Does a UK cookie banner need a “Reject all” button?

What the law actually says

The rule on cookies and similar technologies (pixels, local storage, device fingerprinting) is regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR). The Data (Use and Access) Act 2025 replaced that regulation with effect from 5 February 2026. The core idea hasn’t changed: you can’t store information on, or access information from, a visitor’s device unless they consent, or one of the listed exceptions applies.

Consent here means consent to the UK GDPR standard: freely given, specific, informed and unambiguous, given by a clear affirmative action. Neither PECR nor the UK GDPR mentions a button called “Reject all”. What they do require is that consent is a real choice, and that people can withdraw it as easily as they gave it.

What the ICO’s 2026 guidance says about banners

The ICO published its final guidance on storage and access technologies on 29 April 2026. Its page on managing consent in practice is the one to read if you run a banner. The main points:

• It must be as easy to refuse consent as it is to accept.
• The ICO’s good-practice example shows “Accept all” and “Reject all” side by side with equal prominence.
• A first layer that offers only “Accept” plus “More options” or “Settings”, so that refusing takes more clicks than accepting, is given as an example of bad practice.
• Toggles for non-exempt cookies must be off by default. Pre-ticked boxes aren’t consent.
• Doing nothing isn’t consent. Neither is “by continuing to use this site you agree”.
• You can’t rely only on browser settings, and you can’t bury consent in your terms and conditions.
• People should be able to consent to separate purposes (for example analytics and advertising) and see which third parties are involved.
• Withdrawing consent should be as easy as giving it, for example through a link in your footer that reopens the banner.

So in practice: if your banner has an “Accept all” button, give it a “Reject all” at the same level, with the same size and styling.

The new exceptions: when you don’t need consent

The 2026 rules list exceptions in Schedule A1 to PECR, and the ICO explains them on its exceptions page. There are five:

• Communication: needed to carry a communication over a network.
• Strictly necessary: needed to provide a service the visitor has asked for, such as a shopping basket, log-in session or security.
• Statistical purposes: analytics used to improve your own website or service.
• Appearance: remembering how the visitor wants the site to look or behave, such as language or text size.
• Emergency assistance: locating someone in an emergency.

The analytics and appearance exceptions have conditions. You must give clear information about what you do, and a simple, free way to object. For analytics, the information collected must not be shared with anyone except to help you improve the site or service. If your analytics tool shares data with the provider for its own purposes, or feeds advertising features, it is unlikely to fit the exception and still needs consent.

Advertising still needs consent. The ICO’s guidance on online advertising is clear that ad pixels, retargeting and similar tags are not exempt. In May 2026 the ICO advised government on possible future exceptions for some lower-risk advertising, but it stated that nothing has changed at this stage.

Common mistakes we see

• Advertising or analytics tags firing before the visitor makes a choice.
• A “Reject” button that hides the banner but leaves tags running.
• Reject buried in a second layer, in grey text, or worded as “Manage preferences”.
• No way to change your mind later.
• A cookie policy listing tools the site no longer uses, or missing ones it does.

How to test your own banner in five minutes

1. Open your site in a private or incognito window, so the browser behaves like a first-time visitor.
2. Before clicking anything, open the browser’s developer tools. Look at the cookies and storage list (in Chrome: Application, then Cookies) and the Network tab. Any advertising or non-exempt analytics already loaded is a problem.
3. Click “Reject all”, reload the page, and check again. Nothing non-exempt should appear.
4. Look for a way to reopen your choices, such as a footer link.
5. Repeat on your phone. Banners often look different on small screens.

Why it matters more now

Since 5 February 2026 the maximum fine for breaching the cookie rule is the higher UK GDPR level: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. That’s a ceiling, not a typical amount. Our guide to PECR fines after the Data (Use and Access) Act explains what changed.

FAQ

Is a “Reject all” button a legal requirement in the UK?

The law requires that refusing consent is as easy as giving it. The ICO’s 2026 guidance gives equally prominent “Accept all” and “Reject all” buttons as good practice, and a banner with only “Accept” and “Settings” as bad practice. If you offer “Accept all”, an equal “Reject all” is the safest way to meet the rule.

Do I need a cookie banner if I only use strictly necessary cookies?

You don’t need consent for cookies that fall within an exception, so you don’t need a banner just for them. It is still good practice to explain what you use, for example in your privacy or cookie information.

Is Google Analytics now exempt from consent?

Only if your setup fits the statistical purposes exception: the data is used to improve your own site or service, isn’t shared except for that purpose, and visitors get clear information and a simple, free way to object. Setups linked to advertising features are unlikely to qualify.

How often can I ask again after someone clicks Reject?

The ICO’s guidance says you shouldn’t keep pressuring people who have refused. It suggests that waiting about six months before asking again is reasonable.

Do these rules apply to small businesses?

Yes. PECR applies to any website that uses cookies or similar technologies, whatever the size of the business.

Official sources

• PECR regulation 6 (legislation.gov.uk)
• PECR Schedule A1: exceptions (legislation.gov.uk)
• ICO: How do we manage consent in practice?
• ICO: What are the exceptions?
• ICO: How do the rules apply to online advertising?
• ICO: Advice to government on online advertising rules (May 2026)

Laws and guidance change. Check the sources above for the latest position. For advice on your own circumstances, consult a solicitor.