Does your agency website need a cookie banner?

The cookie rules sit in regulation 6 of the Privacy and Electronic Communications Regulations (PECR), not in the UK GDPR, and they cover more than cookies. The ICO’s guidance says PECR “applies to any technology that stores information, or accesses information stored” on a visitor’s device: cookies, tracking pixels, scripts and tags, local storage and device fingerprinting. The ICO now calls them all storage and access technologies.

The basic rule has not changed: you need a visitor’s consent before using them, unless an exception applies. What changed is the list of exceptions. The Data (Use and Access) Act 2025 rewrote them in a new schedule to PECR, and the regulations that brought that part of the Act into force set the date as 5 February 2026. The ICO finalised its updated guidance on 29 April 2026. Its summary of the Act puts the change plainly: “it allows you to set some types of cookies without having to get consent”.

So whether your website needs a banner depends on what it loads. If everything on it fits an exception, it does not need a consent banner, though it still has to tell visitors what it does. If anything on it needs consent, it needs a way to ask before that thing loads.

Most guidance written for estate agency websites before 2026, including the cookie policy templates that rank for the question, still says consent is needed for everything except strictly necessary cookies. That is now out of date.

The schedule sets out five exceptions. Three matter for an agency website:

• Strictly necessary. Storage or access “strictly necessary for the provision of an information society service requested by the subscriber or user”. The ICO says this is judged from the visitor’s point of view, not yours: the cookie that keeps a logged in landlord logged in to a portal they asked to use, or that remembers what is in a form as they move through it. No conditions apply.
• Statistics about how the site is used. Storage or access whose sole purpose is “to collect information for statistical purposes about how the service is used”, so that you can improve it. This is analytics: which pages vendors visit, where they leave the valuation form.
• Appearance or functionality. Storage or access whose sole purpose is to adapt how the website looks or works, such as remembering a visitor’s saved search filters, map or list view, or text size.

The second and third come with conditions written into the law. The visitor must be given “clear and comprehensive information about the purpose of the storage or access”, and “a simple means of objecting, free of charge”. If they object, you stop. The ICO adds that you cannot rely only on browser settings to tell whether someone has objected.

The statistics exception is narrower than it sounds. The ICO says it “is not for identifying, tracking or monitoring people or groups of people who use your service”. It does not cover advertising, recordings of individual visitors’ sessions, profiling, or sharing the data with anyone except to help you improve your own site. A third party analytics provider can fit it, but only if it acts for you as a processor, uses the information only to help you improve your service, and you tell visitors you use it. If your analytics account is linked to advertising, or the provider uses the data for its own purposes, that use needs consent.

Here the agency website differs from a plain brochure site, because of what agencies add to win valuations:

• Advertising pixels and tags. The ICO says “the use of storage and access technologies for online advertising purposes requires consent”, that measuring a campaign “does not require a separate consent” because it is part of the advertising purpose, and that no exception applies. A Meta pixel for Facebook valuation adverts, Google Ads conversion tracking or a retargeting tag all need consent before they fire.
• Social media plugins and feeds. The ICO’s own example is a social media plugin: the website operator must obtain consent and name the provider, and for data collected through it, the operator and the platform are joint controllers.
• Embedded maps, video tours, chat and review widgets. These load code from another company. The ICO says it is “your responsibility to understand the technologies you intend to use”, and that you “must not pre-enable non-exempt storage and access technologies”. Unless you have checked that a widget stores nothing, or stores only what fits an exception and is used only for you, treat it as needing consent and hold it back until the visitor agrees, with a click to load placeholder in its place.
• Session recording and heatmap tools that capture what individual visitors do, which the ICO places outside the statistics exception.

For YouTube property videos, Google offers a privacy enhanced mode, switched on by changing the embed address to youtube-nocookie.com. Google says views in that mode will not be used to personalise advertising shown to the viewer outside your site. It does not say the mode sets nothing, so it reduces the problem rather than removing it.

The ICO’s guidance on managing consent sets out what a valid banner does. In plain terms:

• Nothing that needs consent loads first. Technologies “are only set when valid consent is gathered, or when they meet an exception”.
• Refusing is as easy as accepting. The ICO’s checklist says the mechanism “makes it as easy to refuse consent as it is to accept”. A Reject button hidden behind a Settings link fails that.
• Ignoring the banner means no. “Silence or inactivity doesn’t qualify”, and if the visitor does not engage, you must not use the technologies that need consent. Toggles should be off by default.
• Third parties are named. You must give the identity of any third parties you share data with, on the banner itself or one clear click away.
• Consent can be withdrawn at any time, for example from a cookie settings link in the footer, and the tools must then stop.

The ICO has been checking. It tested the UK’s top 1,000 websites on whether advertising cookies were stored before a choice, whether rejecting was as easy as accepting, and whether cookies were placed without consent. On 4 December 2025 it reported that 979 passed at their latest test, 564 of them only after the ICO had contacted them, and said it would keep testing. Agency websites are far below that traffic, but the standard it tested against is the same one that applies to them.

A banner also costs you something in the place that matters most. It covers the first screen of a property page or the valuation form on a phone, so a site that needs no banner at all, or a small one, is worth designing for. The fastest way to get there is to load fewer third party tools. Our guide to getting more valuation requests from your website covers what that first screen should do instead.

You can see most of it yourself in twenty minutes:

1. Open your home page, a property page and the valuation form in a private browser window and do not touch the banner. Open the browser’s developer tools and look at the cookies and storage already set. Anything beyond strictly necessary that appears before you choose is a failure.
2. Press Reject, reload and look again. Advertising and social media cookies should not be there.
3. List every outside tool the site loads: analytics, ad pixels, maps, video, chat, reviews, the valuation tool, the booking widget. For each one, note what it is for and who receives the data. That list is most of your cookie policy.
4. Check your analytics settings. If you want analytics to run without consent under the new exception, its data must not be linked to advertising or shared for the provider’s own purposes, and your site must explain it and offer a simple opt out.
5. Ask your website supplier which tags they or your CRM add, and who controls the accounts behind them.

A clean privacy and cookie setup belongs on the list of what an estate agent website should include, next to the legal display rules. If you are planning a new site and want one built with as little third party tracking as it needs, how we design estate agent websites sets out how we work, and our prices are on the pricing page.

• legislation.gov.uk: The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, regulation 2
• legislation.gov.uk: Data (Use and Access) Act 2025, schedule 12 (storing information in the terminal equipment of a subscriber or user)
• ICO: Guidance on the use of storage and access technologies (finalised 29 April 2026)
• ICO: What are the exceptions?
• ICO: How do we manage consent in practice?
• ICO: How do we comply with the PECR rules?
• ICO: How do the rules apply to online advertising?
• ICO: What are storage and access technologies?
• ICO: The Data (Use and Access) Act 2025, what does it mean for organisations?
• ICO: ICO action secures increased cookie compliance (4 December 2025)
• YouTube Help: Embed videos and playlists (privacy enhanced mode)

More guides for agency owners are on the guides page.