Your Cookie Banner Is Probably Legal Now. It’s Still Costing You.

The UK cookie argument is, for practical purposes, over.

The Data (Use and Access) Act 2025 changed the underlying rules on 5 February 2026. The ICO finalised its guidance on 29 April 2026, replacing the old cookies guidance with something considerably broader. And in announcing it, the ICO said that 99% of the UK’s top 1,000 websites now meet compliance standards for cookie banners, following focused work with industry.

Ninety-nine per cent. Whatever you think of cookie banners, the regulator’s own assessment is that the compliance battle at the top of the market has largely been won.

So this is not another post telling you your banner is illegal. It probably isn’t. This is a post about what that banner is costing you now that the legal question has mostly been settled — because for most business websites, the consent platform is among the heaviest things on the page, it runs before almost everything else, and nobody has looked at it since it was installed.

What actually changed

Worth getting this straight, because a lot of what is circulating is a year out of date.

The law changed on 5 February 2026. The Data (Use and Access) Act 2025 amended PECR, including the rules on storing and accessing information on people’s devices.

The guidance changed on 29 April 2026. The ICO published its finalised guidance on the use of storage and access technologies, following two consultations. Note the change of name — it is no longer “cookies guidance”. It now expressly covers cookies, tracking pixels, device fingerprinting, web storage, scripts and tags, and link decoration. If your compliance thinking stops at cookies, it stops short.

There is a set of exceptions, set out in the guidance’s own chapter on the subject: communication, strictly necessary, statistical purposes, appearance, and emergency assistance. The statistical purposes exception is the one that generated headlines, because in principle some analytics can fall within it. Whether your analytics does is a specific question with a specific answer, and the exceptions chapter is where to find it rather than a blog post — including ours. Two new sub-chapters were added in April covering what a simple means of objecting means, and whether you can use the same technology for multiple purposes.

One thing is still moving. The ICO has said its work reviewing regulation 6 of PECR for online advertising purposes sits separately from this guidance, with further updates to follow. If your business depends on advertising cookies specifically, that is the thing to watch.

We’re web developers, not solicitors. Treat the above as a pointer to primary sources rather than as advice on your situation.

The part nobody measures

Here is what a consent management platform does on a typical page load. It loads early, because it has to run before anything it governs. It is often a third-party script from a different domain, so it costs you a DNS lookup, a TCP connection and a TLS handshake before a single byte of it arrives. It then executes, builds a UI, and paints a large element over your content.

Every visitor. Every session. Forever.

Nobody in the business has ever looked at what that costs, because it arrived as a compliance item and compliance items don’t get performance reviews.

Check 1 — What does it weigh?

How: Open your homepage in Chrome, DevTools → Network, tick “Disable cache”, hard reload. Sort by Size. Find your consent platform — it will usually have the vendor’s name in the domain. Note the transfer size and the time it took.

Why it matters: This is a number you can put in front of whoever chose the platform. Most people have never seen it and are surprised by it.

Pass: You know the number, and it’s proportionate to what the script does. Fail: You have never looked, or it’s heavier than your largest image.

Check 2 — What does it do to INP?

How: Run PageSpeed Insights on mobile. Look at Interaction to Next Paint in the field data if you have it, and at total blocking time in the lab data. Then, in DevTools, open the Performance panel, record a page load, and look at the main thread while the banner is initialising.

Why it matters: Interaction to Next Paint is one of the three Core Web Vitals, with a threshold of 200ms. A script that occupies the main thread during the exact window when a first-time visitor is trying to tap something is hitting the metric at its most sensitive moment.

Pass: INP under 200ms at the 75th percentile, and your banner isn’t visible in the main-thread trace as a long task. Fail: INP above 200ms, or a long task attributable to the consent script.

Check 3 — Is it causing layout shift?

How: In the same Performance recording, look for shifts as the banner appears. Or run Lighthouse and check whether the consent element is named in the CLS diagnostics.

Why it matters: Cumulative Layout Shift has a threshold of 0.1. A banner that pushes content down when it appears is a textbook cause. It also, incidentally, breaks AI agents, which identify an element and then act on it — anything that moves in between produces a failed task.

