Website Compliance Checklist for UK Cookies, Privacy and Accessibility

Keeping a website compliant in the UK is no longer just a legal box-ticking exercise. It is part of building trust, reducing risk and making sure visitors can actually use your site in a fair, transparent way.

For most businesses, the key areas are cookie consent, privacy notices and accessibility. These sit across different rules and standards, including UK GDPR, PECR and WCAG. They overlap in practice, which means a website that is compliant in one area can still fall short in another.

This checklist is designed as a practical starting point for UK businesses. It is general information, not legal advice.

Why website compliance matters

A website usually collects data in more ways than people realise. Forms, analytics tools, embedded videos, chat widgets, marketing pixels and accessibility barriers all create compliance considerations.

If your website is unclear, hard to navigate or overly intrusive, the risks can include:

• poor user trust
• complaints about cookies or privacy practices
• barriers for disabled users
• inaccurate or incomplete privacy information
• inconsistent consent handling
• reputational damage

Good website compliance should make your digital experience clearer, more transparent and easier to use.

1) Check your cookie use under PECR and UK GDPR

Cookies are often the first compliance issue visitors notice. Under PECR, non-essential cookies and similar technologies generally require informed consent before they are placed on a user’s device.

Start by auditing every tool that sets cookies or uses similar tracking technology, including:

• analytics platforms
• marketing and advertising pixels
• social media embeds
• video players
• live chat tools
• preference management tools
• A/B testing and personalisation software

What to check

• Are only strictly necessary cookies set before consent?
• Is consent genuinely optional, rather than bundled into a generic “accept all” approach?
• Can users reject non-essential cookies as easily as they accept them?
• Is it clear what each cookie does, who provides it and how long it lasts?
• Can users change or withdraw consent later?

Good practice

• Use clear, plain English in the cookie banner.
• Avoid pre-ticked boxes.
• Separate necessary cookies from analytics, marketing and functional cookies.
• Keep a record of consent choices.
• Review third-party tools regularly, because settings can change without warning.

If your organisation uses multiple tags and trackers, a tool such as ComplianceCheck can help identify where website disclosures and on-page controls may need review.

2) Make your privacy notice easy to find and understand

A privacy notice should explain, in plain language, how you collect and use personal data. Under UK GDPR, transparency is central. People need to know what you are doing with their information and why.

Your privacy notice should typically cover

• who you are and how to contact you
• what personal data you collect
• why you collect it and the lawful basis you rely on
• whether you share data with third parties
• whether data leaves the UK or the EEA, and any safeguards used
• how long you keep data
• what rights people have
• how to complain, including the right to contact the ICO

Checklist for a useful privacy notice

• Is it easy to find from every page, usually in the footer?
• Is it written for your actual audience, not copied from a template with vague wording?
• Does it reflect what the website really does today?
• Does it explain cookies, analytics and contact forms clearly?
• Is it kept up to date when your tools, suppliers or processes change?

A privacy notice should not read like a legal wall of text. The best notices are structured, readable and honest about what happens behind the scenes.

3) Build accessibility in from the start

Accessibility is not only a technical issue; it is part of legal and ethical website design. In practice, many businesses use WCAG as the recognised benchmark for accessible web content.

A website that is hard to navigate, impossible to read on mobile or unusable with a keyboard can exclude users with disabilities and create avoidable risk.

Key accessibility checks

• Is text readable with sufficient colour contrast?
• Can every function be used with a keyboard?
• Do images have meaningful alternative text where needed?
• Are form fields labelled clearly?
• Are headings used in a logical order?
• Are videos captioned or otherwise accessible?
• Are error messages specific and helpful?
• Does the site work well with screen readers and zoom tools?

Accessibility and compliance go together

Cookie banners, privacy links and consent controls also need to be accessible. A banner that blocks the page but cannot be operated with a keyboard is not a good user experience and may be a compliance problem in itself.

Pay particular attention to:

• focus order in pop-ups and modals
• colour contrast in buttons and text
• accessible labelling of cookie categories
• readable consent and rejection options
• keyboard access to settings panels

4) Review forms, embeds and marketing tools

Many compliance gaps sit outside the main website pages. Forms and third-party tools often collect more data than teams expect.

Review these areas carefully

• contact forms
• newsletter sign-up forms
• recruitment forms
• embedded maps
• embedded videos
• social media feeds
• chatbot and helpdesk widgets
• CRM and email marketing integrations

For each one, ask:

• What data is collected?
• Why is it collected?
• Where is it stored?
• Who can access it?
• Is the user told clearly before they submit?
• Does the tool load trackers before consent?

It is also important to understand whether a tool is truly necessary for the page or whether a more privacy-conscious alternative is available.

5) Keep records of decisions and reviews

Website compliance is not a one-off project. New plugins, redesigned pages and supplier changes can create new risks quickly.

A simple governance process can help:

• assign a responsible owner for website compliance
• schedule regular audits of cookies, notices and accessibility
• record what tools are in use and why
• document changes to privacy notices and consent settings
• test key journeys, including mobile and assistive technology use

This helps teams show they have considered compliance actively rather than assuming a plugin or template has done the work for them.

6) Use official guidance as your reference point

For UK businesses, the most reliable starting points are the regulators and public bodies that publish official guidance. In particular, the ICO is the key source for UK GDPR and PECR expectations.

You may also find it helpful to consult:

• ICO for guidance on cookies, consent, privacy notices and data protection rights
• GOV.UK for broader UK government information and digital guidance
• NCSC for security-related website and online service advice
• ACAS where website forms or recruitment processes affect employment practices
• HSE where online processes support health and safety reporting or operational controls

Always check the latest official guidance, because requirements and regulator expectations can evolve.

Practical takeaways

• Audit all cookies and trackers, not just the ones you recognise.
• Make consent real: optional, informed and easy to withdraw.
• Write privacy notices in plain English and keep them current.
• Check accessibility for banners, forms, navigation and media.
• Review third-party tools, embeds and marketing integrations regularly.
• Keep records of what you changed and why.
• Use official guidance from the ICO and other UK bodies as your baseline.

A compliant website should be transparent, usable and respectful of the people who visit it. If you get the basics right, you improve trust, reduce risk and create a better experience for everyone.

Final thought

Cookie consent, privacy notices and accessibility are often managed by different teams, but users experience them as one website. The strongest compliance approach is joined-up: legal, technical and design decisions should support each other rather than working in isolation.

That is where regular review, clear ownership and practical tooling make a real difference.