The checklist

A cookie is a small piece of information a website saves on a visitor's device. Similar technologies are other tools that store or read information in the same way.

Know what your site uses

  • List every cookie and similar technology your website uses.
  • Check the tools you have added, such as analytics, live chat, maps or embedded video.
  • Ask whoever built or manages your site what it sets on visitors' devices.
  • Note which items store or access information on the device.

Check for exceptions

  • Remember that consent is needed unless an exception applies. Do not assume yours does.
  • Check each item on your list against the exceptions, one at a time.
  • Write down your reason for any item you treat as exempt.
  • If you are not sure, ask for advice before you leave it out of your banner.

Give clear information

  • Explain in plain words what each cookie or tool does.
  • Keep the banner wording short and free of jargon.
  • Link to a fuller page for visitors who want more detail.
  • Check the information is clear and comprehensive, as the guidance asks.

Get consent

  • Make sure your banner asks for consent for every item that needs it.
  • Test your site in a private browsing window and see what happens when you accept or ignore the banner.
  • Check the banner works properly on a phone as well as a computer.
  • Check your banner remembers the visitor's choice.

Keep it up to date

  • Review your cookie list whenever you add a new tool, form or marketing service. If you add email sign ups, our guide to email marketing rules in the UK is a useful next read.
  • Put a cookie check on your before you launch checklist for any new site or major update.
  • Decide who is responsible for checking it, and how often.
  • Keep a dated note of what you checked and changed.

Why this matters

Many business owners add tools to their website over time and forget what each one does. Without a check, your site could be storing or reading information on visitors' devices without telling them clearly or asking for consent where it is needed.

A cookie banner that does not match what your site really does gives a false picture. Regular checks keep the two in line. This checklist is practical guidance, not legal advice, so check it against the ICO's own pages before you rely on it.

FAQs

Does every website need a cookie banner?

No. The guidance says consent is needed where you store or access information on a user's device, unless an exception applies. Check what your site actually uses before you decide.

Do tools other than cookies count?

Yes. The guidance covers cookies and similar technologies. Any tool that stores or accesses information on a visitor's device should be on your list.

Can I set up the banner myself?

Yes, but you need to know what your site uses first. If you would rather not work that out alone, our website care plans can help keep your site looked after and up to date.

Is this checklist enough on its own?

No. It helps you ask the right questions, but it is not legal advice. Compare your results with the ICO's guidance before you publish your banner.