Does your website need a cookie banner?

You’ve seen them on almost every website: a box that pops up over the page saying “We value your privacy”, with buttons to accept, reject or “manage preferences”. Many small business websites have one too.

We often ask owners with one of these banners how many people visit their website each month. Many can’t say. The banner was set up by a plugin, a template or whoever built the site, and the data it asks permission for goes to tools nobody looks at. Meanwhile it covers the page. It’s the first thing every visitor sees, and it often gets in the way: an extra step before they can read anything, sitting over the phone number or the enquiry button until it’s dismissed.

So, does your website need one? If it uses the usual analytics and advertising tools, very likely yes. But it doesn’t have to be that way. With a little thought about what you really need to know, you can still see how your website is doing, with figures you’ll actually use, without tracking your visitors and without the banner.

When you need permission

The rule isn’t really about cookies. It’s about storing or reading anything on a visitor’s device, whether that’s a cookie or something similar. The law says you need the visitor’s permission first, with a few exceptions. That’s what a cookie banner is for: asking.

You don’t need permission for things your website needs to do what the visitor asked for, such as remembering what’s in a shopping basket. The ICO calls this “strictly necessary”.

You do need permission for anything to do with advertising, or tracking people as individuals. The ICO is clear that there are no advertising purposes that count as strictly necessary.

The new rule for counting visits

Until this year, analytics that used cookies or similar technology needed permission first, even if all it did was count visits. That changed on 5 February 2026, when the Data (Use and Access) Act brought in an exception for statistics, whether the analytics uses cookies or not.

You can now count visits without asking first, as long as:

• the only purpose is statistics about how your website is used, so you can improve it
• you give visitors clear information about it, usually in your privacy notice
• you give them a simple, free way to say no

It doesn’t cover tracking individual visitors, recordings of what people do, or anything shared with advertisers. Those still need permission. You can use an outside analytics service, as long as it works for you rather than using the data for itself (ICO guidance).

Check what your website actually loads

A banner is only needed if something on your site needs permission, so the first job is finding out what’s there. Common culprits on small business websites are:

• analytics set up years ago and never looked at
• advertising tools, such as a Facebook pixel, added for a campaign that’s long over
• videos, maps and social media feeds embedded from other sites, which can come with their own cookies

Each of these needs looking at separately: even a cookie-free analytics service says plainly that other scripts on a page need their own check. If a tool isn’t earning its place, removing it is often simpler than asking permission for it.

How we do it

We build websites that are easy to use and don’t interrupt your visitors: no tracking you don’t need, and no banner over the page. We count visits with simple, cookieless analytics, which collects less in the first place. It counts visits, pages and where visitors came from in total, not individual people. Each site’s privacy page explains it and has a “Don’t count my visits” button, so it’s within the rules without a banner.

Your own dashboard then turns those totals into figures you can use: how many people visited, how many got in touch, and where they found you. That’s more useful than a pile of data nobody opens, and your visitors’ privacy is respected.

You still need a privacy notice

Whether or not you need a banner, if your website collects personal details, even just a name and email through a contact form, the law says you must tell people at the time you collect them. That’s your privacy notice. It should cover:

• who you are, and how to contact you
• what you collect, and what you use it for
• why you’re allowed to use it (for an enquiry form, usually that you’re replying to what they asked)
• who helps you, such as your website host and email service
• how long you keep it
• people’s rights, including to see or delete what you hold, and to complain to the Information Commissioner’s Office

Link to it from your footer, and next to your forms.

Next step

Not sure what your website loads, or whether it needs that banner? Our website review goes through your site by hand, and can include what it loads and whether you need that banner, explained in plain English.