Key takeaways
- Under the Privacy and Electronic Communications Regulations (PECR), most cookies and similar technologies need the visitor's consent before they are set.
- Exceptions cover strictly necessary cookies and, since the Data (Use and Access) Act 2025, some cookies used solely for statistical (analytics) purposes or to remember appearance preferences, if you explain them and offer a simple way to object.
- Advertising and tracking pixels, such as Google Ads or Meta Pixel, always need consent.
- A compliant banner makes rejecting as easy as accepting, has no pre-ticked boxes and blocks tags until consent.
- The ICO's guidance on storage and access technologies is the place to check the detail.
Almost every accounting firm website uses cookies or similar technologies, whether for analytics, embedded maps and videos, chat widgets or advertising. The rules on when you need consent changed in 2025, and the Information Commissioner’s Office (ICO) has made cookie compliance an enforcement priority. This guide explains what a practice website needs.
The legal framework
The Privacy and Electronic Communications Regulations (PECR) control storing or accessing information on a visitor’s device, which covers cookies, pixels, local storage and similar technologies. Where personal data is involved, UK GDPR also applies. The Data (Use and Access) Act 2025 amended PECR, adding new exceptions and aligning fines with UK GDPR levels.
What needs consent and what does not
| Purpose | Consent needed? |
|---|---|
| Strictly necessary for a service the visitor asks for, such as security, load balancing or remembering consent choices | No |
| Remembering the visitor’s appearance or functionality preferences | No, if you give clear information and a simple, free way to object |
| Analytics used solely to produce statistics about use of your site, to improve it | No, if you give clear information and a simple, free way to object, and the use is genuinely limited to that purpose |
| Advertising, remarketing and conversion pixels (Google Ads, Meta Pixel, LinkedIn Insight Tag) | Yes |
| Analytics where the provider uses the data for its own purposes or advertising | Yes, in practice |
| Embedded content that sets third-party cookies, such as video and social media embeds | Usually yes |
The analytics exception is narrower than it sounds. If your analytics set-up shares data for advertising, links it to other services, or the provider uses it for its own purposes, it is unlikely to qualify. Many firms continue to ask consent for analytics as the safer approach, which is what this site does.
What a compliant banner looks like
- Clear information about what each category does, with a link to a cookie notice
- Accept and reject options given equal prominence on the first layer
- No pre-ticked boxes for non-essential categories
- Granular choices in a settings panel, such as analytics and marketing separately
- No non-essential cookies before consent, including tags loaded by tag managers
- An easy way to change your mind, such as a link in the footer
- Accessible design: usable with a keyboard and screen reader, without trapping focus
Avoid “cookie walls” that block the website unless visitors accept, and banners that nudge acceptance with colour or wording.
Technical implementation
- Audit what your site sets: use browser developer tools or a scanning tool to list cookies, pixels and scripts.
- Categorise each one: strictly necessary, preferences, analytics, marketing.
- Configure your consent tool so that each category’s scripts only load after the relevant consent. With Google tags, set up Consent Mode defaults to denied for advertising and, unless you rely on the statistics exception, for analytics.
- Test in a private browser window: reject everything and confirm no marketing cookies or requests appear.
- Record consent choices and keep your cookie notice up to date when you add tools.
Common problems on practice websites
- the banner displays, but analytics and advertising tags fire before any choice
- only an “Accept” button, with rejection hidden in settings
- embedded Google Maps or YouTube videos setting cookies on page load
- marketing pixels added by an agency without updating the consent set-up
- cookie notice listing tools no longer used, or missing new ones
Cookies and your privacy notice
Your cookie notice explains the technologies you use; your privacy notice explains how you use personal data generally. They can be separate pages or combined, but both should be easy to find. See privacy policy set-up and the GDPR checklist.
Frequently asked questions
Do I need a cookie banner on my accounting firm website?
Yes, if you use any cookies or similar technologies that need consent, such as advertising pixels or third-party embeds. A site using only strictly necessary cookies may only need a clear notice.
Do analytics cookies still need consent?
Not always. Since the Data (Use and Access) Act 2025, analytics used solely to produce statistics about your own service can rely on an exception if you give clear information and a simple way to object. Set-ups that share data for advertising still need consent.
Can I use Google Ads tracking without consent?
No. Advertising and conversion tracking cookies and pixels require consent before they are set.
What happens if my cookie banner is not compliant?
The ICO can take enforcement action, and fines under PECR now align with UK GDPR levels. It is also a poor signal to clients about how you handle data.
Sources
Facts and rules in this guide were checked against the sources below in October 2026. Platforms, prices and regulations change, so check the current position before acting. This guide is general information, not legal or professional advice.