Cookie Notice Template for England and Wales

If you operate a website in England and Wales that uses cookies or similar tracking technologies, you need a comprehensive Cookie Notice to comply with UK data protection laws. This essential document protects your business from regulatory penalties while ensuring transparency with your website users about how their data is collected and processed.

When do you need this document?

You must implement a Cookie Notice if your website uses any cookies beyond strictly necessary ones for basic functionality. This includes e-commerce sites using shopping cart cookies, marketing websites with analytics tracking, social media platforms with advertising cookies, and business websites using third-party plugins or widgets. The notice is required whether you operate a small business website or a large commercial platform. You also need this document if your site embeds social media content, uses Google Analytics, implements chatbots, or employs any form of user behaviour tracking. The Cookie Notice must be prominently displayed to all users before non-essential cookies are activated.

Key legal considerations

Your Cookie Notice must categorise cookies clearly into necessary, functional, analytical, and marketing types, explaining each category's purpose and data processing activities. The document should include comprehensive information about cookie duration, data sharing with third parties, and the legal basis for processing under UK GDPR. You must provide clear instructions for users to withdraw consent and manage their preferences, including browser-level controls and your website's cookie management tools. The notice should explain how users can delete existing cookies and the consequences of refusing certain cookie categories. Ensure your Cookie Notice is easily accessible through a prominent link on every page and written in plain English that ordinary users can understand.

Legal requirements in England and Wales

Under UK GDPR and the Data Protection Act 2018, you must obtain valid consent before placing non-essential cookies on users' devices, with consent being freely given, specific, informed, and unambiguous. PECR 2003 specifically regulates electronic communications and requires clear information about cookies before they're stored or accessed. Your Cookie Notice must comply with ICO guidance on cookie consent, which emphasises that pre-ticked boxes and cookie walls are not acceptable consent mechanisms. The notice should detail your data retention periods, international data transfers if applicable, and users' rights under UK GDPR including access, rectification, and erasure. You must regularly review and update your Cookie Notice to reflect changes in your cookie usage, third-party integrations, or legal requirements, ensuring ongoing compliance with evolving data protection regulations.