Data protection · Check before acting
Cookie policy and consent for a UK business website
Identify the cookies and browser storage your site uses, decide when consent is needed and write a policy that matches the real website.
Start by listing what the website actually uses
A useful cookie policy is written from the real website, not copied from another business. List cookies and similar technologies used by analytics, forms, account sign-in, payments, embedded video, chat, booking tools and advertising. Record the name, provider, purpose and how long each item lasts.
Browser local storage, pixels and similar technologies can fall under the same rules even when they are not called cookies. “We do not collect personal data” is not a reason to skip the check.
A B2B website still needs to check
Do not assume the rules disappear because your customers are businesses. The cookie and similar-technology rules concern access to information on a visitor's device. Work out what each technology does and whether it is strictly necessary for the service the visitor requested.
Examples that may be strictly necessary include keeping a secure signed-in session working or remembering a shopping basket. Analytics, advertising and many optional embeds normally need a different assessment and may need consent before they run.
Make the choice clear
Where consent is needed:
- explain the purpose in plain English;
- give an equally clear way to accept or refuse optional storage;
- do not set optional cookies before the choice;
- avoid pre-ticked boxes or confusing button wording;
- make it easy to change the choice later; and
- keep a record of the version of the choice people saw.
Rejecting optional cookies should not stop a person using parts of the site that do not depend on them.
What the cookie policy should say
Include:
- what cookies and similar storage are;
- each current technology, purpose, provider and duration;
- which items are needed for the requested service;
- which optional items run only after agreement;
- how a visitor can change their choice or clear storage;
- what can stop working when essential site data is cleared; and
- the last review date and a contact route.
Link the policy from the footer and from the cookie choice itself. Use the same names and durations shown in the site's actual configuration.
Recheck whenever the site changes
Review the list before adding analytics, advertising, video, chat, maps, social embeds, payment tools or a new website platform. Test in a private browser window to confirm optional technologies do not load before the visitor's choice.
What complete looks like
You have an accurate technology list, optional storage waits for a valid choice, refusing is easy, the policy matches the live site and somebody owns the next review.