What a cookie banner actually has to do under UK GDPR and PECR

Two laws, one banner

In the UK, cookies are governed by the Privacy and Electronic Communications Regulations (PECR), and the consent they require is defined by UK GDPR. The EU has the same pair: the ePrivacy Directive and GDPR. The practical rules are almost identical, so a banner that satisfies the ICO in the UK will generally satisfy EU regulators too.

PECR says you need consent before storing or reading anything on a visitor's device unless it is strictly necessary for a service the visitor asked for. Analytics, advertising and most personalisation cookies are not strictly necessary, so they need consent.

What "consent" means

UK GDPR defines consent as freely given, specific, informed and unambiguous, given by a clear affirmative action. Applied to a banner, that translates into six concrete rules:

1. No pre-ticked boxes. Optional categories must start off. Scrolling or continuing to browse is not consent.
2. Reject must be as easy as accept. If there is an "Accept all" button, there must be an equally visible way to decline. Hiding "reject" behind "Manage preferences" is the single most common failing the ICO calls out.
3. Granular choices. Visitors must be able to accept analytics but decline marketing, or vice versa. Necessary cookies can be locked on.
4. Informed. The banner must say what the cookies are for in plain language and link to a fuller cookie policy.
5. Withdrawable. It must be as easy to withdraw consent as it was to give it, so a persistent "cookie settings" link is expected.
6. Demonstrable. You must be able to show that consent was obtained. That means keeping a record of what each visitor chose and when.

Things that are not required

The law does not set a fixed lifetime for consent, though the ICO suggests re-asking periodically. Six to twelve months is common. It also does not require a banner on pages that only set strictly necessary cookies, and it does not require consent for server-side analytics that never touch the device.

Common failures

• Loading tags before the choice. GA4 or Meta Pixel firing on page load, then a banner appearing afterwards. Consent after the fact is not consent.
• "By continuing you agree." Implied consent has not been acceptable since 2019.
• Cookie walls. Blocking the whole site unless the visitor accepts everything is not "freely given" in most situations.
• Dark patterns. A bright "Accept" button next to a grey text link for "Reject" has been the subject of enforcement action across Europe.
• No record. Many banners store the choice only in the visitor's browser, so the site owner has no evidence if challenged.

A checklist for your WordPress site

• Every non-essential script waits for consent, including anything added by plugins.
• The banner has an equal-weight reject option on the first layer.
• Categories are off by default and individually selectable.
• The banner links to a cookie policy that lists what you actually use.
• A "cookie settings" link lives in the footer of every page.
• Each decision is logged with a timestamp and the categories chosen, without storing the full IP address.
• Consent expires and the banner reappears after a sensible period.

Keep it proportionate

Regulators have been clear that a small business with one analytics tool is not their priority. But the fix is also cheap: a banner that blocks scripts until consent, offers a real reject button and keeps a log covers the large majority of the obligations. Spending an hour on it now is far cheaper than an audit later.