Is Your Cookie Banner Legal?

Introduction

When was the last time you clicked “Accept All” for cookies without a second thought? Most of us have done it, especially when we’re in a hurry.

The fact is that many websites use cookie consent pop-ups or templates that don’t reflect the reality behind the scenes. They can be vague about why cookies are used, how long data is stored, and often fail to disclose that third-party companies are tracking users.

Giving Consent to Cookies

Whether a business is a small start-up or a large corporation, its website collects data through cookies. This means businesses have a responsibility under UK GDPR and the Privacy and Electronic Communications Regulations (PECR) to inform visitors about what data is being collected and why.

The business must also obtain proper consent before adding any non-essential cookies.

Auto-ticked boxes, vague explanations, or buried options can all lead to non-compliance.

Businesses that ignore these regulations risk both reputational damage and regulatory penalties.

Information Commissioner's Office (ICO) Guidance

The ICO specifies that consent must be obtained through a clear, affirmative action, such as ticking a box or clicking a link. Merely continuing to use a website does not constitute valid consent.

It also emphasises that users must fully understand that their actions will result in specific cookies being set and must take a clear and deliberate action to give consent. This must be more than simply continuing to use the website.

Additionally, users should have the means to enable or disable non-essential cookies, and this process should be straightforward.

https://ico.org.uk/media2/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies-1-0.pdf

Case Study: Bonne Terre Limited, Trading as Sky Betting and Gaming

Between 10 January and 3 March 2023, Sky Betting and Gaming shared visitors’ personal data with advertising technology providers immediately upon accessing the SkyBet website, before users could accept or reject advertising cookies.

This meant personal data was used for targeted advertising without prior consent, highlighting a clear breach of data protection requirements.

As a result, the ICO issued a reprimand to Sky Betting and Gaming, for unlawfully processing people’s data through advertising cookies without their consent.

https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/09/action-taken-against-sky-betting-and-gaming-for-using-cookies-without-consent/

Conclusion

Cookie banners aren’t just a tick-box exercise, they form part of your legal relationship with every website visitor. Getting them right protects your reputation and helps keep you compliant.

Your cookie policy should align seamlessly with your Privacy Policy, Website Terms, and contracts with third-party services, such as Google Analytics, ad networks, or hosting providers.

A clear, well-drafted cookie notice isn’t simply good practice it reduces the risk of complaints, reputational damage, and regulatory enforcement.

Your cookie banners shouldn’t be an afterthought. If you’re not convinced they are legally sound call Richard Jenkins 024 7698 0613 or email richard@clariclegal.co.uk  for a no obligation chat.

Disclaimer:

This article is for general informational purposes only and does not constitute legal advice.