Cookie Banners Are a UX Moment. Make It a Good One
Almost everyone has met two kinds of cookie banner. The first shows two or three clear buttons, so you can accept, reject, or choose in a single click. The second sends you through a series of links and layered menus before you can say no, and by the third screen many of us give up and click accept.
Both banners exist to meet a legal obligation. Only one of them treats the visitor with respect. Now that the UK's cookie rules have changed, here is the case for treating consent as a design problem, and why getting it right helps your visitors, your brand, and your compliance at the same time.
What has changed in the UK
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and the cookie changes took effect on 5 February 2026. The Information Commissioner's Office (ICO) updated its guidance on storage and access technologies on 29 April 2026. The Act amends the existing rules, including the Privacy and Electronic Communications Regulations (PECR), which govern cookies, rather than replacing them. Cookies that no exception covers still need clear information and prior opt-in consent.
What is new is a set of additional exceptions. Consent is no longer required for cookies that collect statistics to improve a service or that adapt a site to a visitor's preferences, such as a chosen language, provided visitors get clear information and a free, simple way to opt out. Cookies used to locate a device in an emergency are exempt too. Advertising and tracking cookies still need prior opt-in consent.
The penalties have grown as well. The maximum fine for PECR breaches has risen from £500,000 to £17.5 million or 4% of global annual turnover, which matches the level under the UK General Data Protection Regulation (UK GDPR). Sites that also serve EU visitors must meet the EU's own rules, which sit outside these UK changes, so each region needs its own handling.
Two banners, two experiences
The ICO's guidance says it should be as easy to refuse consent as it is to accept. It expects accept, reject, and customise options to carry equal prominence, and it expects each choice to be specific to a purpose. Those expectations read like a design brief.
A good banner is easy to picture. It has three equally prominent buttons, a plain-language explanation of each purpose, and a decision made in a single step. The preference centre is there for those who want detail and stays out of the way of those who don't.
A poor banner does the opposite. Accept sits in a bright button while reject hides as a grey text link behind a menu. Advertising and tracking toggles come pre-set to on.
Reaching a refusal takes several clicks, and every extra click is a small tax on the visitor's patience. The ICO describes a banner that offers "accept all" and "more options" with no reject button as bad practice. Whatever the intent, the effect is a choice that looks free and feels steered.
Good consent design pays back
A cookie banner is often the first interaction someone has with your brand. A clear, honest one tells them in seconds that you respect their time and their choices. A confusing one tells them the opposite before they have read a word of your content. Trust built at that first moment carries into the rest of the visit, and into the likelihood that they come back.
There is a practical gain as well. Choices made freely give you cleaner, more reliable data than consent extracted through friction. And because the new exceptions remove the need for consent on some analytics and functionality cookies, an audit can shrink the number of things you need to ask about at all. Fewer questions make for a simpler banner and a quicker start to the visit.
A small point on accessibility
A banner is a layer that appears on top of everything else, so it has to work for every visitor. It needs sufficient contrast, controls that can be reached by keyboard, labels a screen reader can announce, and tap targets large enough for a thumb. The ICO notes that banners which are hard to use on mobile can undermine the validity of the consent they collect.
A banner also needs to be understandable. Older visitors, people with cognitive differences, and anyone less confident online can get lost in a maze of layers and miss the reject route. The ICO's guidance includes a section for services that children are likely to use, which is a reminder that not every visitor is an experienced adult. A banner that is easy to understand protects the people who most need it.
Where to start
Begin with an audit of every cookie, pixel, and script your site sets, along with its purpose and vendor. Classify each one against the exceptions to see what truly needs consent. Then design the banner and preference centre around equal choices, plain language, and as few layers as possible, and test it with a keyboard and a screen reader. Keep a record of the choices visitors make and what they were shown, and update your privacy notice to match.
The bottom line
Cookie consent can look like a compliance chore. In practice it is one of the first things a visitor sees on a site, and visitors judge a brand by how it handles it. The new UK rules raise the stakes for getting it wrong, and they give teams a good reason to simplify. A banner that is clear, fair, and accessible is easier to use and easier to defend.
Want a review of your current banner and consent flow? Book a call and we'll walk through it with you.
General information only and not legal advice. Sources. ICO, Guidance on the use of storage and access technologies. Clifford Chance, Key aspects of the Data (Use and Access) Act take effect.