Nothing to pay up front. 12 month minimum, then it rolls monthly at the same price. After that the site is yours to keep, moved into your own Webflow account for a one off £250.
BEHIND THE WORK
A small senior team building marketing engines for ambitious brands.
Cookie Banner for Small Business UK: What the Rules Need
A Webflow agency in Suffolk explains what PECR and UK GDPR ask of a small site's cookie banner and contact form, with a table and a 3 field form test.
Web Design
October 23, 2026
What PECR and UK GDPR ask of a small site's cookie banner and contact form, in plain English, with a table and a check you can do today.
Say you run a plumbing firm in Stowmarket with two vans. A customer emails to say your cookie banner only has an Accept button. You open your contact form and count 9 fields, when you only ever use 3 of them. That's usually how a cookie banner problem turns up on a small business site. Someone else spots it first.
We build Webflow sites on monthly plans, so bear in mind we'd like your business. We're web people, not lawyers, and this is general guidance rather than legal advice. Check the ICO's guidance or take advice for your own case. If someone already maintains your site, ask them to check both things this month.
Key takeaways
If your site sets analytics or advertising cookies, PECR expects consent before they load. An Accept button on its own isn't a real choice.
A typical enquiry form needs a name, a way to reply and the message. Every extra field is data you must justify and protect.
A small site with no analytics and no embeds may need no banner at all, so check what your site sets first.
Our Webflow plans are from £189 a month, with hosting, SEO and content edits on request included and nothing up front.
Do you need a cookie banner on a small business website?
Yes, if your site sets cookies that aren't strictly necessary, because PECR asks for consent before they're set. If everything it sets is strictly necessary, you don't need one.
Take a clinic in Sudbury running Google Analytics, with a YouTube video on the contact page and a map in the footer. Each of those can set cookies, and none of them is needed for the site to work, so the clinic needs a banner. The consent only counts if the banner does 4 things:
It asks for a clear positive action, such as clicking a button.
It starts with every box unticked.
It makes rejecting as easy as accepting.
It lets people change their mind later.
Type
Typical example on a small site
Ask before it loads?
Strictly necessary
A security cookie, or a shop basket
No, these are exempt
Analytics
Google Analytics
Yes, as the safe default
Advertising
A Meta pixel or Google Ads tag
Yes
Embeds
YouTube, Google Maps, a social feed
Yes, when they set cookies
Most small sites trip the consent rule by accident, through an analytics tag or an embed that the owner added years ago and then forgot about. Find out what yours actually sets before you choose a banner tool, because a banner only works if it holds back the right tags.
What does a contact form need under UK GDPR?
Collect only what you need, explain why and for how long in a privacy notice, and link that notice right next to the form. Replying to an enquiry usually rests on legitimate interests, or on steps someone asked for before a contract.
1. Ask for less
Picture a Newmarket physio whose form asks for a date of birth on every single enquiry. Nobody reads the answer, yet it still has to be kept safe. Stick to a name, a contact detail and the message.
2. Say what you'll do with it
Put a link to your privacy notice beside the submit button, where people will actually see it. The notice should cover who you are, what you collect, why you collect it, how long you keep it and who to contact.
3. Keep marketing separate
A newsletter tick box should be its own box, and it should start unticked. Someone asking for a quote hasn't asked for your monthly email.
When this isn't worth paying anyone for
If your site sets no analytics or embed cookies and the form is already short, we're the wrong answer. A one page brochure site like that may need little more than a clear privacy notice. Fix the notice and leave the rest.
If you're on WordPress and a consent plugin already works properly, don't move platform for this alone.
Health information, children's data and regulated financial work bring stricter rules, so check the ICO and take proper advice rather than lean on a blog post, ours included.
Do I need a cookie banner on my small business website?
Yes, if your site sets analytics or advertising cookies, or loads embeds that set them. Strictly necessary cookies on their own don't need a banner.
Is "Accept all" enough, or must there be a "Reject all" button?
Accept alone isn't enough. Reject should be as easy as accept, with nothing ticked in advance and no refusal hidden behind a settings screen.
What should a contact form privacy notice say?
Who you are, what you collect, why you collect it, how long you keep it and who to contact. Name anyone else who handles the data, such as your email provider, and say what rights people have over it.
Do I need consent to email someone who filled in my contact form?
Replying to their enquiry is fine. Marketing emails are a different matter, so the safe route is a separate opt in box, never ticked for them, with a note of when and how each person agreed.
Check your own site this week
Open your site in a private browser window and don't click Accept. Use the browser's site settings or developer tools to see which cookies are already stored, and note anything that isn't strictly necessary. Then check whether Reject is as easy to find and click as Accept.
Now open the contact form. Is there a privacy link? How many fields are there, and is any box already ticked for the visitor? Cut the fields you never use.
Send us your site address and we'll tell you what it sets before consent, even if you never hire us.
Written by the FutureProofs team in Suffolk. Reviewed by Luke.
