The cookie rules that apply to UK websites changed on 5 February 2026, when the Data (Use and Access) Act 2025 amended regulation 6 of the Privacy and Electronic Communications Regulations (PECR). The biggest practical change for cookie consent in the UK is a new exemption that lets websites run some analytics cookies without asking for consent first, provided visitors are told and can object. The Information Commissioner's Office (ICO) followed with final guidance on 29 April 2026, and its fining powers under PECR have risen to the UK GDPR level.
This article explains the change in plain terms. It is general information, not legal advice.
Key takeaways
- Since 5 February 2026, UK websites can set analytics cookies without prior consent if visitors are told and can object easily.
- The analytics exemption covers aggregate statistics only, and any tool that links data to adverts or tracks people across sites still needs consent.
- Advertising cookies, including ad measurement and conversion tracking for ad partners, still need consent under the ICO's guidance.
- The ICO can now fine up to £17.5 million or 4% of global turnover under PECR, up from the old £500,000 maximum.
What happened
The Data (Use and Access) Act 2025 (DUAA) received Royal Assent in June 2025. Its provisions have been switched on in stages by commencement regulations. The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82), made on 29 January 2026, brought section 112 and Schedule 12 (storing information in terminal equipment) and section 115 and Schedule 13 (the ICO's PECR enforcement powers) into force on 5 February 2026.
Schedule 12 inserts a new Schedule A1 into PECR. It keeps the general rule that you need consent to store or access information on a user's device, then sets out exceptions:
| Exception | When it applies | Conditions |
|---|---|---|
| Transmission | Sole purpose is sending a communication over a network | None beyond the purpose |
| Strictly necessary | Needed to provide a service the user asked for (e.g. security, fraud prevention, log-in, remembering basket items) | None beyond the purpose |
| Statistical purposes ("analytics") | Sole purpose is collecting statistics on how your site is used, to improve it | Clear information plus a simple, free way to object |
| Appearance and preferences | Sole purpose is adapting how the site looks or works to the user's preferences | Clear information plus a simple, free way to object |
| Emergency assistance | Locating a user who has asked for emergency help | Sole purpose is establishing location |
The analytics and appearance exceptions are the new ones that matter most to ordinary business websites. They are opt-out, not opt-in: the cookie can be set without prior consent, but you must explain it and let people switch it off.
The same commencement brought the ICO's higher PECR penalties into force. In its statement on 5 February 2026, the ICO said it can now issue fines of up to £17.5 million or 4% of global turnover under PECR. The old maximum was £500,000.
What the ICO's final guidance says
The ICO published its final "Guidance on the use of storage and access technologies" on 29 April 2026, after two consultations. Its section on the exceptions narrows the analytics exemption considerably:
- Aggregate statistics only. The data must produce aggregate statistics that cannot identify people, and individual-level data should be kept only as long as needed to aggregate it.
- Typical qualifying uses. Page visit totals, user journeys, scroll depth, device and browser types, referrer sources, A/B testing, city-level location, page load speed, bounce rates and exit pages.
- Third-party tools are allowed, with limits. You can use an outside analytics provider, but it must act as your processor, use the data only to help you improve your service, not link it with other data it holds, and not share it beyond that purpose.
- Sole purpose means sole purpose. If the same tool links activity to adverts, builds demographic profiles or tracks people across sites, you are outside the exception and need consent.
- Objecting must be easy. The ICO suggests toggles in your existing consent tool that are on by default and can be switched off at any time. You cannot rely on browser settings alone.
Advertising cookies are unaffected. The ICO's guidance is explicit that online advertising of any kind, including frequency capping, ad measurement and conversion tracking for ad partners, still needs consent. The ICO has separately advised government on possible low-risk advertising exceptions, but that is advice only and the current rules still apply.
What this means for UK businesses
For many small sites, the change could mean fewer pop-ups and better analytics coverage, because visitors who never touch a banner can still be counted. But it is not a blanket exemption for any analytics product. A standard setup with advertising features, cross-device signals or data shared with the vendor for its own purposes is likely to fall outside the exemption, so consent would still be needed.
The bigger risk is assuming "analytics is exempt now" and removing consent controls entirely, just as PECR fines have risen to the UK GDPR level.
What to do now
- List every cookie, pixel and script on your site. Note what each one does and who receives the data. Run a free website audit with MakeItFlow: its technology detection shows which analytics, tag manager and marketing tools a page loads, which helps you start the inventory. It does not scan cookies or check consent, so you still need a cookie scanner or your consent platform's report for the full list.
- Sort each item into an exception or "needs consent". Use the table above. Anything tied to advertising, profiling or cross-site tracking stays in the consent bucket.
- Check your analytics configuration. If you want to rely on the analytics exemption, switch off advertising and data-sharing features, confirm the vendor acts as your processor, and keep the setup limited to aggregate reporting.
- Update your cookie banner and privacy notice. Explain the exempt analytics and preference cookies in clear language and add an easy, always-available way to object.
- Keep cookies technically tidy. Set Secure, HttpOnly and SameSite attributes where appropriate; our guide to secure cookie flags explains how. MakeItFlow's security headers checker is a quick way to check the rest of your response headers at the same time.
Frequently asked questions
Can I now run Google Analytics without a cookie banner in the UK?
Not automatically. The ICO says a third-party analytics provider can fall within the exemption only if it acts on your behalf, uses the data only to help you improve your site and does not link or share it for other purposes. You must still tell visitors and give them a simple way to object. Many default configurations will not meet those conditions.
Do I still need consent for advertising and remarketing cookies?
Yes. The ICO's guidance says no exception covers online advertising, including ad measurement, frequency capping and conversion tracking for ad partners. Its May 2026 advice to government on low-risk advertising is not law.
When did the higher PECR fines start?
The ICO's enforcement powers under the DUAA came into force on 5 February 2026. Breaches that took place before that date are still dealt with under the old rules, which capped fines at £500,000.
Sources
- legislation.gov.uk: Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026
- legislation.gov.uk: Data (Use and Access) Act 2025, Schedule 12
- ICO: Statement on the commencement of the Data (Use and Access) Act
- ICO: Final storage and access technologies guidance published
- ICO: What are the exceptions?
More guides for your industry
Free checklist (PDF)
Free health & supplement brands website checklist
30 practical checks for health & supplement brands: website speed and mobile, Google Business Profile and reviews, email security, booking and enquiry handling, and AI search visibility. Each one says why it matters, and many link to a free tool that checks it.
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 21 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
