Does my small business website need a cookie banner, a privacy policy and terms?

The ICO, the UK data regulator, says a business that holds personal data needs a privacy notice, and expects one on the website if customers mainly find you online. A contact form, a quote form, a newsletter box and an email address you collect all count. It should say who you are, why you use the data, who sees it, how long you keep it and how people can complain to the ICO. The ICO has a free privacy notice generator for small organisations.

If your form asks for a name, email or phone number, the ICO says to make your privacy information visible before people enter their details, for example a link on the form. One short line under the button is enough: what you will use the details for, and a link to the full notice.

Under the UK rules on cookies (PECR), you need a person’s clear agreement before you store or read anything on their device unless it is strictly necessary for the service they asked for. Simply scrolling on does not count as agreeing. That is why some small sites have no banner: they use no analytics, no advertising and no embedded tools that set cookies.

The ICO says advertising never counts as strictly necessary. A Meta pixel, Google Ads tag or similar tool that tracks visitors for ads must not run until the visitor says yes.

Since the Data (Use and Access) Act 2025, the ICO lists a statistical purposes exception. It applies only if the sole purpose is to count how the site is used so you can improve it, you tell visitors clearly, you give a simple free way to object, the data is aggregated, and any third-party provider acts only for you. Tracking individual visitors, linking visits to ads or purchases, or using the data for anything else needs consent. If you are not sure your setup meets every condition, ask first.

A simple brochure site does not legally need terms. You do want clear terms for anything you sell or any service you deliver: what is included, price and payment, delivery, who owns the work and how to cancel. Write them for your business. A template with blanks or someone else’s company name makes you look careless and protects nobody. If you sell products online to consumers, there are extra rules, so get advice.

Open your privacy and terms pages. Do they name your business, give a contact address, and describe what your site actually does? An empty page, placeholder text or a generic template that mentions tools you do not use is a risk, because the notice has to describe what really happens to people’s data.

Every site we build gets a plain-English privacy notice written for that business, a cookie choice that matches what the site really uses, and a privacy link beside every form. We set it up and test it before launch. The ICO updated its guidance on 29 April 2026, so we check it again for each project.