Your school website is probably the most visited "front door" you have. Parents check it for term dates, prospective families browse it before an open evening, and pupils use it to find homework links. If that website carries a Facebook "Like" button, an embedded Instagram feed, a YouTube video or a tracking pixel, some of those visitors are being tracked by social media platforms before they have clicked on anything.

The rules on cookies and similar technologies changed in February 2026, and the ICO published its final guidance in April 2026. This article explains what has changed, where social media tracking tends to hide on school websites, and how to check your own site in five minutes.

It's not just cookies any more

The rules are set out in the Privacy and Electronic Communications Regulations (PECR), which sit alongside the UK GDPR. They cover any technology that stores information on, or reads information from, a visitor's device. The ICO now calls these storage and access technologies. As well as cookies, that includes tracking pixels, web storage, scripts and tags, and device fingerprinting.

The basic rule has not changed: you must tell visitors what technologies you use and what they do, and you must get their consent before using them, unless an exception applies. Consent has to meet the UK GDPR standard, so refusing must be as easy as accepting, and nothing non-essential can run until the visitor has said yes.

Crucially, these requirements also apply to technologies you bring in from other organisations, such as social media platforms. The Data (Use and Access) Act 2025 made this clearer still by covering anyone who instigates storage or access, not just whoever technically performs it. If your website loads a social media widget, your school is responsible for what that widget does.

Where social media tracking hides on a school website

1. Like and share buttons. Social media plugins load code from the platform as the page opens. They can record the visit even if nobody clicks the button.
2. Embedded feeds and videos. A "Latest from our Facebook page" panel, an embedded X or Instagram feed, or a YouTube video loads content, and often cookies, from that platform.
3. Tracking pixels. Pixels (for example from Meta, TikTok or LinkedIn) are small, invisible pieces of code that report visits back to the platform, usually for advertising or audience-building. They are sometimes added by a website designer or for a recruitment campaign and then forgotten.
4. The cookie banner itself. Many school sites have a banner that appears, but the social media code has already loaded behind it, or there is an "Accept" button with no equal "Reject" option.

What changed in 2026

The Data (Use and Access) Act 2025 amended PECR, and the cookie changes came into force on 5 February 2026. There are now five exceptions where consent is not needed:

• Communication: storage or access needed solely to send a communication over a network.
• Strictly necessary: needed to provide the service the visitor has asked for, such as a login or a shopping basket.
• Statistical purposes (new): used only to collect statistics about how your website is used so you can improve it.
• Appearance (new): used only to adapt how the website looks or works to the visitor's preferences, such as text size or language.
• Emergency assistance (new): used to help locate someone in an emergency.

For the statistical and appearance exceptions, you must still give clear information and a simple, free way to object. Each exception applies only where the technology is used solely for that purpose. If an analytics tool also shares data for advertising, the exception falls away and you need consent.

Social media tracking does not fit any of these exceptions. The ICO's guidance says social media plugins are only likely to be strictly necessary for visitors who are already logged in to that platform and choose to use them. For everyone else, and for tracking pixels used for advertising, consent comes first.

Maximum fines for breaching the PECR cookie rules now match the UK GDPR: up to £17.5 million or 4% of annual worldwide turnover.

What about children?

School websites are visited by pupils as well as adults. Where children are likely to use an online service, the ICO's Children's Code expects high privacy settings by default and no profiling unless there is a compelling reason. Social media tracking on pages pupils use, such as homework, clubs or learning resources, is hard to justify. The simplest answer is not to have it there at all.

Check your own website in five minutes

1. Open your school website in a private or incognito window, so you arrive as a new visitor.
2. Don't click anything on the cookie banner yet.
3. Open your browser's developer tools (press F12 in Chrome or Edge), go to the Application tab and look under Cookies. Note any domains that aren't your own, such as facebook.com, instagram.com, youtube.com, tiktok.com or linkedin.com.
4. Look at the page itself: are there share buttons, social feeds or embedded videos?
5. Now click Reject and reload the page. Social media cookies should not appear. If they do, the banner isn't working.

If you're not comfortable using developer tools, ask your website provider for a list of every cookie, pixel and third-party script on the site, what each is for, and whether it loads before or after consent.

What to do next

• Remove what you don't need. Old pixels, unused share buttons and feeds that nobody looks at are risk with no benefit.
• Link instead of embedding. A simple "Follow us on Facebook" link or icon doesn't load any tracking until someone chooses to click it.
• Put embedded content behind consent. Use a "click to load" placeholder for videos and feeds. YouTube's privacy-enhanced mode (youtube-nocookie.com) reduces tracking, but it isn't cookie-free, so it still needs to sit behind consent.
• Fix the banner. Reject must be as easy as Accept, nothing non-essential should load first, and visitors must be able to change their mind later.
• Update your cookie policy and privacy notice so they list every technology you use and why.
• Include your website in supplier due diligence. Your website provider, and any plugin they add, should be able to explain what their code does. Our Supplier Due Diligence best practice area can help.
• Check again every year, and whenever your website is redesigned or a new campaign adds tracking.
• Make sure your cookie banner actually blocks. Your cookie banner or Cookie Management Platform (CMP) should stop social media and other non-essential scripts loading until a visitor clicks "Accept". Many basic banners only display a notice while the scripts run in the background. Reject must be as easy as Accept, and visitors must be able to change their mind later.
• Link instead of embedding. Replace live social feeds and "Like" or "Follow" widgets with a static image or a styled button that links to the school's social media page. Nothing loads from the platform until someone chooses to click.
• Use YouTube's privacy-enhanced mode, behind a click-to-load placeholder. If you embed YouTube videos, use the youtube-nocookie.com address rather than the standard one. Privacy-enhanced mode reduces tracking but isn't cookie-free, so show a placeholder image that only loads the video when a visitor chooses to play it, or load it only after consent.

Further reading

• ICO: Guidance on the use of storage and access technologies
• ICO: What are PECR?
• Using WhatsApp in Schools
• Guardians of Privacy: Social Media, Privacy, Children and the AI Threat

Want updates like this in your inbox? Sign up to Keep in the Know, our data protection newsletter for schools and trusts.

Last reviewed: November 2026