Why this matters.
The Privacy and Electronic Communications Regulations (PECR), enforced alongside UK GDPR by the ICO, require websites to get informed consent before setting most cookies and similar tracking technologies — except those strictly necessary for the site to function. Many websites still use “implied consent” banners that don’t actually block tracking until a choice is made, which the ICO has stated does not meet the legal standard.
The ICO has been increasingly active on cookie compliance, writing to thousands of UK websites about non-compliant cookie banners and following up with formal action against those that don’t fix issues. Beyond regulatory risk, a properly configured cookie banner is also a trust signal — visitors increasingly notice (and complain about) sites that load tracking before asking permission.