal would change the EU cookie rules, including the exceptions to consent. It is still in the legislative process, so the current national rules apply.
What your website needs to do
Map purposes before choosing banner categories
List each tool and what it actually does: delivering the requested service, statistics, advertising measurement or audience building. For each purpose, record the data, recipients, retention and lawful basis. Remove tools without a clear purpose.
Using Google advertising or measurement products with visitors in the EEA or UK? Google’s own policy adds requirements for consent, disclosures and records: see our guide to Google’s EU User Consent Policy.
Make consent a real choice
Where consent is required, ask before the activity starts, explain each purpose and leave optional settings off. Scrolling, silence or continuing to browse is not consent, as the EDPB’s consent guidelines explain. Offer a refusal option as clear as the accept option and a persistent settings link: GDPR requires withdrawing consent to be as easy as giving it.
Connect the choice to what actually runs
A saved preference only helps if the website follows it. Check tag manager scripts, plugins, embedded videos and other widgets, not just whether the banner disappears. Moving collection to a server does not take the data outside GDPR.
Explain the data journey and handle rights
Your privacy information should cover who is responsible, purposes and lawful bases, recipients, retention, rights and international transfers, using the same names and purposes as the banner and cookie declaration. Set a process for rights requests. Not all rights are absolute, so assess each request rather than promising automatic deletion.
What this means for your reporting
If fewer visitors accept optional analytics, recorded traffic can fall without a fall in real visits. Note consent changes in campaign reports and compare results with orders and enquiries. Keep purposes apart too: an online shop’s basket cookie should not quietly become a marketing identifier when a visitor rejects advertising.
Website checklist
- Scope: record which regimes apply: EU GDPR, UK GDPR and the device rules of each country you target.
- Fresh visit: before any choice, no consent-dependent cookies, storage or requests appear.
- Reject: after reloading and browsing, optional storage and requests stay off, including server-side destinations.
- Partial choice: accepting one purpose starts only the matching tools.
- Withdraw: after reopening the settings and withdrawing, the affected tools stop.
- UK exceptions: if you rely on one, the information and free objection option are visible, and objecting stops the storage or access.
- After changes: repeat the checks when you add a tool, change a purpose or enter a new market.
FAQ
Is a privacy policy enough?
No. A policy describes processing. It does not obtain consent where consent is required or control what scripts actually do.
Must visitors accept analytics to buy something?
Do not make optional analytics a routine condition of checkout. Assess necessity from the service the customer requests, not from your reporting preferences.
Can one banner cover the EU and UK?
One system can support both, but its settings must match each regime. A setup that relies on the UK statistics exception may still need consent from visitors in EU countries where no equivalent exemption applies.
Do strictly necessary cookies need consent?
No, if the storage or access is strictly necessary for a service the visitor requested. It is still good practice to list them in your cookie information, and GDPR transparency rules apply where they involve personal data.
Do we need to keep proof of consent?
Where you rely on consent under GDPR, Article 7(1) of the GDPR requires you to be able to demonstrate it. Keep evidence of the information shown and the choice made, without collecting more personal data than that purpose needs.