Cookie Consent Basics for Small Websites

Cookie banners are nobody’s favourite part of running a website, but they are part of the job if you have visitors from regions with consent rules. This article is a practical orientation, not legal advice. Rules differ by country and by what your site does, so treat it as a way to understand the vocabulary and run a sensible review, then confirm the details with a qualified adviser.

The basic idea

The European Data Protection Board’s small-business FAQ explains that storing a cookie on a visitor’s device, or reading one already there, generally requires that people are properly informed about the purposes and have given consent. The exception is for technically necessary cookies, which do not need it. In the UK, the Information Commissioner’s Office publishes its own guidance on storage and access technologies, which covers cookies and similar tools.

What valid consent looks like

The ICO’s guidance, dated August 2026, lists several features of a valid request. In plain terms:

Ask before setting non-essential cookies. Silence, scrolling or simply continuing to browse is not consent.
Be specific. Offer separate choices for separate purposes, rather than one lump.
Be open about third parties. People should be able to find out who they are, even if the details sit on a second layer.
Keep consent separate from your terms and conditions.
Make sure the banner works. If a visitor refuses, the cookies must not load anyway.

Design details that matter

Equal prominence for refusing. The ICO says a reject-all button should be as prominent as accept-all, on both mobile and desktop. A banner offering only accept and a more-options link is described as poor practice.
Nothing pre-ticked. Toggles for non-essential items should start switched off.
Easy withdrawal. Changing your mind should be as easy as agreeing, and the related tools and data should stop when consent is withdrawn.
Do not nag. After a refusal, wait a reasonable time before asking again. The guidance mentions around six months as a general yardstick.
Re-ask when things change, for example when you add a new advertising tool.

What counts as essential

Exemptions depend on purpose. A technology used purely for something the visitor asked for, like remembering items in a basket, may be strictly necessary. The ICO also warns that statistics and appearance exemptions apply only when that is the sole purpose. If the same cookie also supports advertising, consent is needed. Using separate tools for separate purposes makes this easier to reason about.

Setting it up on a Shopify store

Shopify’s help pages describe a customer privacy area in settings, with options for a privacy policy, a cookie banner and a data-sharing opt-out page. Points to note:

A published privacy policy is needed before you can add the banner.
Automated settings are on by default for new stores. By default the banner is shown to visitors in the UK and European Economic Area if you have active markets there, and you can enable it elsewhere.
Shopify’s banner covers Shopify’s own tools. Third-party cookies or pixels may need a separate banner or custom handling.
If you use a third-party privacy app, remove Shopify’s banner first and use the same regions in both, since mismatched regions can let tracking begin before consent.
Where consent is required, declining reduces data collection, which can lower session counts and conversion rates in your analytics.
Shopify states that its automated settings are not a substitute for legal advice.

On other platforms, look for the consent features built into your theme or a reputable consent plugin, and read how it handles tag managers and third-party scripts.

Keep a record and a privacy notice

The ICO says you should be able to show that someone consented, and a consent management platform is a common way to do that. Separately, the EDPB notes that when you collect personal data you must explain what happens to it in clear, plain language, and that access requests must be answered within one month and free of charge. Make sure your privacy page actually matches the tools you use.

An annual cookie review

List every script on your site: analytics, advertising, chat, maps, videos, review widgets and social buttons.
Next to each, write its purpose and whether it needs consent.
Open your site in a private window, refuse everything and check with your browser’s developer tools or a cookie scanner that nothing non-essential loads.
Test changing your choice afterwards.
Check that the privacy policy names the tools you actually use.
Repeat whenever you add an app.

When it is time to call a developer

Bring in a developer if tracking scripts fire before consent, if a custom theme loads third-party code directly, or if you need your analytics to follow the visitor’s choice. Ask a lawyer, not a developer, about what your business must do. Our services page describes the technical work we can help with, and a clean theme is much easier to bring into line with consent tools.