The cookieless web for hotels, and what privacy-first means now

When we first wrote about the cookieless web in 2021, the threat was Chrome. Google was about to switch off third-party cookies, and every hotel marketer was told to prepare for the end of remarketing.

That never happened. Chrome kept third-party cookies, and in October 2025 Google retired most of the technology it had built to replace them. Hotels went cookieless anyway, just not in the way anyone predicted. The data now disappears at the consent banner, when a guest presses reject, and in Safari, which limits cookies whatever Google decides.

So a privacy-first hotel website in 2026 does two things. It asks for consent properly, so the guests who say yes are measured well. And it builds first-party data, the information guests choose to hand over, so less of the marketing depends on a cookie at all.

What happened to cookies

A first-party cookie is set by the website the guest is on. A third-party cookie is set by another domain, usually an ad platform, and follows the guest from site to site.

The third-party kind was the one under threat. Google delayed its removal from Chrome repeatedly, then said in April 2025 that it would keep offering users the choice instead. On 17 October 2025 it retired most of the Privacy Sandbox, including Topics, Protected Audience and the Attribution Reporting API. Those were the three replacements our 2022 follow-up told hotels to watch.

Safari and Firefox block third-party cookies by default, and Safari caps many first-party ones at seven days, the problem our guide to server-side tracking deals with.

For a hotel, the cookie that matters is your own, and it lives or dies at the banner. A wrong banner costs bookings in the reports and risk with the regulator at once, which is why consent sits with tracking in our Growth Marketing practice.

What the law asks of a hotel

Two sets of rules apply to a UK hotel website. PECR covers cookies and marketing emails. UK GDPR covers the personal data itself. Both were amended by the Data (Use and Access) Act 2025.

Cookies and consent

Under PECR, any cookie that is not strictly necessary needs consent before it is set. Advertising cookies, the Meta pixel and remarketing tags all need it, and rejecting has to be as easy as accepting.

The 2025 Act added exceptions. Analytics used only to produce aggregate statistics about how the site is used can now run without consent, provided visitors are told and given a simple, free way to object. The ICO's final guidance on storage and access technologies, published on 29 April 2026, is clear that this covers how the site is used, not who uses it. It does not cover advertising measurement, attribution, profiling or cross-site tracking.

That rules out most hotel set-ups. A GA4 property linked to Google Ads, sharing audiences and importing conversions, is doing advertising work. PECR fines now match UK GDPR, up to £17.5 million or 4 per cent of global turnover.

Guest data under UK GDPR

The basics have not moved since 2018, and they still catch hotels out. The hotel is the controller of its guests' data, deciding what is collected and why. The booking engine, the CRM, the email platform and the agency are processors, acting on the hotel's instructions, and each needs a data processing agreement.

A guest can ask to see everything you hold on them, and you have a month to answer. Under the 2025 Act a search only has to be reasonable and proportionate, but you still need to know where the data lives. The privacy notice should say in plain English what you collect, why, and who you share it with. Everyone who handles guest data, from reception to reservations, needs training in the rules.

Getting consent right

Most hotel teams treat the consent banner as a legal box someone else ticked. It is the first thing a guest sees, before the rooms or the price, and it belongs to the booking journey as much as the booking engine does.

Where hotel banners go wrong

The same faults come up in almost every set-up I review.

• Tags that fire before the choice. Advertising tags load with the page, so the guest is tracked before they answer. It was one of three things the ICO checked when it reviewed the UK's top 1,000 websites in 2025.
• A reject option that is hard to find. Accept is a button, reject is a link two screens deep. That fails the ICO's test.
• A second banner on the booking engine. The website runs one consent platform and the booking engine runs another, so the guest is asked twice or not at all. Our guide to GA4 key events covers why this breaks attribution.
• Categories that do not match the tags. The banner promises marketing cookies are off, while a metasearch or affiliate tag in the container ignores it.
• Forms with no consent record. I have seen a newsletter sign-up push guests' details into a CRM with no record that they agreed to receive email.

Consent Mode v2 and its limits

Consent Mode is how Google's tags learn what the guest chose. It passes four signals (ad storage, analytics storage, ad user data and ad personalisation), and Google has required it since March 2024 for advertisers using UK and EEA users' data.

It runs in two ways. In basic mode, Google's tags do not load until the guest consents. In advanced mode, they load with consent denied and send cookieless pings, which Google uses to model the conversions it can no longer observe. Google's consent mode documentation sets out the difference. Whether advanced mode suits your hotel is a question for your privacy adviser, not only for whoever runs your tags.

Modelling is often sold as the fix. For GA4, it needs advanced mode, at least 1,000 events a day from guests who declined and at least 1,000 daily users who accepted. Many independent hotels never reach that, so the declined visits simply go missing.

Consent mode strips a significant portion of attribution overnight.
And we all just adjusted the spreadsheets.
Harry Fielder, CEO, Umi

Consent Mode tells Google what the guest chose. It cannot change what they chose.

Building first-party data

The 2021 version of this article predicted two replacements for the third-party cookie, hashed email addresses and a web where guests are signed in. Both were right, and both depend on the hotel owning the relationship.

Data guests hand you

A booking, an enquiry, a newsletter sign-up and a Wi-Fi login all give you an email address with a reason attached. Google's enhanced conversions and Customer Match, and Meta's equivalents, accept those addresses hashed, so a booking can be matched to an ad click without a long-lived cookie. They still need the guest's consent to use their data for advertising.

Under PECR's soft opt-in, a guest who booked with you can receive marketing about similar stays, provided they were offered an opt-out when they booked and in every email since. Every other sign-up needs a clear tick, recorded. Our guide to growing your hotel's newsletter database covers the capture points.

Guests who sign in

A guest who logs in to manage a booking, a membership or a spa package is recognised on any device, whatever their cookies say. That makes the login one of the most strategic parts of a hotel website, because it decides who owns the relationship. If the hotel holds that identity, the booking, the dinner and the newsletter click become one guest rather than three strangers.

Joining those records across the PMS, the booking engine and the CRM is the job Mio does for the hotels we work with.

Every guest who signs in is a guest you no longer need a cookie to recognise.

Where to start

1. Audit the banner. List every tag in your container, check which consent category each one sits in, and remove the ones nobody can explain.
2. Make reject equal. Put accept and reject side by side on the first layer, in the same style.
3. Use one consent platform. Run the same one on the website and the booking engine, and pass the guest's choice across.
4. Set up Consent Mode v2. Choose basic or advanced deliberately, with your privacy adviser, and set consent rules for every tag that is not Google's.
5. Record consent at every form. Make sure each sign-up and enquiry stores what the guest agreed to, and that the CRM only emails people who agreed.
6. Review your processors. Check there is a data processing agreement with the booking engine, the CRM, the email platform and every agency.

Then do one test yourself. Open your website in a private window, press reject, and use Google's Tag Assistant to see what still fires. If an ad tag sends data after a guest said no, fix that before anything else in this list.