Cookie consent and the law

A website must get your permission before it stores or reads information on your device. This information is usually in cookies — small text files — but the same rule covers other data saved by a site. The permission is called cookie consent.

Why consent is needed

Cookies can remember your login, basket or preferences, but they can also track what you do across websites so adverts can target you. Because the data is stored on your own device, the law gives you a say before that happens. The UK rule that sets this out is the Privacy and Electronic Communications Regulations (PECR), which grew out of the EU ePrivacy Directive. A site should not place non-essential cookies, such as advertising or tracking cookies, until you have agreed. Cookies the site needs in order to work, such as one that keeps you logged in, are essential, so those do not need your consent.

What a cookie banner does

A cookie banner is the message that appears when you visit a site. It explains what cookies the site wants to use and asks you to accept or reject them. Clicking accept gives the website permission to store cookies on your device, often including advertising and tracking cookies. Your consent must be a clear action: a site cannot treat you as agreeing just because you carry on browsing, and boxes must not be pre-ticked. For example, a music streaming site might ask to use cookies that remember the playlists you have made and also show you adverts for concert tickets. If you reject, the site should not use those optional cookies.

Cookies are not illegal. Using them is legal when the site asks for consent and follows the rules.