Cookie consent banner on your school website
If your website sets non-essential cookies, such as analytics or embedded videos, it needs to ask visitors first, with rejecting as easy as accepting.
Check this on my websiteWho it applies to
- Published on
- School and trust websites
- School type
- Academies and maintained schools
- School stage
- All stages, from early years to sixth form
- Does not apply to
- No school types are excluded
When it's due
Keep it up to date
There's no fixed date. Update it whenever something changes.
What's needed
Set up a cookie banner on every page of your website that sets no non-essential cookies until the visitor accepts and makes rejecting as easy as accepting.
In this requirement
Section 1 of 2
Consent before cookies are set
If the website uses cookies that are not strictly necessary, such as analytics or embedded videos, consent must be asked for before non-essential cookies are set, by unambiguous positive action, with a way to enable or disable non-essential cookies. The audit checks what loads before consent.
The register sets this section for maintained schools only.
What it must contain
4 parts- Asks for consent before setting non-essential cookiesMust: Required by law, statutory guidance or the academy's funding agreement.
- Takes consent only from a clear positive action by the visitorMust: Required by law, statutory guidance or the academy's funding agreement.
- Lets visitors turn non-essential cookies on or offShould: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.
- Takes clear and specific consent for more privacy-intrusive cookiesShould: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.
What the official sources say
Set out in 2 official sources:
Guide to PECR: cookies and similar technologies
The rules on cookies are in regulation 6. The basic rule is that you must: – tell people the cookies are there; – explain what the cookies are doing and why; and – get the person’s consent to store a cookie on their device.
Must: Required by law, statutory guidance or the academy's funding agreement.§ What do we need to do to comply?
It must involve some form of unambiguous positive action – for example, ticking a box or clicking a link – and the person must fully understand that they are giving you consent. You cannot show consent if you only provide information about cookies as part of a privacy policy that is hard to find, difficult to understand, or rarely read. Similarly, you cannot set non-essential cookies on your website’s homepage before the user has consented to them.
Must: Required by law, statutory guidance or the academy's funding agreement.§ What counts as consent?
Show 8 more from this source
This must be more than simply continuing to use the website. To ensure that consent is freely given, users should have the means to enable or disable non-essential cookies, and you should make this easy to do.
Should: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.§ What counts as consent?
☐ We have implemented a consent mechanism that allows users of our online service to control the setting of all cookies that are not strictly necessary.
Expected: Inspectors expect to see it, though it isn't a legal requirement.§ Checklists – Consent for cookies
You must tell people if you set cookies, and clearly explain what the cookies do and why. You must also get the user’s consent. Consent must be actively and clearly given.
Must: Required by law, statutory guidance or the academy's funding agreement.§ In brief…
You should take particular care to ensure clear and specific consent for more privacy-intrusive cookies, such as those collecting sensitive personal data such as health details, or used for behavioural tracking.
Should: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.§ What counts as consent?
However, it is still good practice to provide users with information about these cookies, even if you do not need consent.
Good practice: Recommended as good practice. Not required.§ Are there any exemptions?
The only requirement is that it must be “clear and comprehensive” information about your purposes. You must explain the way the cookies (or other similar technologies) work and what you use them for, and the explanation must be clear and easily available. Users must be able to understand the potential consequences of allowing the cookies. You may need to make sure the language and level of detail are appropriate for your intended audience.
Must: Required by law, statutory guidance or the academy's funding agreement.§ What information must we give users?
Yes. Although cookies that process personal data give rise to greater privacy and security risks than those that process anonymous data, PECR apply to all cookies.
Must: Required by law, statutory guidance or the academy's funding agreement.§ Do the rules still apply if the data is anonymous?
☐ We have ensured that we provide clear and easy to understand information about the cookies we use. ☐ We have ensured that our information is comprehensive and covers all the cookies we use.
Expected: Inspectors expect to see it, though it isn't a legal requirement.§ Checklists – Information about cookies
Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 (cookies)
Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user.
Must: Required by law, statutory guidance or the academy's funding agreement.§ Regulation 6(1)
Section 2 of 2
Third-party trackers before consent
Third-party trackers, such as Google Tag Manager or social media widgets, should not contact their servers until the visitor has consented: nothing non-essential loads before consent, nothing is read from or stored on the device first, and a consent mechanism controls all non-essential cookies.
The register sets this section for maintained schools only.
What it must contain
3 parts- Sets no non-essential cookies before consentShould: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.
- Lets visitors control every cookie that is not strictly necessaryShould: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.
- Stores or reads nothing on the visitor's device before consentMust: Required by law, statutory guidance or the academy's funding agreement.
Questions schools ask
Does a school website need a cookie banner?
Consent before cookies are set: Academies and maintained schools must. Third-party trackers before consent: For academies and maintained schools, it's recommended in official guidance, but isn't a legal requirement in itself.
What does a cookie banner need to do?
Asks for consent before setting non-essential cookies; Takes consent only from a clear positive action by the visitor; Lets visitors turn non-essential cookies on or off; Takes clear and specific consent for more privacy-intrusive cookies; Sets no non-essential cookies before consent; Lets visitors control every cookie that is not strictly necessary; and 1 more part listed above.
When do we need to review our cookie banner?
Keep it up to date. There's no fixed date. Update it whenever something changes.
Where does the requirement for the cookie consent come from?
It is set out in Guide to PECR: cookies and similar technologies and Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 (cookies).
Recent changes to the official guidance
The official sources for this requirement don't publish dated change notes. We check them for changes ourselves.
We last checked these sources on 21 September 2026.
Is this on your school's website?
Enter your school email address and we'll check your website for this requirement.
It's free, and the result arrives by email.
Official sources last checked 21 September 2026 · register version 1.0.4