[//] Upkeep
Cookies, privacy and what UK law actually requires
Cookie banners are everywhere and most of them are wrong. Small businesses tend to either ignore the rules entirely or copy a banner from another site without understanding what it does.
The actual requirements are more manageable than the noise suggests. This is general information rather than legal advice, and the regulator's own guidance is linked throughout.
Which cookies need consent
Cookies strictly necessary for the site to function — remembering what is in a basket, keeping someone logged in — do not require consent.
Everything else does: analytics, advertising, embedded content that tracks, social media pixels. Consent must be obtained before those load, which is where most implementations fail. A banner that fires Google Analytics on page load and then asks permission has already done the thing it was asking about.
The ICO's guidance on cookies (opens in a new tab) is the authoritative source and is written for non-specialists.
What a compliant banner looks like
Four properties, none of them technically difficult.
- Rejecting is as easy as acceptingIf "Accept all" is a button and refusing requires opening a settings panel, that is not a free choice.
- Nothing non-essential loads firstThe scripts must genuinely wait for consent.
- No pre-ticked boxesConsent has to be an active choice.
- Consent can be withdrawnThere should be a way to change the decision later, usually a link in the footer.
Your contact form is personal data
The moment someone submits a name and email address, you are processing personal data under UK GDPR. That brings obligations regardless of how small your business is.
In practice you need a privacy policy explaining what you collect, why, how long you keep it and who you share it with; a lawful basis for processing, usually legitimate interests or consent; and a genuine intention to delete data you no longer need.
This is not onerous for a business collecting a handful of enquiries, but "we never got round to a privacy policy" is a gap worth closing. The ICO has specific advice for small organisations (opens in a new tab) including templates.
The trust angle
Beyond compliance, this affects how you are perceived. A site with no privacy policy and an aggressive cookie wall reads as careless with data — precisely the impression you do not want before someone hands you their details.
A short, honest privacy page saying what you actually do is more reassuring than a long generic one copied from a template. It is part of the same picture as building trust.
Sources and further reading
- Cookies and similar technologies (opens in a new tab)Information Commissioner's OfficeThe UK regulator. Authoritative and readable.
- Advice for small organisations (opens in a new tab)Information Commissioner's OfficeChecklists and templates aimed at small businesses.
- UK GDPR guidance and resources (opens in a new tab)Information Commissioner's Office
Common questions
- Do I need a cookie banner?
- Only if you use non-essential cookies — analytics, advertising or tracking embeds. A site with none needs no banner. That is a legitimate design choice and simpler than implementing consent properly.
- Do I need a privacy policy?
- If you collect any personal data, including through a contact form, yes. It should explain what you collect, why, how long you keep it, and how someone can ask for it to be deleted.
- Is embedding a YouTube video a cookie issue?
- It can be, since standard embeds may set tracking cookies before anyone presses play. YouTube offers a privacy-enhanced embed mode that avoids this, and it is a simple swap.
Read next
Analytics and measurement
The handful of numbers worth watching, and the ones that look impressive but mean nothing.
Building trust
The signals that make a stranger believe you are real, competent and safe to contact.
Maintenance & security
Why sites break on their own over time, and the small routine that prevents most of it.
Or see all 19 guides — or head back to the Smiths SEO home page to see what I do.
Not sure how your site measures up? Find out for free.
Send me your web address and I’ll go through it properly, then write back within 24 hours with what’s broken, what’s slow, and what it would cost to put right. Nothing to pay unless you decide to go ahead.