If your business has a website, UK cookie law almost certainly applies, even if it\u2019s something simple you set up years ago or haven\u2019t touched since launch. This catches a lot of people out, especially smaller sites that assume they\u2019re \u201ctoo small to matter\u201d. The rules updated in February 2026 with the Data (Use and Access) Act <\/span>and in practice, many websites haven\u2019t really caught up yet. This breaks it down in plain English so you can see what needs changing, without having to decode legal guidance or ICO wording.<\/p>\n In practice, UK law cookie expects three things: tell people what cookies you\u2019re using, stop non-essential ones loading until they agree, and make it just as easy to refuse as it is to accept.<\/strong><\/p>\n The legal basis is PECR \u2014 the Privacy and Electronic Communications Regulations.<\/a> PECR applies to any website with UK visitors, even if that traffic is just a handful of local enquiries a month or the occasional referral from social media. It does not matter whether your business is a sole trader, partnership, or limited company.<\/p>\n Non-essential cookies are the extras your site doesn\u2019t need to function. Things like tracking visits, running ads, or embedding third-party tools. For example, Google Analytics, Meta Pixel, most live chat widgets, and even embedded YouTube videos will typically set cookies, often before anyone has clicked anything.<\/p>\n The 2026 DUAA update introduced a narrow analytics exemption. To qualify, cookies must only measure site performance, allow opt-outs, and exclude third-party sharing.\u00a0For more detail on whether that applies to your GA4 setup, see our guide to the analytics exemption.<\/a><\/p>\n There are six main pieces to get right: a cookie banner that blocks non-essential cookies before consent, a cookie notice or policy, a working decline option, a privacy policy, correct business information, and a record that consent was given.<\/strong><\/p>\n This is one of those things that looks fine at first glance, but is often where compliance quietly breaks, especially on DIY Wix<\/a> or Squarespace <\/a>builds. Platforms like Wix and Squarespace have built-in cookie tools, but many of them load analytics and third-party scripts before the visitor clicks Accept. That is non-compliant. In practice, that means cookies shouldn\u2019t load until someone has actually given consent, not just been informed. Most people only realise this after running a scanner and seeing analytics fire before the banner is clicked, it\u2019s a common surprise.<\/p>\n Declining must be as easy as accepting. If someone has to hunt for the \u201cDecline\u201d option, or it\u2019s tucked behind extra clicks, that\u2019s usually where things fall short. The ICO is clear on this: People need a real choice, not like one option has been designed to do all the encouraging.<\/p>\n This is a page (or section of your privacy policy) that lists every cookie your site sets, what each one does, and how long it lasts. This is where a lot of site owners guess, but cookie policies based on assumptions tend to miss half the scripts running in the background.<\/p>\n UK GDPR<\/a> requires a privacy policy that explains what personal data you collect, why, how long you keep it, and who you share it with. Contact forms, newsletter sign-ups, and booking systems all count as personal data collection. But in real-world terms it\u2019s less about legal wording and more about being transparent with what data you\u2019re actually collecting.<\/p>\n If you are a limited company, your website must show your registered company name, company number, and registered office address. This is a separate requirement under the Companies Act 2006 and it often gets overlooked because people are focused on cookies instead. Sole traders must show their full name and a business address.<\/p>\n If you are using a consent management platform (CMP), it will log consent automatically. If you built your cookie banner manually, you need a way to evidence that consent was obtained for each visitor session.<\/p>\n Not sure what your site currently has?<\/p>\n Our free compliance checker scans your website and tells you exactly what’s in place and what’s missing. It takes 30 seconds and covers cookies, privacy policy, business information, and more.<\/p>\n Check your website now \u2192<\/a><\/p>\n Three tools: your browser’s Developer Tools to see what cookies load, a cookie scanner to list all third-party scripts, and a quick check of your site’s footer and legal pages.<\/strong><\/p>\n Open your website in Chrome or Firefox. Press F12 to open Developer Tools. Click Application > Cookies > your domain. Reload the page without accepting the cookie banner and see what loads immediately. Any cookie that appears before you click Accept is being set without consent. This is usually the point where people realise their site is doing more than they expected in the background.<\/p>\n Next, check your legal pages. Does your site include a Privacy Policy, a Cookie Policy, and a footer featuring your company name and number (if applicable)?<\/p>\n For a full list of scripts running on your site, use tools like Cookiebot. Their free scanner or Lighthouse in Chrome DevTools can identify third-party requests you may have forgotten about. Particularly from embedded forms, booking widgets, or social share buttons.<\/p>\n No. Both platforms give you tools to build a cookie banner, but neither configures it correctly by default \u2014 and neither audits the third-party apps you add to your site.<\/strong><\/p>\n Wix\u2019s built-in cookie consent tool shows a banner, but in practice, we still see setups where Google Analytics or similar tools fire before consent\u2014especially if you add extra apps<\/b> later.\u00a0For the specific steps to check and fix your Wix cookie setup, see our guide to Wix cookie compliance<\/a>.<\/p>\n Squarespace’s cookie banner has similar limitations. The built-in tool does not block scripts loaded by third-party blocks or integrations. If you have an Instagram feed, a Calendly booking widget, or a Mailchimp pop-up embedded in your Squarespace site, those are dropping cookies regardless of your banner settings.<\/p>\n A sensible first step is to run the audit, then take a realistic view of whether this is a quick fix or something that\u2019s been layered over time and now needs a proper rebuild.<\/strong><\/p>\n Fixing an existing site typically involves: installing a proper consent management platform (CMP) like CookieYes or Cookiebot, configuring it to block all non-essential scripts before consent, auditing every app and widget on your site, updating your cookie notice with accurate information, and adding or updating your privacy policy.<\/p>\n If you are on Wix or Squarespace and using multiple third-party tools, this can take several hours \u2014 and it needs to be maintained every time you add a new app or plugin.<\/p>\n If you’d rather have a properly built site from day one \u2014 with compliance handled, not patched \u2014 Duport’s website build covers this as standard. Everything is configured correctly before you go live. You are not retrofitting compliance onto a DIY build. It starts from \u00a3360, mention this article when you get in touch and we’ll honour the \u00a3144 rate.<\/p>\nWhat does UK cookie law require from a small business website?<\/h2>\n
UK cookie compliance checklist: what does your website need?<\/h2>\n
\n
\n
\n
\n
\n
\n
How do I audit my existing website for cookie compliance?<\/h2>\n
Do Wix and Squarespace handle cookie compliance automatically?<\/h2>\n
What should I do right now to get compliant?<\/h2>\n