PECR and cookies on your business website

Cookie compliance is where small-business websites most often quietly break the law. The UK's rules — the Privacy and Electronic Communications Regulations (PECR) alongside UK GDPR — are stricter than the "cookie wall = job done" practice everyone copies.

What PECR actually requires

For cookies and similar tech on UK sites:

• Strictly necessary cookies (what makes the site work — sessions, security) — no consent needed.
• Everything else (analytics, marketing, preferences beyond essentials) — prior consent required. Not "by continuing to browse..." — actual opt-in before the cookies drop.

The standard practice — banner up, analytics already loaded — is technically non-compliant, though enforcement focuses on the worst offenders. Getting it right is genuinely easy though.

How the Agentric consent banner works

• Nothing non-essential loads before consent — the widget's analytics and any marketing tags wait for opt-in.
• Real choices — Accept all / Reject non-essential / granular preferences. No dark patterns.
• Persistent and revisitable — the choice stores as a cookie; preferences link in the footer lets anyone change their mind.
• Honest categorisation — our Cookie Policy lists exactly what's set and why.

What this means for your own site

If you embed the widget on your own website:

• The widget's own cookies are covered by our disclosure — listed in the Cookie Policy you can link.
• Your own site's cookies are your responsibility — if you run Google Analytics or the Meta Pixel, you need the same consent-before-load on your site. There are free consent tools (CookieYes, Cookiebot tiers) if you need one.
• Landing pages we host are handled end-to-end — consent banner included.

The chat-vs-consent nuance

The chat widget itself is a service the user actively engages — its necessary session mechanics are defensible as strictly necessary when someone uses it. Analytics around it (tracking which pages, visit patterns) are not — those wait for consent. The distinction matters and is built in.

The bottom line

PECR is one of those rules where the gap between common practice and legal practice is wide. Doing it right — consent before non-essential cookies, real choices, honest policy — costs nothing and removes a genuine compliance exposure.