What are the UK cookie rules?
Cookies and similar technologies (pixels, local storage, device fingerprinting) are regulated in the UK by the Privacy and Electronic Communications Regulations (PECR), alongside UK GDPR where personal data is involved. The Information Commissioner's Office (ICO) enforces both.
Before 2026, you needed consent for almost everything except cookies that were strictly necessary - such as a shopping basket or a login session. That's why nearly every UK site has a cookie banner.
What did the Data (Use and Access) Act 2025 change?
The Data (Use and Access) Act 2025 became law in June 2025. Its cookie changes took effect on 5 February 2026, and the ICO finalised its updated guidance in April 2026.
The Act added new exceptions where consent isn't needed, including:
- Statistical purposes - collecting information to produce aggregate statistics that help you improve your website or service.
- Appearance and functionality - remembering choices such as language, text size or layout preferences.
- Emergency assistance - locating someone who needs emergency help.
Can I now use Google Analytics without consent?
Possibly - but it depends on how it's set up. The ICO's guidance on the exceptions says the statistical exception only applies where:
- The information is used only to improve your website or service.
- It produces aggregate statistics, not profiles of individuals.
- It is not also used for other purposes, such as advertising or sharing with third parties for their own use.
- You give clear information about the analytics and a free, simple way to opt out.
If your analytics tool shares data for advertising, links with ad platforms, or builds profiles of individual visitors, you still need consent. Review your settings - particularly data sharing, Google signals and advertising features - before switching off consent.
What still needs consent?
- Advertising and retargeting cookies and pixels (for example Meta Pixel or Google Ads remarketing).
- Cross-site tracking and profiling.
- Most third-party embeds that track users, unless they are configured not to.
What should UK businesses do now?
- Audit your cookies and tags - list every tool that stores or reads data on visitors' devices.
- Sort them into categories - strictly necessary, statistical (exception), functionality (exception), and consent-required.
- Update your cookie banner - you may be able to load qualifying analytics by default, with an opt-out, while keeping marketing tags behind consent.
- Update your privacy and cookie policies to explain the exceptions you rely on.
- Check consent mode - if you run Google Ads, configure Google's consent mode so tags behave correctly depending on the user's choice.
- Document your reasoning - record why each tool qualifies for an exception.
Other DUAA changes worth knowing
From 19 June 2026, organisations must have a process for handling data protection complaints before people escalate to the ICO. The Act also increased the maximum fines for PECR breaches to align with UK GDPR levels. See the ICO's overview of what the DUAA means for organisations.
The bottom line
The changes reduce banner fatigue for simple, privacy-friendly analytics - but they don't remove the need for consent for marketing and tracking. Many businesses can now get better analytics coverage while staying compliant, but only if their tools are configured carefully.
Our web development and digital marketing teams set up analytics and consent together, so your data is useful and compliant.
Sources and further reading
Written by
Eirmon Solutions Editorial TeamWeb, SEO and marketing team
Practical guides on web design, SEO, AI and digital marketing from the Eirmon Solutions team, written for UK business owners and checked against the sources listed with each article.
