Cookie consent banners: Crawl Audit check 136

Short answer: in the UK, most cookies and similar tracking need the visitor's consent first. Since 5 February 2026 there's an exception for simple analytics, as long as people can easily object. Check 136 warns when it can't find a cookie consent banner. Whether you need one depends on what your site sets.

What Crawl Audit checks

• Pass: the HTML mentions cookies, consent or GDPR, and has an element with "cookie" or "consent" in its class or id.
• Warning: otherwise.

It looks for a banner, not for whether you need one, or whether it works. A site with no tracking at all gets this warning too.

What UK law says (PECR)

• The rule, as changed by the Data (Use and Access) Act 2025 from 5 February 2026: "Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user."
• Schedule A1 exceptions include storage that is "strictly necessary" for a service the user asked for, such as a shopping basket.
• And storage "to collect information for statistical purposes about how a website ... is used with a view to making improvements to the website", but only if "the subscriber or user is given a simple means of objecting, free of charge, to the storage or access and does not object."

What the ICO says

• The analytics exception "is not a broad exception that covers all types of analytics technologies or ways you can use them", and "does not apply to purposes related to online advertising."
• Where you need consent, your mechanism should make it "as easy to refuse consent as it is to accept". "Silence or inactivity doesn't qualify."

In practice

• No tracking: no banner needed. Say so in your privacy policy.
• Simple first-party analytics: you may rely on the exception, with a clear, easy way to opt out.
• Advertising pixels or tools that share data for ads: ask first, with Accept and Reject equally easy, and load nothing until someone accepts.

This is a summary, not legal advice. Read the ICO guidance for your own setup.

Sources

• legislation.gov.uk, PECR regulation 6 and Schedule A1, checked 6 October 2026.
• ICO, Guidance on the use of storage and access technologies (updated 29 April 2026).