How to implement a PECR-compliant cookie consent banner

Bottom Line Up Front

In the UK, you must not place any non-essential cookies on a user's device until they have given clear, positive consent. This means your analytics and marketing tools must be disabled by default when a user first lands on your site, only activating after they click an 'Accept' or 'I Agree' button. Implied consent—such as assuming a user agrees because they continue to use the site—is no longer legally compliant under the Information Commissioner’s Office (ICO) guidelines.

Understanding PECR and Cookies

The Privacy and Electronic Communications Regulations (PECR) sit alongside the UK GDPR. While the GDPR covers general personal data, PECR specifically governs cookies and similar tracking technologies. To be compliant, you must distinguish between two types of cookies:

• Strictly Necessary Cookies: These are essential for the website to function, such as keeping a user logged in or remembering items in a shopping basket. You do not need consent for these, but you must still inform users of their presence.
• Non-Essential Cookies: These include cookies used for analytics (tracking how people use your site), social media pixels, and advertising. You must obtain consent for these before they are loaded onto the user’s browser.

Step-by-Step Implementation

1. Audit your current cookies: Use a browser-based developer tool or an online scanner to identify every cookie your website currently sets. Many third-party scripts (like chatbots or heatmaps) add cookies you might not be aware of.
2. Categorise your cookies: Group them into categories like 'Necessary', 'Analytics', and 'Marketing'. This allows users to make an informed choice, such as accepting analytics but rejecting marketing.
3. Select a Consent Management Platform (CMP): For most small businesses, it is more efficient to use a tool like Cookiebot, OneTrust, or Termly. These platforms provide the necessary code to scan your site and generate a compliant banner.
4. Configure 'Prior Consent' (The 'Hold' Step): This is the technical core of the task. You must ensure your website code doesn't load non-essential scripts (like the Google Analytics tag) until the CMP sends a 'consent granted' signal.
5. Provide a withdrawal mechanism: PECR requires that withdrawing consent be as easy as giving it. Always include a 'Cookie Settings' link in your website footer so users can adjust their preferences at any time.

Best Practices for Compliance

The ICO emphasises that banners should not be designed to manipulate users. This means you should avoid 'dark patterns', such as making the 'Accept All' button much more prominent than the 'Reject' option. Relatable example: Think of it like a guest entering your home; you wouldn't start recording their conversation and selling their preferences to advertisers before they've even said hello.