Cookie consent that keeps you legal and measurable
Cookie consent is now a legal requirement with teeth: the ICO has been actively warning UK websites since 2023, and Google Consent Mode v2 decides whether your analytics survive. We implement banners that are lawful, accessible and not hideous.
What UK GDPR and PECR actually require
Two laws work together here. PECR says you need consent before setting non-essential cookies. UK GDPR defines what real consent looks like. Neither is new, but enforcement attention is.
Consent before cookies fire
Non-essential cookies (analytics, ads, most tracking) must not load until the visitor agrees. Banners that set cookies first and ask afterwards fail at step one.
Reject as easy as accept
The ICO told the UK's most-visited websites in November 2023 to offer rejection as prominently as acceptance, and has kept the pressure up since. A hidden reject link is not consent.
Informed, specific, revocable
Visitors must know what they are agreeing to, per purpose, and be able to change their mind as easily later. Pre-ticked boxes and vague "improve your experience" wording do not count.
Usable by everyone
A banner every visitor must interact with has to meet accessibility standards: keyboard reachable, screen reader friendly, targets at least 24px under WCAG 2.2.
Consent Mode v2, and the analytics that quietly died
A silent analytics outage costs more than the banner
Why non-compliant setups lose their data
Since March 2024, Google has required Consent Mode v2 for sites using its advertising features in the UK and EEA. Your banner must pass each visitor's choice to Google tags in a format they understand. Get it wrong and the failure is silent: no error, no warning, just analytics and conversion data that stops arriving. We audit sites whose owners believed a quiet month was a sales slump, when their bolted-on banner had cut the data feed. Compliance and measurement are now the same wiring job.
- Consent Mode v2 mandatory for Google ad features since March 2024
- Badly wired banners block data even from visitors who accepted
- Correct setups keep consented measurement and lawful modelling
Valid consent or no consent: there is no third option
Dark patterns: the shortcuts that void consent
Plenty of banner plugins ship with tricks regulators have explicitly called out: an Accept button in brand colours beside a grey whisper of a reject link, "legitimate interest" toggles switched on by default, or settings mazes designed to exhaust the visitor. Consent gathered this way is invalid, so the cookies set on the back of it are unlawful, and the banner bought you nothing but false comfort. We strip the dark patterns out and keep the design clean, on-brand and honest. Compliant does not have to mean ugly.
- Equal prominence for accept and reject, first layer
- No pre-ticked boxes or defaulted "legitimate interest" toggles
- Consent records stored, so you can prove compliance if asked
From cookie chaos to compliant in three steps
Audit what your site actually sets
We scan every cookie and tracking script, classify each as essential or not, and document purposes. Most owners are surprised by what they find.
Implement the banner and wiring
A compliant, accessible banner matched to your brand, non-essential cookies genuinely blocked until consent, Consent Mode v2 signals flowing correctly.
Verify, document, hand over
We test accept and reject paths, confirm analytics records lawfully, update your privacy and cookie policies, and give you the evidence trail.
How accessible is your website right now?
Run our free checker. It scans any page against WCAG 2.2 in about 30 seconds and shows exactly what to fix.
Compliance as part of a healthy website
Consent implementation is quoted per site and stays maintained under Essential Care. Pair it with an accessibility statement or a full audit. Prices exclude VAT.
Essential Care
For brochure sites that need to stay updated, backed up and online.
£59 /month
£590 /year
- Weekly core, plugin and theme updates
- Daily off-server backups
- 24/7 uptime monitoring
- Security scanning and hardening
- Monthly health report
- Email support, next business day
Accessibility Statement
A legally sound accessibility statement, written and published for you.
£149 one-off
- Based on a real scan of your site
- Follows UK and EU model wording
- Published on your site for you
- Includes feedback mechanism setup
- Update guidance included
Full SEO Audit
Technical, content and competitor audit with a plan you can act on.
£299 one-off
- Full technical crawl of your site
- Keyword and content gap analysis
- Competitor benchmark
- Backlink profile review
- Prioritised 90-day action plan
- Free 30-minute results call
All prices exclude VAT. Cancel monthly plans any time. Secure card and Direct Debit payments powered by Stripe.
Frequently asked questions
Do UK websites legally need a cookie banner?
If your site sets non-essential cookies, yes in effect. PECR requires consent before you store or read anything on a visitor's device that is not strictly necessary, and UK GDPR sets the standard that consent must meet: freely given, specific and informed. Analytics, advertising and most tracking cookies all need consent first, collected through a compliant banner.
Can a website just have an "accept cookies" button with no reject option?
No. The ICO has been explicit since its warnings to top UK websites in late 2023: rejecting non-essential cookies must be as easy as accepting them. A banner with a big Accept button and a Reject hidden three clicks deep does not collect valid consent, which means every cookie set on the back of it is unlawful.
What is Google Consent Mode v2?
The mechanism Google requires for measuring visitors who have made a consent choice, mandatory since March 2024 for sites using Google advertising features in the UK and EEA. Your banner passes each visitor's choice to Google tags. Wired correctly, you keep lawful measurement; wired badly, your analytics and ad conversions quietly stop recording.
Why did my Google Analytics data drop after adding a cookie banner?
Because the banner was bolted on without Consent Mode. If consent signals never reach Google properly, nothing is recorded at all, even from visitors who clicked Accept. We see sites that lost months of data this way. A correct Consent Mode v2 setup records consented visitors fully and models the rest lawfully.
Do cookie banners need to be accessible?
Yes, and most are not. The banner is the first thing a visitor must interact with, so if it cannot be reached by keyboard, read by a screen reader, or its buttons are too small to tap, you have blocked disabled visitors at the front door. That creates Equality Act 2010 risk and fails WCAG 2.2, which sets a minimum target size of 24px.
What cookies do not need consent?
Strictly necessary ones: the session cookie keeping a shopper's basket together, security, load balancing, and remembering the consent choice itself. The test is whether the service the visitor asked for would work without it. Analytics does not qualify, however harmless it feels, a mistake the ICO keeps correcting.
What are dark patterns in cookie consent?
Design tricks that push visitors toward accepting: a bright Accept button next to a barely-visible reject link, "legitimate interest" toggles pre-switched on, walls of vendor checkboxes, or banners that reappear until you give in. Regulators treat consent gathered this way as invalid, so dark patterns void your legal basis as well as annoying visitors.