A cookie is a small piece of information a website stores on a visitor’s device. It can help remember something, such as items in a shopping basket or a choice made during a visit.
Other cookies support statistics or advertising. That’s why websites ask about preferences. Different uses have different requirements, and visitors need appropriate information and control.
You’ve probably selected reject on a banner yourself. When you do, you expect the website to follow that choice. Your customers should be able to expect the same from yours.
The banner needs to match the website
A banner is the part visitors see, but the website may use several tools behind it. Those could include analytics, advertising measurement or features supplied by another company.
Adding a banner doesn’t automatically connect all those tools to its controls. A reject button can look right while something continues running, or a tool can start before anyone has made a choice.
That’s why the setup needs checking as well as the wording. Someone needs to understand what’s installed, what it does and when it runs. The explanation to visitors can then reflect what’s actually happening.
The rules also cover technologies beyond cookies, including some tracking pixels, browser storage and scripts. A tool doesn’t fall outside the rules simply because its provider says it uses no cookies.
Some uses need consent and others may qualify for an exception
In the UK, PECR generally requires consent for storing information on, or accessing information from, a visitor’s device unless an exception applies. Some uses essential to a service the visitor requests can qualify, such as keeping their shopping basket working.
Advertising related storage or access requires consent, including when it supports advertising measurement. Something useful to your marketing isn’t automatically essential to the visitor’s request.
Where personal information is involved, UK GDPR duties apply as well. The right arrangement depends on what the tools actually do and how their information is used.
There is a narrower exception for some website statistics
The ICO finalised updated guidance in April 2026. It explains an exception for some analytics used solely to produce aggregate statistics about how a service is used, with a view to improving it.
Visitors must receive clear information and a simple, free way to object. Individual information should only be kept as long as needed for aggregation. Any provider must act on your behalf for the permitted purpose, without unrelated reuse or linking.
That doesn’t cover advertising measurement, individual tracking or profiling. A service calling itself analytics doesn’t establish that it qualifies. Its settings, actual use and provider terms need assessing against the conditions.
This is where older guidance can be misleading. It’s important to distinguish the narrow exception from the consent requirements that still apply to other uses.
The choices should be straightforward
Where consent is needed, visitors should make an active choice before the relevant technology runs. Continuing to browse doesn’t count as agreement.
Refusing should be as easy as accepting. Someone shouldn’t need to work through extra screens to find a reject option while an accept button is immediately available. They should also be able to change their choice later.
Plain wording helps people understand what they’re deciding. The technical detail needs to be accurate, but the visitor shouldn’t need specialist knowledge to use the controls.
The setup can change even when the banner doesn’t
A new plugin, advertising campaign or embedded feature may change what runs on your website. Existing controls may need adjusting even if they look exactly as they did before.
Checking what happens before a choice, after acceptance or rejection, and when someone changes their mind helps establish whether the setup still works. An applicable objection to exempt statistics needs to be respected too.
You don’t need to learn how every script works. You should understand why your website uses these tools and who looks after the arrangement.
If that’s unclear, get in touch with Plastic Box Digital Marketing. We can talk through the website setup and what needs reviewing, using current ICO guidance to support the decisions.