Cookies and UK GDPR: a plain guide for small business websites

Two different rules, often confused

People tend to lump everything together as "GDPR", but there are two separate pieces of law to think about.

• PECR (the Privacy and Electronic Communications Regulations) covers cookies and similar technologies that store or read information on a visitor's device.
• UK GDPR covers how you collect, use and look after personal data, such as the name, email and phone number someone types into your contact form.

Both are overseen by the ICO, the Information Commissioner's Office, which is the UK regulator for data protection and privacy. The rules are being updated, so always check current ICO guidance before you make decisions.

This is general information, not legal advice.

Cookies: when you need consent

Under PECR, you need a visitor's consent before setting non-essential cookies and similar trackers. That typically includes analytics tools, advertising pixels, social media tracking and some embedded content.

Cookies that are strictly necessary for something the visitor has asked for do not need consent. A cookie that keeps items in a shopping basket, or keeps someone logged in, is an example.

What counts as valid consent

• The visitor takes a clear, positive action, such as clicking "Accept".
• Non-essential cookies are not set before that action.
• Rejecting is as easy as accepting.
• Pre-ticked boxes and "by using this site you agree" notices are not enough.

Check what your site actually loads

Many small business owners do not know which trackers their website uses. Themes, plugins, chat widgets and embedded maps or videos can all add them. Ask your web designer for a list, or use your browser's developer tools to see which cookies appear when you first open the site. If something is there that you do not use, remove it.

Do you really need a cookie banner?

If your site sets no non-essential cookies or trackers, you have nothing to ask consent for, so you do not need a consent banner. You should still explain in your privacy notice what, if anything, is stored.

This is worth thinking about. Banners get in the way on small phone screens, many visitors click away from them, and a badly set up banner can itself break the rules. For a plumber, a hairdresser or an accountant, detailed visitor tracking often adds little. Knowing how many enquiries you received and where they came from is usually more useful than knowing how many people scrolled a page.

UK GDPR and your contact form

The moment someone sends you their name and phone number through a form, you are handling personal data. UK GDPR expects a few basic things from you.

1. A privacy notice. Explain who you are, what data you collect through the site, why, how long you keep it and who you share it with. Link to it from the form and from the footer of every page.
2. A lawful basis. You need a lawful basis for using the data. For replying to an enquiry someone has sent you, this is usually straightforward, but you should know which basis you rely on and say so in your notice.
3. Access and deletion requests. People can ask what data you hold about them and, in many cases, ask you to delete it. You need to be able to find their details and act on the request.
4. Sensible security. Keep enquiries somewhere secure, not scattered across personal inboxes, phones and paper notes.

Collect only what you need

A form asking for name, contact details and a short message is usually enough. Every extra field is more data to look after and another reason for a visitor not to finish the form.

A quick checklist

• List every cookie and tracker your site sets.
• Remove anything you do not genuinely use.
• If non-essential cookies remain, get proper consent before they load.
• Publish a clear privacy notice and link to it from your forms.
• Know where enquiries are stored and who can see them.
• Have a simple process for access and deletion requests.
• Check the ICO website for current guidance, as the rules are changing.

For the other basics every trade site needs, see our tradesperson website checklist.

How Site Shifter keeps this simple

Site Shifter sites do no visitor tracking, so there is no cookie banner to manage. They are hosted in Europe, and every form enquiry becomes a client record with a person assigned, so you always know where enquiries are and who is dealing with them. You still write your own privacy notice, but there is far less to explain. Have a look at all the features or read our frequently asked questions.

Frequently asked