COMMON QUESTIONS · REVIEWED 1 OCTOBER 2026
Cookie consent FAQ
Answers for UK website owners deciding what to check and what a scan result means. This is general technical guidance, not advice on your individual legal position.
Does every cookie need consent?
No. The purpose and applicable conditions matter. PECR includes exceptions, including strictly necessary uses and conditional uses for statistical purposes. Do not assume a tool qualifies simply because it is called analytics or is installed by a familiar provider.
Is a cookie banner enough?
No banner can prove the website follows the choice it offers. Test the behaviour before and after the choice. If a tool that requires permission runs regardless of Reject, changing banner text alone will not address that behaviour.
Is saving Reject a failure?
Not by itself. Websites may need to remember the visitor’s choice. A name containing “consent” suggests a possible purpose but does not prove it. Identify what the entry does before blocking it or calling it tracking.
Does red mean a fine?
No. It means an automated technical criterion failed. The facts, applicable law and regulatory process determine any enforcement outcome. The ICO’s PECR powers include fines up to £17.5 million or 4% of global turnover; those are maximum powers, not an estimate for your website or a predicted penalty.
Does green mean compliant?
No. It applies to the particular observation. Other pages, later activity and organisational practices can produce different results. Keep the coverage and limitations with any report you share.
Do I need a paid service?
No. Use the free findings with your own maintainer. Wider testing is useful when additional pages matter; it is not a way to turn every unknown into an answer. If you want us to make the changes, start a fix plan. We confirm the scope and price before you pay; a detailed audit is not a prerequisite.
Will scanning change my site?
No website code or settings are changed. The scanner visits public pages and interacts with supported consent controls in its own browser sessions. It does not install a plugin or obtain administrative access.
Why can two scans differ?
The site may have changed, a third-party tool may load differently, or a control may be unavailable during one visit. Compare page coverage, scan time, observed state and rule version before deciding whether a change fixed the problem.
Related guides
Prepared by GDPRFix, operated by Alex Player, trading as Nexus Websites. Legal claims link to official guidance; this guide is not a legal opinion.