Expect BestThe cookie banner is the most disliked element on the modern web, and the irony is that most of them do not achieve compliance anyway. They annoy visitors, damage the design and still leave the business exposed, which is the worst of both outcomes.
Getting it right is not complicated, and for some sites the correct answer is no banner at all.
What the rules actually require
UK law, through PECR alongside UK GDPR, says you need consent before setting cookies that are not strictly necessary. Strictly necessary means the site genuinely cannot function without them: a session cookie holding a shopping basket, or one remembering a login.
Analytics is not strictly necessary. Neither is advertising, nor an embedded video that sets a tracking cookie, nor a chat widget. All of those need consent first.
Consent has to be freely given, specific, informed and unambiguous. In practice that means four things: nothing non-essential fires before the visitor chooses, rejecting is as easy as accepting, the choice is granular rather than all-or-nothing, and you keep a record of what was agreed.
Why most cookie banner implementations fail
The most common failure is the design one. Accept is a large coloured button and reject is a grey text link, or worse, hidden behind a settings screen. That asymmetry is exactly what regulators have been pushing back on, and it is the easiest thing to fix.
The second failure is technical and more serious. The banner appears, but the analytics script has already loaded and set its cookie before anyone clicked anything. The banner is then decoration rather than consent, and the site is no more compliant than one with no banner at all.
The third is record keeping. If you cannot demonstrate what a visitor agreed to and when, you cannot demonstrate consent.
What a compliant banner looks like
Equal prominence for accept and reject. A clear link to more detail. No pre-ticked boxes for anything optional. Scripts blocked until a choice is made. A stored record of the decision. And an easy way for someone to change their mind later.
That is genuinely it. It does not need to take over the screen, it does not need three paragraphs of legal text, and it does not need to reappear on every page.
The option nobody considers
Use fewer cookies.
A meaningful number of small business sites could drop their banner entirely by switching to privacy-focused analytics that set no cookies and collect no personal data, embedding video through a no-cookie option, and removing the two marketing scripts nobody has looked at since they were added.
The result is a faster site, a cleaner design, no consent obligation and analytics that are arguably more accurate, because they are not missing the visitors who reject tracking. For a business that is not running retargeting campaigns, this is very often the right answer and almost nobody is offered it.
Where to start
Audit what your site actually sets. Open the browser tools, look at the cookies and the network requests, and list what fires before any interaction. Most owners are surprised by how many there are and by how few they knew about.
Then decide, item by item, whether it earns its place. The ones that do get a properly built consent mechanism. The ones that do not get removed, which is faster, cheaper and better for everyone.
A note on the design of it
Whatever you land on, keep it small and keep it out of the way. A banner that covers a third of the screen on a phone is costing you visitors, and on a slow connection it is the first thing people see and the reason some of them leave.
A slim bar at the bottom with two equally weighted buttons and one link satisfies the requirements and barely registers. There is no legal benefit whatsoever to the full-screen version, and there is a measurable cost to it.
If you would like us to look at what your site is setting, our web design team will run through it and tell you plainly what needs consent and what could simply go.