What Should a Cookie Consent Banner Say?

The short version: A cookie consent banner should tell visitors what you're tracking, why, and give them a genuine choice to say no, in plain English, within about two sentences. Most small business banners fail because they're either a legal disclaimer nobody reads or a dark pattern designed to make "accept all" the only easy option, and both approaches now carry real regulatory risk in the UK and EU. Get the wording right and you protect yourself legally while building trust, which matters more than most business owners realise.

Why your banner wording matters

I've watched small business owners treat their cookie banner like wallpaper. Something a developer bolted on, with text copied from a template site, never looked at again. That's a mistake, and not just a tick-box compliance one.

Under UK GDPR and PECR (the Privacy and Electronic Communications Regulations), you need clear, informed, and freely given consent before dropping non-essential cookies on a visitor's browser. The Information Commissioner's Office has been clear that pre-ticked boxes, banners with no real reject option, or wording that's vague about what you're doing with the data, don't count as valid consent. If you're running Google Analytics, Meta Pixel, or any ad retargeting script, you're squarely in scope.

The uncomfortable part nobody likes to say out loud: most small business cookie banners on the market right now would not survive a complaint to a data protection authority. Not because the business is being malicious, but because the plugin defaults were never checked and the banner was built to disappear quickly, not to inform anyone.

What a compliant, usable banner needs to say

Strip away the jargon and a good banner needs four things, in this order:

• A plain statement that you use cookies, and roughly why (analytics, marketing, or both)
• An equally easy way to reject as to accept, not buried three clicks deep
• A link to a full cookie policy or privacy policy for anyone who wants detail
• No pre-ticked boxes for anything beyond strictly necessary cookies

That's it. You don't need three paragraphs. You need honesty and a genuine choice, stated in under 40 words if you can manage it.

A worked example

Say you run a small online shop selling handmade candles, turning over around £4,000 a month, with Google Analytics and a Facebook Pixel installed to track ad performance. Here's wording that would hold up:

"We use cookies to understand how visitors use this site and to show you relevant ads on Facebook. You can accept all cookies, reject non-essential ones, or manage your preferences. See our Cookie Policy for details."

Then three buttons of equal visual weight: "Accept all," "Reject non-essential," and "Manage preferences." Not one big green "Accept" button and a tiny grey "Settings" link nobody can find. That size difference alone is what regulators flag as a dark pattern, because it nudges people toward consent they didn't freely choose.

Examples by business type

Wording should match what you're collecting. A generic template rarely fits.

Service business (consultant, coach, local tradesperson)

"This site uses essential cookies to work and optional cookies to help us understand visitor numbers using Google Analytics. Accept, reject, or choose your settings below."

Ecommerce site

"We use cookies for checkout to work, for analytics so we can improve the site, and for marketing so we can show you relevant products on other sites. Choose below what you're happy with."

Content or membership site

"We use cookies to remember your login, measure which content people read, and personalise recommendations. You can turn off anything beyond the essentials at any time."

Local business with a simple brochure site

If all you've got is a contact form and Google Analytics, you often don't need a complex three-tier banner at all. "This site uses analytics cookies to help us understand how visitors find us. Accept or reject below." is enough, and shorter copy here is more compliant, not less, because it's honest about the limited scope.

The wording mistakes I see constantly

A few patterns come up again and again on small business sites, and they're worth naming plainly.

• "This website uses cookies to enhance your experience." Meaningless. It doesn't say what cookies, or why, and tells the regulator nothing either.
• Banners with only an "Accept" button and no reject option. This is the single most common breach I see, and it's an easy fix that takes a developer about an hour.
• Burying the reject option behind a "Manage settings" screen with eight toggles switched to on by default. Friction like this is designed to exhaust people into accepting, and it's exactly what dark pattern guidance from the ICO warns against.
• Linking to a cookie policy that was last updated three years ago and lists tools you stopped using ages back. If you swapped Hotjar for Microsoft Clarity last year, your policy needs to say so.

How specific do you need to be about each cookie?

You don't need to list every individual cookie name in the banner itself, that belongs in the linked policy. But the banner categories should be accurate. Typically that's three buckets:

• Strictly necessary (session cookies, security, shopping cart contents) - these don't need consent
• Analytics (Google Analytics, Clarity, Hotjar) - these do need consent
• Marketing and advertising (Meta Pixel, Google Ads remarketing tags, LinkedIn Insight Tag) - these absolutely need consent, and some, under EU rules specifically, need granular opt-in rather than one blanket toggle

If you're running paid ads with retargeting pixels, don't lump that cookie in with analytics and call it one category. A German or French visitor's browser may be covered by stricter rules than a UK one, and if you sell into the EU, your banner needs to handle that.

What happens if you get the wording wrong

Enforcement against small businesses specifically for cookie banner wording is rare, most ICO action targets larger companies, but that's not the same as being safe. A competitor complaint, an unhappy customer, or a routine audit by an ad platform checking your pixel setup can all surface the problem. Meta and Google have both tightened requirements on advertisers to prove valid consent exists before data is passed to their systems, and if your banner can't demonstrate that, your ad account is the thing at risk, not just a regulator's letter.

There's also a quieter cost. A banner that feels manipulative, giant green button, tiny grey text, makes people distrust the rest of your site before they've read a word of your copy. I'd argue that's the bigger loss for most small businesses: not the fine, the trust.

A simple five-step process to fix your banner this week

1. Audit what's tracking visitors on your site right now, using your browser's developer tools or a free scanner, don't guess
2. Sort every script into strictly necessary, analytics, or marketing
3. Rewrite the banner copy to name what you track in one plain sentence, matching the categories above
4. Make "Reject" as visible and as easy to click as "Accept," same size, same number of clicks
5. Update the linked cookie policy to match, and date it so visitors (and you) know when it was last checked

None of this takes more than an afternoon for most small sites. It's one of those jobs that feels bigger than it is until you sit down and do it.

When it's worth getting outside help

If you're running multiple pixels across several ad platforms, operating in both the UK and EU, or your current setup was built by whoever built your site five years ago and nobody's touched it since, it's worth having someone review the whole tracking and consent setup rather than patching the banner text alone. That's the kind of gap an AI consultant for small business or a privacy-minded web developer can close quickly, because the banner wording is only ever the visible tip of what needs fixing underneath.

Frequently asked questions

Do small businesses legally need a cookie consent banner?

Yes, if your site sets any non-essential cookie, including Google Analytics or an ad pixel, you need to get consent before it fires, under UK PECR and GDPR rules. Strictly necessary cookies like shopping carts or login sessions don't need consent, but almost every small business site uses at least one tool that does.

Can I just use one of the free cookie banner plugins?

You can, but check the defaults carefully. Many free plugins ship with pre-ticked boxes or a reject button that's harder to find than accept, which undermines the consent even though the plugin itself is technically compliant. Review and edit the wording, don't launch it as installed.

Does a cookie banner need to mention Google Analytics by name?

You don't have to name every tool in the banner itself, but your linked cookie policy should list the specific tools you use, including Google Analytics, so visitors can see exactly what's collecting their data if they choose to look.

What's the single biggest mistake small business owners make with their banner?

Making "Accept" the easy, prominent choice while hiding or shrinking the reject option. It's the most common pattern I see, it's an easy fix, and it's exactly the kind of design the ICO has flagged as invalid consent.