Cookies and Privacy Policies on UK WordPress Sites: The Basics
If your WordPress site uses analytics or advertising, UK law asks you to explain the cookies and get consent first. Here is what the ICO says, in plain English.
By Steve, Founder and editor, website developer
Published
· 2 min read
Most WordPress sites in the UK use at least one cookie that needs consent, usually for analytics or adverts. This article summarises what the Information Commissioner's Office (ICO) says about cookies, and what that means for a typical WordPress site. It's general information, not legal advice; for your specific situation, read the ICO's guidance or speak to an adviser.
What do the cookie rules say?
The rules are in the Privacy and Electronic Communications Regulations (PECR), and the ICO's guidance summarises them: you must tell people if you set cookies, clearly explain what the cookies do and why, and get the user's consent. Consent must be actively and clearly given: some kind of positive action, such as ticking a box or clicking a button.
The ICO is also clear that a privacy policy that is hard to find, hard to understand or rarely read is not enough on its own to show consent.
Which cookies don't need consent?
There's an exemption for cookies that are essential to provide a service the user has asked for. The ICO's examples include cookies that remember what's in a shopping basket, security cookies for services such as online banking, and load-balancing cookies. It's still good practice to tell people about these cookies, even though you don't need consent.
What does this mean for a WordPress site?
| If your site uses... | Consent needed? |
|---|---|
| WordPress login cookies for logged-in users | Generally treated as essential for logging in |
| A shop basket (e.g. WooCommerce) | The basket cookie falls under the ICO's basket example |
| Google Analytics or similar | Yes, under the ICO guidance summarised here |
| Advertising networks (e.g. AdSense) | Yes |
| Embedded YouTube videos and social media | Usually yes, as they can set their own cookies |
Laws and guidance change, so check the ICO's current guidance before you rely on this table.
How do you add a cookie banner to WordPress?
Use a cookie consent plugin that blocks analytics and advertising scripts until the visitor accepts, and lets them say no as easily as yes. If you use an advertising network, check whether it requires a particular consent tool.
What should a privacy policy cover?
WordPress creates a draft privacy policy page that you can find in Settings › Privacy. Edit it to say, in plain English, what personal information your site collects (contact forms, newsletter sign-ups, orders, comments), why, how long you keep it, who you share it with and how people can exercise their rights. Link it from your footer and your cookie banner.
Where to go next
Add privacy and cookie checks to your launch with our new website launch checklist, and read settings to change after installing WordPress.
