Cookies, privacy policies and contact forms: what a small business site needs

You’ve added Google Analytics to your site, or a booking widget, or a Facebook pixel someone recommended. Now you’re not sure whether you need a cookie banner, what your privacy policy should say, or whether the contact form is collecting more than it should.

Most small business sites can get this right with a few clear decisions. This is a plain-English summary of the UK rules as they stand in 2026. It’s general information, not legal advice, so check anything specific to your business with a solicitor or the ICO.

Which rules apply

Two sets of rules cover a typical website.

UK GDPR covers personal data: names, email addresses, IP addresses, anything that identifies someone. It’s where your privacy policy and your contact form obligations come from.

PECR (the Privacy and Electronic Communications Regulations) covers cookies and anything similar that stores or reads information on a visitor’s device, including local storage and tracking pixels. The ICO is clear that PECR applies to all cookies, even ones that don’t hold personal data. The ICO (Information Commissioner’s Office) regulates both.

What needs consent and what doesn’t

Some cookies are exempt because the site can’t do what the visitor asked without them. The ICO calls these strictly necessary. A shopping basket, a login session, a security cookie and the cookie that remembers someone’s banner choice all fall here. You still have to say you use them, but you don’t need to ask first.

Advertising cookies always need consent. Google Ads conversion tracking, Meta pixels and retargeting tags are not strictly necessary, and the ICO says advertising has never been exempt.

Analytics is the part that changed. The Data (Use and Access) Act 2025 added new exceptions to PECR, and those came fully into force on 5 February 2026. One covers storage used only to collect statistics about how your site is used, so you can improve it. The ICO’s guidance sets tight conditions on it:

• the statistics are used only to improve your own site or service;
• the results are aggregate figures that can’t identify anyone;
• you explain it clearly and give people a simple, free way to object;
• any analytics provider acts as your processor, not for its own purposes.

The ICO says plainly this isn’t a blanket exemption for all analytics. A tool that also feeds advertising, or profiles visitors across other sites, still needs consent. If you use Google Analytics linked to Google Ads, the safe assumption is that you need to ask.

What a fair cookie banner looks like

The ICO’s consent guidance comes down to a handful of points:

• Nothing non-essential runs before a choice. If someone ignores the banner, the answer is no. “By continuing to browse you agree” doesn’t count.
• Reject is as easy as accept. A banner with “Accept all” and a “More options” link, but no reject button on the first screen, is the ICO’s own example of what not to do.
• Off by default. Toggles for optional cookies start switched off.
• Easy to change later. People can withdraw consent as easily as they gave it, usually through a link in the footer.

Our own site works like this. It sets no analytics or advertising cookies by default. Google Tag Manager, which loads Google Analytics and Google Ads, only runs after someone opts in, and the banner offers Reject with the same weight as Accept. Analytics and advertising can be chosen separately, and a “Cookie settings” link in the footer reopens the choice. Our cookie policy lists each cookie, who sets it and how long it lasts.

What your privacy policy has to say

UK GDPR sets out what you must tell people when you collect their data. The ICO’s list is longer than most people expect. For a small business site the core of it is:

• who you are and how to contact you;
• why you collect each piece of data, and your lawful basis for it;
• who you share it with (your form service, email provider, analytics);
• how long you keep it;
• the rights people have, including the right to complain to the ICO.

Write it about your business. A template copied from a bigger company will list services you don’t use and miss the ones you do. Our privacy policy names each service we rely on, which is the part most templates get wrong.

Contact forms

A contact form is the most common way a small business site collects personal data, and it’s easy to over-collect. Ask for what you need to reply. Our form asks for a name, an email address and a message, and nothing else. Phone number, address and company size can come later, if the job needs them.

Then say where the message goes. Ours is delivered through Formspree, and the privacy policy says so. If yours lands in a Gmail inbox, a CRM or a booking system, name that service. Keep enquiries only as long as you have a reason to, and delete old ones on a schedule.

Keep it in step with the site

The banner and the policies go out of date as soon as someone adds a chat widget, a map or a new tracking tag. Make checking them part of every change to the site. If you’re also sorting out your domain, email and the rest, our digital setup guide covers the basics in one place.

If you’d like us to look over your site’s cookies and forms, get in touch.