Does a small club or charity website need a cookie banner?

Only if your website stores or reads information on a visitor's device (cookies and similar technologies) for something beyond what is strictly necessary. There is no exemption for small clubs or charities as such. What changed in February 2026 is that basic anonymous visitor statistics can now be covered by an exception, so a very simple site may not need a consent banner at all. A site with advertising, a Facebook pixel, or standard analytics set up to track individuals does.

This is general information, not legal advice. Cookie rules are technical: the only reliable way to know what your site does is to test it, and the ICO guidance is the authority on how the rules are applied.

The rule in plain English

The law is regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR). Since the Data (Use and Access) Act 2025 changes took effect on 5 February 2026, regulation 6(1) says a person must not store information, or gain access to information stored, in a visitor's device, subject to Schedule A1. That schedule sets out when you can:

• With consent: if the visitor is given clear and comprehensive information about the purpose and gives consent.
• Without consent, in a short list of cases (the exceptions).

Notice what is missing: no size threshold, no charity or volunteer carve-out. If you store or access information on a visitor's device, you either have an exception or you need consent. A tiny village society is treated like anyone else.

The exceptions that matter to clubs and charities

The exceptions are in Schedule A1, and the ICO's guidance explains them in plain language. The ones relevant to a club site:

1. Strictly necessary (paragraph 4). Storage or access that is strictly necessary to provide the service the visitor requested. The Schedule gives examples such as security, fraud and fault prevention, authenticating a user, and keeping a record of choices made on a website. A login for members or a cookie that remembers a visitor's cookie choice are typical. The ICO says this is judged from the visitor's point of view, and that no advertising purpose meets it.
2. Statistical purposes (paragraph 5), new in 2026. You may collect information for statistical purposes about how your site is used, with a view to improving it, without consent if all of these are true: that is the sole purpose, the information is not shared with anyone except to help improve your service or website, the visitor is given clear and comprehensive information, and the visitor is given a simple, free means of objecting and does not object.
3. Website appearance (paragraph 6). Storage that only adapts how the site looks or works to the visitor's preferences, with the same requirement for information and a simple, free way to object.
4. Communication and emergency assistance (paragraphs 3 and 7), which will rarely apply to a club website.

The ICO published final guidance on storage and access technologies on 29 April 2026. It stresses that the statistical exception is narrow: it is about aggregate information on how a service is used, not identifying or monitoring individual people, and it does not apply to online advertising. It also says that if one purpose meets an exception but another does not, you need consent.

Common triggers on club and charity sites

These are the things that most often turn a simple site into one that needs consent:

• Standard analytics configured to track individuals across visits or sessions, or to build profiles. Whether yours falls within the statistical exception depends on its setup, so check the vendor's documentation and your own settings.
• Advertising or remarketing tags, such as the Facebook (Meta) pixel or Google Ads tags. Advertising is outside the exceptions.
• Embedded third-party content, such as videos, social feeds, maps and share buttons, which can set their own cookies when the page loads.
• Donation or ticketing widgets from third parties that you load into your own pages.
• Live chat tools and heatmap or session replay tools.

If your site has none of these, it may only use strictly necessary cookies, and you may need no banner, though a short cookie notice in your footer or privacy policy is still good practice.

What a valid banner has to do

If you do need consent, the ICO guidance spells out what good practice looks like. In short:

• Nothing non-essential loads until the visitor says yes. A banner that sets the cookies first and asks afterwards does not work as consent. The ICO's checklist asks that storage and access technologies are only set when valid consent has been given or an exception applies.
• Refusing must be as easy as accepting. The guidance shows equally prominent "accept" and "reject" options as good practice, and treats a banner with no reject option as bad practice.
• A positive action is required. Pre-ticked boxes do not count, and neither does "by continuing to use this website you consent". The ICO gives that exact wording as an example of pre-enabling without consent.
• Be specific. Give choices by purpose, and tell visitors about any third parties involved.
• Make withdrawal easy. Visitors must be able to change their mind as easily as they gave consent.

How to check your own site

You do not need to be technical to get a sensible first answer.

1. Open your site in a private or incognito window.
2. Before clicking anything on the banner, open your browser's developer tools and look at the Application (or Storage) tab for cookies and local storage. Anything other than clearly necessary items is a flag.
3. Click "reject" or the equivalent and reload. If the cookies are still there, the banner is decorative.
4. Visit pages that have videos, maps or donation buttons and look again.

Our free website health check covers mobile-friendliness, security and speed. It does not test cookie behaviour, so it is a useful extra but not a substitute for the steps above.

A simple decision path

• Does your site load anything from outside your own domain (a video, a map, a social feed, a donation widget, an analytics or advertising script)? If no, you are probably only using strictly necessary storage, and a short cookie notice is enough.
• If yes, is it advertising or tracking individuals? Then you need consent before it loads, and a banner that really blocks it until the visitor agrees.
• If it is only anonymous statistics to improve the site, you may be able to rely on the statistical exception, provided you give clear information and a simple way to opt out, and the tool is configured for statistics only.
• If you cannot tell, treat it as needing consent until you have checked the vendor's documentation, or remove the tool. A club newsletter page rarely needs a tracking script at all.

What to write in your policy

Whatever you find, say it in your privacy or cookie notice in plain words: what is set, why, for how long, and who else is involved. If you use the statistical exception, the law requires clear and comprehensive information and a simple way to object, so put the explanation and the opt-out where visitors will see it. Our privacy policy template has a cookies paragraph you can adapt, and the GDPR guide for small clubs explains the wider picture. Charities should also read UK charity website legal requirements.

Some of our earlier guides describe cookie consent in simpler terms (any analytics needs opt-in). That was the position before 5 February 2026; the statistical exception above is the current law, and everything in this article reflects it.

Where Natterio fits

Every Natterio site has cookie consent and a contact form, and sites are UK-hosted. What your site sets in practice depends on what you add to it, such as embeds and third-party widgets, so test it after you publish. Natterio does not make your site compliant by itself. The free plan is permanent (three pages, no card) and paid plans start at £7 a month. Build your club's site free.

Sources and last checked 30 Oct 2026

• The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 (substituted 5 February 2026): legislation.gov.uk/uksi/2003/2426/regulation/6
• The same Regulations, Schedule A1 (inserted 5 February 2026): legislation.gov.uk/uksi/2003/2426/schedule/A1
• ICO, Guidance on the use of storage and access technologies, What are the exceptions?: ico.org.uk
• ICO, How do we manage consent in practice?: ico.org.uk
• ICO, Final storage and access technologies guidance published (April 2026): ico.org.uk news