Cookie consent and GDPR: a practical guide for small websites.

Cookie banners are one of the most confusing parts of running a website. Some sites load every tracking script the moment the page opens and show a banner that changes nothing. Others install a heavy consent tool that slows the site down and annoys visitors. Neither is a good outcome.

This guide covers the main principles behind cookie consent in the UK and EU, how other regions differ, how to set up consent so it actually controls your tags, and how to keep the banner from hurting performance.

Which rules apply?

Cookie rules come from more than one law, which is part of the confusion:

• UK: the Privacy and Electronic Communications Regulations (PECR) cover storing or reading information on a visitor's device, including cookies. UK GDPR and the Data Protection Act 2018 cover the personal data involved. The Data (Use and Access) Act 2025 amends some of these rules, including possible exemptions for certain low-risk cookies; check the Information Commissioner's Office (ICO) website for current guidance on what is in force.
• EU: the ePrivacy Directive, implemented by each member state's own law, covers cookies, while the GDPR sets the standard for what valid consent means. The European Data Protection Board (EDPB) publishes guidelines, and national regulators publish their own.
• US: there is no single federal equivalent. Several states, including California under the CCPA as amended by the CPRA, generally use an opt-out model for selling or sharing personal information, with requirements such as a "Do Not Sell or Share My Personal Information" link and respecting browser opt-out signals like Global Privacy Control.
• India: the Digital Personal Data Protection Act 2023 sets consent-based rules for processing digital personal data, with its implementing rules being phased in. If you have Indian users, ask your adviser how it applies.

If your audience spans several regions, many businesses apply the stricter UK/EU approach to everyone, or configure their consent tool to behave differently by region. Your lawyer can advise which suits you.

What valid consent generally looks like in the UK and EU

Regulator guidance points to a few consistent principles:

• Consent comes first. Non-essential cookies and scripts shouldn't run until the visitor agrees. Analytics, advertising pixels and session recording tools are generally treated as non-essential.
• It generally needs to be a clear action. Messages like "By continuing to browse, you accept cookies" don't amount to valid consent under the regulators' guidance. Pre-ticked boxes don't either.
• Rejecting should be as easy as accepting. A prominent "Accept all" next to a hidden or multi-step reject option is the kind of design regulators have criticised. A "Reject all" button at the same level as "Accept all" is the safer pattern.
• People need to know what they're agreeing to. Group cookies by purpose and explain each group in plain language, with a link to your cookie policy.
• Consent can be withdrawn. Provide a persistent "Cookie settings" link, usually in the footer, so visitors can change their choice at any time.

Strictly necessary cookies, such as those that keep a shopping basket or a login session working, generally don't need consent, but you should still explain them.

Step 1: Find out what your site sets

You can't control what you haven't listed.

1. 1 Open your site in a private browser window without accepting anything.
2. 2 Open the browser developer tools and go to the Application tab (Chrome and Edge) or Storage tab (Firefox).
3. 3 List every cookie and local storage item that appears before you interact with the banner.
4. 4 Check the Network tab for requests to analytics, advertising and other third-party services.
5. 5 Repeat on key pages such as product, checkout and contact pages, because some scripts only load there.
6. 6 Group each item as necessary, functional, analytics or advertising, and note which tool sets it.

Many consent platforms also scan your site automatically, but a manual check catches scripts the scanner misses, such as hard-coded tags in a theme.

Step 2: Make the consent tool control your tags

A banner that doesn't change what loads offers no protection. If you use Google Tag Manager, a common set-up is:

1. 1 Install your consent platform's GTM template, or its script, so it loads first.
2. 2 Use the Consent Initialization - All Pages trigger to set default consent states (usually "denied" for analytics and advertising in the UK and EU).
3. 3 In GTM's container settings, turn on the consent overview so you can see each tag's consent requirements in one place.
4. 4 For each tag, open Advanced Settings > Consent Settings and set the consent types it requires.
5. 5 Check that the consent platform updates consent states when the visitor makes a choice.
6. 6 Test with GTM's Preview mode: reject everything and confirm that non-essential tags don't fire, then accept and confirm that they do.

Also remove any tracking code hard-coded in the theme or added by plugins and apps, otherwise it will run regardless of the banner.

Google Consent Mode v2

Google Consent Mode passes the visitor's consent choices to Google tags such as Google Analytics and Google Ads. Version 2 uses four main signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. Google requires consent signals for certain advertising and measurement features for users in the European Economic Area, and many consent platforms support Consent Mode directly. Google's Consent Mode documentation explains the set-up.

There are two modes:

Consent Mode adjusts how Google tags behave. It doesn't make a site compliant on its own, and it doesn't control non-Google tags.

Keep the banner from slowing the site

Some consent tools add a lot of JavaScript and can delay rendering or shift the layout when the banner appears, which can hurt your Core Web Vitals. To reduce the impact:

• Choose a consent platform with a light script, and check its effect with PageSpeed Insights before and after.
• Show the banner as an overlay fixed to the bottom of the screen, rather than inserting it into the page and pushing content down.
• Avoid loading several heavy tag scripts at once after consent; review whether you still need each one.
• Test on a mid-range phone, not just a fast laptop.

Note that the consent script itself usually needs to load early so it can block other tags; deferring it too much can let tags slip through before it's ready.

Privacy policy and cookie policy

Most sites need a privacy policy that explains, in plain language, what personal data you collect (including through forms and analytics), why, the legal basis, who you share it with, how long you keep it, and how people can exercise their rights, such as asking for a copy of their data or for it to be deleted. In the UK and EU, organisations generally have one month to respond to such requests. A cookie policy, or a cookie section within the privacy policy, should list the cookies you use and what they're for. Templates are a starting point, but they need to reflect what your site actually does.

What about server-side tagging?

Server-side tagging sends data to your own tagging server first, which can then forward it to analytics and advertising tools. It can reduce the amount of third-party JavaScript in the browser and give you more control over what data is passed on, for example by removing IP addresses. It does not remove the need for consent: if the data comes from tracking a visitor, the same consent rules generally apply. It also adds hosting costs and set-up work, so it suits sites with more complex measurement needs.

Keep it up to date

Sites change. New marketing tools get added, plugins update and laws are amended. Review your cookie inventory and consent set-up at least once a year and whenever you add a new tool, ideally as part of regular website maintenance. If you sell internationally, our guide to international e-commerce covers other regional differences, and once consent is in place our GA4 reports guide shows what to check each month.

We can help with the technical side: auditing what your site loads, setting up a consent platform and Consent Mode, and making sure tags respect visitors' choices. Your lawyer should still confirm the legal side. See our web development work or get in touch.