Current position
As built, this site sets no cookies at all. There is no analytics, no tag manager, no embedded media and no third-party script of any kind. Fonts are served from this domain rather than from a third party.
That is a deliberate starting point and it is worth preserving for as long as possible: a site with no cookies needs no consent banner, which removes a layer of friction, a compliance risk and a Core Web Vitals cost at once.
If analytics is added later
The moment any analytics, advertising or tag-management script is added, this changes. Non-essential cookies require consent under PECR before they are set — not after, and not on an implied basis.
At that point the site needs a consent mechanism that blocks non-essential tags until a choice is made, records the choice, and lets it be withdrawn as easily as it was given. This page then needs a table listing each cookie, its purpose, its provider and its duration.
A privacy-first analytics tool that sets no cookies is worth considering first — it avoids the banner entirely and gives you most of what a small business actually looks at.
Next step