PECR and Cookie Consent: What Your Banner Actually Needs to Do

A lot of cookie banners satisfy the visual expectation, a popup with an accept button, without satisfying what PECR and the ICO’s guidance actually require underneath. Here’s the gap between “we have a banner” and “our banner does what PECR requires,” broken down by what actually has to happen technically, not just what has to be displayed.

Requirement 1: non-essential cookies must not fire before consent

This is the most commonly failed requirement, and it’s purely technical, not cosmetic. If your analytics or advertising tags are configured to load on every page and only a cookie-preference value gets set by the banner, you’ve very likely already set the cookie before consent existed. A compliant setup blocks the underlying script from executing at all until consent is affirmatively given, typically implemented through a tag manager’s consent-gating feature (like Google Tag Manager’s built-in consent checks or Consent Mode) or a script-blocking layer in your consent platform.

Requirement 2: reject has to be as easy as accept

The ICO has been explicit that a banner offering a prominent “Accept All” button alongside a buried, multi-click “manage preferences” path to reject isn’t valid consent, this is a “dark pattern” that undermines the freely-given standard PECR relies on GDPR to define. Reject needs to be reachable in the same number of clicks, with comparable visual prominence.

Requirement 3: categories have to be genuinely separable

A banner that only offers “Accept All” or “Reject All,” with no way to accept analytics but decline advertising, doesn’t give users the granular choice PECR’s disclosure standard implies. Users should be able to consent to some categories and not others, and your tag configuration needs to actually respect that granular choice rather than treating any partial acceptance as full acceptance.

Requirement 4: consent has to be easy to withdraw, not just easy to give

A banner that appears once, on first visit, with no accessible way to revisit and change the choice later fails the “as easy to withdraw as to give” standard. Most implementations solve this with a persistent “cookie settings” link, usually in the footer, that reopens the preference panel at any time.

Requirement 5: the disclosure has to actually explain what’s happening

Vague category labels (“Performance,” “Functional”) without a plain-language explanation of what data goes where, and to which third parties, don’t meet PECR’s “clear and comprehensive information” standard. Users need enough specificity to make an informed choice, not just a menu of jargon.

Testing your own banner against these five requirements

1. Open your site in an incognito window with dev tools’ Network tab open, before clicking anything.
2. Confirm no analytics/advertising requests fire on page load.
3. Click reject, confirm nothing changes, that’s correct, but then check nothing was already running.
4. Click accept for only one category (e.g. analytics, not advertising), confirm only that category’s requests start firing.
5. Reload the page and confirm you can find a way to revisit your choice without clearing cookies manually.

Two closely related questions worth reading next

Whether a given cookie needs to be in this consent flow at all, versus falling under the strictly necessary exemption, is covered in our PECR and cookies overview, and the specific, frequently misjudged case of analytics cookies gets its own treatment in our analytics cookies guide.

This guide is educational and not legal advice. Consult a privacy attorney or technical auditor to confirm your specific banner implementation meets current ICO guidance.