Cookie policy
A cookie policy that tells visitors the website sets cookies, lists each one and explains what it does and why. Every school and trust website must give this information clearly.
Check this on my websiteWho it applies to
- Published on
- School and trust websites
- School type
- Academies and maintained schools
- School stage
- All stages, from early years to sixth form
- Does not apply to
- No school types are excluded
When is it due?
- Renewal
- No fixed date
The official sources set no renewal date. Keep it accurate whenever it changes.
What's needed
Publish a cookie policy listing each cookie, what it does, how long it lasts and how to change consent, linked from the footer of every page.
In this requirement
Section 1 of 2
Clear cookie information
The website must explain clearly what cookies it uses and why, usually in a cookie policy: users told that cookies are set and why, cookies listed with purposes, clear and comprehensive information about the purpose, what happens if you allow them, and information that covers all the cookies used.
The register sets this section for maintained schools only.
What it must contain
7 parts- Explains what each cookie does and why it's usedMust
- Dates when the cookie information was last reviewedMust
- Gives clear and comprehensive information about why cookies are stored or accessedMust
- Explains what happens if a visitor allows each cookieMust
- Gives information about cookies that don't need consent tooGood practice
- Tells visitors that the website sets cookiesMust
- Explains what the cookies do and whyMust
What the official sources say
Set out in 3 official sources:
Guide to PECR: cookies and similar technologies
You must tell people if you set cookies, and clearly explain what the cookies do and why. You must also get the user’s consent. Consent must be actively and clearly given.
Must§ In brief…
The rules on cookies are in regulation 6. The basic rule is that you must: – tell people the cookies are there; – explain what the cookies are doing and why; and – get the person’s consent to store a cookie on their device.
Must§ What do we need to do to comply?
Show 9 more from this source
The only requirement is that it must be “clear and comprehensive” information about your purposes. You must explain the way the cookies (or other similar technologies) work and what you use them for, and the explanation must be clear and easily available. Users must be able to understand the potential consequences of allowing the cookies. You may need to make sure the language and level of detail are appropriate for your intended audience.
Must§ What information must we give users?
It must involve some form of unambiguous positive action – for example, ticking a box or clicking a link – and the person must fully understand that they are giving you consent. You cannot show consent if you only provide information about cookies as part of a privacy policy that is hard to find, difficult to understand, or rarely read. Similarly, you cannot set non-essential cookies on your website’s homepage before the user has consented to them.
Must§ What counts as consent?
Yes. Although cookies that process personal data give rise to greater privacy and security risks than those that process anonymous data, PECR apply to all cookies.
Must§ Do the rules still apply if the data is anonymous?
This must be more than simply continuing to use the website. To ensure that consent is freely given, users should have the means to enable or disable non-essential cookies, and you should make this easy to do.
Should§ What counts as consent?
You should take particular care to ensure clear and specific consent for more privacy-intrusive cookies, such as those collecting sensitive personal data such as health details, or used for behavioural tracking.
Should§ What counts as consent?
☐ We have ensured that we provide clear and easy to understand information about the cookies we use. ☐ We have ensured that our information is comprehensive and covers all the cookies we use.
Expected§ Checklists – Information about cookies
☐ We have implemented a consent mechanism that allows users of our online service to control the setting of all cookies that are not strictly necessary.
Expected§ Checklists – Consent for cookies
However, it is still good practice to provide users with information about these cookies, even if you do not need consent.
Good practice§ Are there any exemptions?
Although this guide focuses on cookies, regulation 6 actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in either case by any method.
Must§ What else is covered, apart from cookies?
PECR 2003 Schedule A1 (cookies: information and consent conditions, inserted by the Data (Use and Access) Act 2025)
a is provided with clear and comprehensive information about the purpose of the storage or access, and b gives consent to the storage or access.
Must§ Schedule A1, paragraph 2(1)(b) (Consent)
Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 (cookies)
Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user.
Must§ Regulation 6(1)
Section 2 of 2
Naming the third parties
The cookie policy should name the third-party services that actually set cookies, such as Google Analytics or YouTube, say what each cookie does and why, show which cookies are strictly necessary and cover all the cookies used. The audit compares the policy with what really loads.
The register sets this section for maintained schools only.
What it must contain
2 parts- Covers every cookie the website usesShould
- Says which cookies are strictly necessary and which need consentMust
What the official sources say
Set out in 1 official source:
Guide to PECR: cookies and similar technologies
the cookie is strictly necessary to provide an ‘information society service’ (eg a service over the internet) requested by the subscriber or user. Note that it must be essential to fulfil their request – cookies that are helpful or convenient but not essential, or that are only essential for your own purposes, will still require consent.
Must§ Are there any exemptions?
Questions schools ask
Does every school have to publish the cookie policy?
Clear cookie information: The official sources we check set no requirement for academies. The official sources we check set no requirement for maintained schools. Naming the third parties: The official sources we check set no requirement for academies. The official sources we check set no requirement for maintained schools.
When does the cookie policy need to be published?
Renewal: No fixed date. The official sources set no renewal date. Keep it accurate whenever it changes.
What must the cookie policy include?
Explains what each cookie does and why it's used; Dates when the cookie information was last reviewed; Gives clear and comprehensive information about why cookies are stored or accessed; Explains what happens if a visitor allows each cookie; Gives information about cookies that don't need consent too; Tells visitors that the website sets cookies; and 3 more parts listed above.
Where does the requirement for the cookie policy come from?
It is set out in Guide to PECR: cookies and similar technologies, PECR 2003 Schedule A1 (cookies: information and consent conditions, inserted by the Data (Use and Access) Act 2025) and Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 (cookies).
Changes to the official sources
The sources for this item do not publish dated change notes. Their current versions are listed above.
We last checked these sources on 21 September 2026.
Is this on your school's website?
We check your site the way an inspector or a parent would find it: page by page, against the official wording of each requirement. If it's there, you get the page and the words we found. If it isn't, you get every place we looked.
Check this one requirement free, or scan your whole site against every requirement.
Official sources last checked 21 September 2026 · register version 1.0.4