Yes, almost certainly. Any UK website using tracking tools like Google Analytics needs to comply with the Privacy and Electronic Communications Regulations, usually shortened to PECR.
What PECR requires
The Information Commissioner’s Office requires sites to give clear and comprehensive information about the purpose of the cookies they use, and to get explicit consent from visitors before setting any non-essential cookies.
Essential versus non-essential cookies
Essential cookies are the ones a site genuinely needs to function, such as remembering the contents of a shopping basket. Non-essential cookies, mainly tracking and analytics, require an explicit opt-in from the visitor before they are set.
Consent has to be explicit
Simply mentioning cookies somewhere in your terms of service is not sufficient for UK compliance. Visitors need an active choice, not a buried assumption. The ICO can fine businesses up to 4% of annual turnover for getting this wrong.
A couple of practical notes
- Cookie consent choices typically remain valid for 12 months before being asked again
- Somewhat ironically, the record of a visitor’s consent choice is itself usually stored in a cookie
It is worth checking your own agency’s website while you are at it. It is surprisingly common for web agencies to not have proper cookie consent on their own site, even while building it for clients.