Bringing a school website in line with the UK DUAA

Our client, an independent school for primary and secondary pupils, needed its website's privacy policy and cookie banners brought into line with the UK Data (Use and Access) Act 2025, the DUAA. The law had recently changed, and the school wanted its website to reflect it.

The cookie banner was the most visible part of the job. Rejecting tracking took several clicks, which made declining far harder than it needed to be. For a school, whose website serves parents, pupils, and families considering a place, the way it asks for consent says a great deal about how it treats their data. The school came to us for two things: a privacy policy in line with the new law, and a consent experience that gives every visitor a fair, simple choice.

We worked in two strands.

On the policy, we partnered with privacy specialists to review and update the school's privacy policy, bringing it in line with the DUAA and aligning it with ICO guidance.

On consent, we significantly changed the way visitors give it. The old banner made rejecting tracking a process of several clicks. The new banner offers Accept and Reject as equal one-click options, so declining takes exactly as much effort as agreeing. Visitors make their choice in a single step and move straight on to what they came to do.

The two strands support each other. The policy explains what the school collects and why, and the banner puts the choice about tracking in each visitor's hands from the first page they see.

The school's privacy policy and cookie banners are now in line with the DUAA, and the policy is aligned with ICO guidance.

Since the changes, the bounce rate has fallen across the site's pages, and visitors spend longer on some of them. A consent banner is often the first thing a visitor meets, and a quick, fair choice lets them get on with reading about the school.