Pass: CLS under 0.1 and the banner overlays rather than displaces. Fail: Content jumps when the banner arrives.

Check 4 — What fires before consent?

How: Clear your cookies for the site. DevTools → Network, hard reload, and do not click anything. Look at what has already loaded. Then check Application → Cookies and Application → Local Storage.

Why it matters: This is the one check on this list that is genuinely a compliance question as well as a performance one. If tracking is firing before the visitor has answered, the banner is decorative. It is also the most common failure we find, usually because a tag was added directly to the theme by someone bypassing the tag manager.

Pass: Only things you can justify under one of the exceptions are running before consent. Fail: Analytics, advertising or social pixels are firing before anyone has clicked anything.

Check 5 — Is rejecting as easy as accepting?

How: Look at your banner as a first-time visitor. Count the clicks to accept everything. Count the clicks to reject everything.

Why it matters: The ICO’s guidance now includes a sub-chapter specifically on what a simple means of objecting means, and its stated strategic focus includes improving user choice and transparency. Beyond compliance, there is a plainer point: a banner engineered to make refusal tedious is a thing your customers can feel.

Pass: Same number of clicks either way. Fail: Accept is one click, reject is three and a toggle screen.

Check 6 — What is it costing the planet?

How: Multiply the transfer size from Check 1 by your monthly sessions. Then run your site through a carbon estimator — ours is at freestyleinternet.co.uk/carbon.

Why it matters: A consent script is one of the few assets on a website that every single visitor downloads, that is never cached across domains in any useful way, and that delivers nothing the visitor came for. If you are looking for data transfer to remove, it is an unusually clean target.

Pass: The number is small enough that you don’t care. Fail: You’ve just worked out that your compliance banner is one of the largest carbon line items on your site.

How to read your results

Checks 1–3 fail, Check 4 passes. You have a performance problem, not a legal one. The fix is usually configuration: load the platform from your own domain if the vendor supports it, defer what can be deferred, and strip out the categories you don’t actually use. Many banners are configured to manage twelve cookie categories on a site that sets four.

Check 4 fails. Deal with this one first and separately. It is the check that carries actual risk, and it’s usually a single rogue tag rather than a platform problem.

Everything fails. You are probably running a heavyweight enterprise consent platform on a brochure site. This is extremely common. These tools are built for publishers running real-time bidding across dozens of vendors, and they get installed on twelve-page service websites because someone Googled “cookie compliance” and bought the top result.

Everything passes. Good. Re-check after your next marketing tool gets installed, because that is when it will change.

The thing worth noticing

The most common fix here is not configuration. It is deletion.

A large proportion of the consent infrastructure on UK business websites exists to obtain permission for tracking that the business does not use, has never analysed, and could not tell you the value of. The banner is not the problem. The banner is a symptom of a marketing stack that accumulated over eight years and was never audited, because removing a tag feels risky and leaving it feels free.

It isn’t free. It costs you main-thread time during your visitor’s first interaction, data transfer on every session, a compliance surface you have to maintain, and the small, cumulative irritation of asking every human being who visits you to answer a question before you’ll show them your prices.

The regulator has done its bit — by its own account, 99% of the top thousand sites now clear the bar. What’s left is not a legal question. It’s whether you know what all those scripts are for, and whether the answer justifies what they cost.

Most businesses have never asked. It is a very good month to ask.

What to do next

Working out what’s actually running on your site, what it costs and what can safely go is a large part of what our Technical Business Benchmark does. £750 + VAT, credited in full against any work you commission afterwards, report within 72 hours of the discovery meeting.

If the carbon side is what interests you, that’s Website Sustainability — and the performance win and the environmental win are the same piece of work, which is the nice thing about it.

Or schedule a call and we’ll take a look at your banner while you’re on the phone.

Sources

• ICO, Guidance on the use of storage and access technologies, finalised 29 April 2026
• ICO, Final storage and access technologies guidance published, 29 April 2026
• PageSpeed Insights