WordPress Cookie Consent in the UK: Your 2026 Compliance Guide
17 August 2026
Learn how to set up WordPress cookie consent for UK GDPR & PECR compliance in 2026. Step-by-step guide, plugins, and best practices.
Why UK Websites Need Cookie Consent in 2026
If you run a WordPress site in the UK, you must comply with the UK GDPR and the Privacy and Electronic Communications Regulations (PECR) 2003, as amended. PECR specifically governs the use of cookies and similar technologies. The Information Commissioner's Office (ICO) enforces these rules and can issue fines up to £17.5 million or 4% of global turnover. In 2026, the ICO continues to prioritise cookie consent, particularly on public-facing and high-traffic sites. Even if your site is small, you need to obtain valid consent before placing non-essential cookies on visitors' devices. This includes cookies for analytics, advertising, and social media embeds. Ignoring this can lead to enforcement action, so it's vital to get it right, even after Brexit.
What UK Law Actually Requires for Cookies
Under PECR, consent for non-essential cookies must be informed, specific, freely given, and unambiguous. This means users must actively opt in—pre-ticked boxes and implied consent by scrolling are not acceptable. You must clearly explain what cookies do and why you use them before consent is given. You also need to provide a 'Reject All' button as prominently as a 'Accept All' button. Essential cookies (e.g., those needed for basic site functionality, such as remembering logged-in users or shopping carts) are exempt from consent. However, you must still provide clear information about them in your cookie policy. The UK GDPR also adds transparency obligations, so you must include a link to your privacy policy on the cookie banner.
Best WordPress Cookie Consent Plugins for UK Sites
Several WordPress plugins can help you achieve compliance. CookieYes (now known as CookieYes Consent Management) is popular for UK sites because it offers automatic cookie scanning, pre-tuned templates for UK GDPR and PECR, and a 'Reject All' button by default. Complianz is another excellent choice; it provides a legal-driven setup wizard that includes UK-specific settings and geo-targeting to show different banners to users in the UK versus the EU. Cookiebot by Usercentrics integrates well with WordPress and offers consent record storage. For a lightweight free option, the official 'GDPR Cookie Consent' plugin works for basic needs. Ensure whichever plugin you choose logs consent with timestamps and IP addresses to prove compliance.
Step-by-Step: Configure Cookie Consent on WordPress
First, audit your cookies using a plugin like CookieYes or your browser's developer tools to identify all cookies and their purpose. Next, install and activate your chosen consent plugin. Configure cookie categories—e.g., Essential, Analytics, Marketing, Preferences—and assign scripts to each category. Set up your banner text to include a clear heading, a short explanation, and two buttons: 'Accept All' and 'Reject All'. Ensure the plugin auto-blocks Google Analytics, Facebook Pixel, or other third-party scripts until consent is given. Then, enable consent logging and integrate with your GDPR privacy policy. Finally, test your implementation in incognito mode and on a mobile device to verify that scripts load only after consent and that you can withdraw consent easily.
UK-Specific Considerations for Cookie Consent
The ICO has moved away from prescriptive, EU-style banners and encourages a more user-friendly approach. However, using 'cookie walls'—where you block all content until cookies are accepted—is risky. The ICO says this usually fails the 'freely given' requirement unless you offer a genuine alternative to accepting non-essential cookies. Also, if your site targets both the UK and the EU, you'll need to comply with the EU ePrivacy Directive as well. Under EU rules, consent must be as strict or stricter, so consider geo-targeting your banner. Finally, review your consent solution annually: the ICO publishes updated guidance and there were calls in 2025 to simplify cookie rules, so stay informed to remain compliant.
FAQ
Yes, if your site uses non-essential cookies, such as analytics or advertising cookies, you must obtain informed consent before setting them. A banner is the most common way to do this, but the law technically allows other methods if they meet PECR requirements.