Cookie consent
A cookie banner or similar tool that asks visitors before any non-essential cookies, such as analytics or embedded videos, are set. Every school and trust website that uses such cookies must ask first, by a clear positive action.
Check this on my websiteWho it applies to
- Published on
- School and trust websites
- School type
- Academies and maintained schools
- School stage
- All stages, from early years to sixth form
- Does not apply to
- No school types are excluded
When is it due?
- Renewal
- No fixed date
The official sources set no renewal date. Keep it accurate whenever it changes.
What's needed
Publish a cookie banner that sets no non-essential cookies until the visitor accepts, with rejecting made as easy as accepting, on every page.
In this requirement
Section 1 of 2
Consent before cookies are set
If the website uses cookies that are not strictly necessary, such as analytics or embedded videos, consent must be asked for before non-essential cookies are set, by unambiguous positive action, with a way to enable or disable non-essential cookies. The audit checks what loads before consent.
The register sets this section for maintained schools only.
What it must contain
4 parts- Asks for consent before setting non-essential cookiesMust
- Takes consent only from a clear positive action by the visitorMust
- Lets visitors turn non-essential cookies on or offShould
- Takes clear and specific consent for more privacy-intrusive cookiesShould
What the official sources say
Set out in 2 official sources:
Guide to PECR: cookies and similar technologies
The rules on cookies are in regulation 6. The basic rule is that you must: – tell people the cookies are there; – explain what the cookies are doing and why; and – get the person’s consent to store a cookie on their device.
Must§ What do we need to do to comply?
It must involve some form of unambiguous positive action – for example, ticking a box or clicking a link – and the person must fully understand that they are giving you consent. You cannot show consent if you only provide information about cookies as part of a privacy policy that is hard to find, difficult to understand, or rarely read. Similarly, you cannot set non-essential cookies on your website’s homepage before the user has consented to them.
Must§ What counts as consent?
Show 8 more from this source
This must be more than simply continuing to use the website. To ensure that consent is freely given, users should have the means to enable or disable non-essential cookies, and you should make this easy to do.
Should§ What counts as consent?
☐ We have implemented a consent mechanism that allows users of our online service to control the setting of all cookies that are not strictly necessary.
Expected§ Checklists – Consent for cookies
You must tell people if you set cookies, and clearly explain what the cookies do and why. You must also get the user’s consent. Consent must be actively and clearly given.
Must§ In brief…
You should take particular care to ensure clear and specific consent for more privacy-intrusive cookies, such as those collecting sensitive personal data such as health details, or used for behavioural tracking.
Should§ What counts as consent?
However, it is still good practice to provide users with information about these cookies, even if you do not need consent.
Good practice§ Are there any exemptions?
The only requirement is that it must be “clear and comprehensive” information about your purposes. You must explain the way the cookies (or other similar technologies) work and what you use them for, and the explanation must be clear and easily available. Users must be able to understand the potential consequences of allowing the cookies. You may need to make sure the language and level of detail are appropriate for your intended audience.
Must§ What information must we give users?
Yes. Although cookies that process personal data give rise to greater privacy and security risks than those that process anonymous data, PECR apply to all cookies.
Must§ Do the rules still apply if the data is anonymous?
☐ We have ensured that we provide clear and easy to understand information about the cookies we use. ☐ We have ensured that our information is comprehensive and covers all the cookies we use.
Expected§ Checklists – Information about cookies
Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 (cookies)
Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user.
Must§ Regulation 6(1)
Section 2 of 2
Third-party trackers before consent
Third-party trackers, such as Google Tag Manager or social media widgets, should not contact their servers until the visitor has consented: nothing non-essential loads before consent, nothing is read from or stored on the device first, and a consent mechanism controls all non-essential cookies.
The register sets this section for maintained schools only.
What it must contain
3 parts- Sets no non-essential cookies before consentShould
- Lets visitors control every cookie that is not strictly necessaryShould
- Stores or reads nothing on the visitor's device before consentMust
Questions schools ask
Does every school have to publish the cookie consent?
Consent before cookies are set: The official sources we check set no requirement for academies. The official sources we check set no requirement for maintained schools. Third-party trackers before consent: The official sources we check set no requirement for academies. The official sources we check set no requirement for maintained schools.
When does the cookie consent need to be published?
Renewal: No fixed date. The official sources set no renewal date. Keep it accurate whenever it changes.
What must the cookie consent include?
Asks for consent before setting non-essential cookies; Takes consent only from a clear positive action by the visitor; Lets visitors turn non-essential cookies on or off; Takes clear and specific consent for more privacy-intrusive cookies; Sets no non-essential cookies before consent; Lets visitors control every cookie that is not strictly necessary; and 1 more part listed above.
Where does the requirement for the cookie consent come from?
It is set out in Guide to PECR: cookies and similar technologies and Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 (cookies).
Changes to the official sources
The sources for this item do not publish dated change notes. Their current versions are listed above.
We last checked these sources on 21 September 2026.
Is this on your school's website?
We check your site the way an inspector or a parent would find it: page by page, against the official wording of each requirement. If it's there, you get the page and the words we found. If it isn't, you get every place we looked.
Check this one requirement free, or scan your whole site against every requirement.
Official sources last checked 21 September 2026 · register version 1.0.4