UK cookie law after the Data (Use and Access) Act

Under UK cookie law you no longer need consent for every analytics cookie: since 5 February 2026, cookies used only to count and improve how your own site is used may run without consent, as long as you explain them clearly and give visitors a free and simple way to object. Advertising cookies, tracking pixels and anything that follows a person across sites still need consent before they load.

The rule sits in regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR), which the Data (Use and Access) Act 2025 amended. The Act received Royal Assent on 19 June 2025; the cookie changes and the new fines came into force on 5 February 2026. The Information Commissioner's Office (ICO) finalised its guidance on what it now calls storage and access technologies on 29 April 2026, after two consultations.

This guide covers what changed, the five conditions an analytics cookie has to meet, which tags stay behind a consent banner, what the ICO can now fine, and why a site that also serves visitors in the EU cannot simply take the UK minimum. The EU side of the question is answered in do I need a cookie banner.

What changed on 5 February 2026

PECR used to allow two exceptions to consent: storage needed to transmit a communication, and storage strictly necessary for a service the user asked for. Everything else, including a plain visitor counter, needed consent. The amended regulation 6 adds three new exceptions and raises the penalties to the level of the UK GDPR.

The fines apply to breaches from 5 February 2026 onwards; they are not retrospective. The ICO has said it will publish new PECR enforcement guidance, and until then its existing Regulatory Action Policy applies.

In ICO language, a cookie is now one of many storage and access technologies. The guidance names tracking pixels, link decoration, local storage, device fingerprinting, and scripts and tags, and says the list is only illustrative. A Meta pixel that sets no cookie is still covered, and so is a script that reads a device fingerprint.

Analytics without consent: the five conditions

The statistical purposes exception is the change most UK sites care about. It holds only when all five conditions are met:

1. One purpose. The cookie or script exists only to collect statistics about how your service is used, with a view to improving it. A tag that also feeds advertising, conversion tracking or profiling is out of the exception, whatever else it does.
2. Your own service. You are the provider of the website or app being measured. The ICO's examples of what fits are page-by-page visit totals, scroll depth and clicks, device and browser types, referring sites, A/B tests, coarse city or regional location, page speed and bounce rates.
3. Clear and comprehensive information. Visitors are told what is measured and why, in a place they actually see, not only in a policy three links deep.
4. A simple, free way to object. A switch in your cookie settings or a link in the footer that turns measurement off. Pointing people to their browser settings is not enough, the ICO says.
5. No sharing beyond improving the service. The data may go to an analytics provider only so it can help you improve your site. That provider has to act as your processor, not use the data for its own purposes and not link it to other information.

What stays out, in the ICO's own examples: individual visitor logs or session recordings (unless used only for security), tracking whether someone saw an ad, visitor IDs linked to conversions, and profiling by IP address or behaviour. A recording tool that replays one visitor's session needs consent, even if you only use it to fix your checkout.

For a site that only wants to know which pages work, the cleanest route is measurement that sets no cookie and keeps no identifier at all. The ICO still expects you to describe it and to let people object, but you avoid the question of whether a third-party tool qualifies.

The appearance exception and fonts

The second new exception covers storage that adapts how the site looks or works to the visitor's own preference: the language they picked, dark mode, a layout that responds to the screen size. It does not cover tailoring content or ads to interests a site has inferred. The same two duties apply as for analytics: tell people and let them object, free of charge.

The ICO lists a font library under this exception, and names self-hosting as an option. A web font loaded from a third party's server sends that server the visitor's IP address with every page view. Hosting the font files on your own domain removes that request, and with it the need to explain a third party's role. In Germany the same question went to court; see are Google Fonts GDPR compliant.

Which tags still need consent first

None of the new exceptions touches advertising. The ICO is explicit that any advertising purpose, including ad measurement and frequency capping, falls outside the analytics exception. In practice that keeps these behind a banner in the UK:

• the Meta pixel and Meta's Conversions API set up from the browser;
• Google Ads conversion tags and remarketing lists, and Floodlight;
• the LinkedIn Insight Tag, the TikTok pixel and similar platform tags;
• embedded YouTube or Vimeo players that set cookies before a click, unless you use their privacy-enhanced mode and it truly sets nothing;
• chat widgets and session recorders that identify a visitor across visits;
• any identifier that links a visit to a later sale for an advertising platform.

For these, the old standard stands: nothing loads before the visitor chooses, the choice to reject is as easy as the choice to accept, and consent is specific, informed and as easy to withdraw as to give. The UK GDPR sets that standard, and our guide to UK GDPR vs EU GDPR covers where the two regimes now part ways.

If you run Google Ads, your banner also has to pass the visitor's choice to Google's tags through Consent Mode. What changed there in June 2026 is in Consent Mode and Google Analytics; how the pixel feeds a campaign is on Meta ads.

How the ICO enforces it

The ICO has been testing the most visited sites in the UK. In January 2025 it reviewed the top 200, raised concerns with 134 of them and announced it would look at the top 1,000. In December 2025 it reported that 979 of the top 1,000 now met its tests on advertising cookies: 415 passed at once, 564 changed their practices after letters and investigations, and 17 preliminary enforcement notices were issued. It said it would keep testing the top 1,000 periodically.

The tests it used are the ones to run on your own site:

• no non-essential cookie is placed before the visitor has made a choice;
• rejecting is as easy as accepting, on the first layer of the banner;
• after a rejection, no non-essential cookie appears anyway;
• consent can be withdrawn as easily as it was given.

The ICO says formal action is reserved for organisations that refuse to comply and that monetary penalties are for the most serious breaches. With a ceiling that now matches the UK GDPR, the cost of being one of those cases has changed.

A site for the UK and the EU at once

Most businesses with a UK audience also sell to Ireland, the Netherlands, Germany or France. EU law did not change on 5 February 2026. Article 5(3) of the ePrivacy Directive still requires consent for anything that is not strictly necessary, and most EU regulators count analytics as not strictly necessary. France is the exception that proves the rule: the CNIL exempts audience measurement only under strict conditions of its own, covered in CNIL cookie rules.

There are two ways to handle this. One banner on the strictest rule for everyone is the simplest and the safest: it costs you some UK analytics data, nothing else. Or the site detects the visitor's country and shows a lighter UK notice with an opt-out, and the full consent banner for the EU. The second keeps more data but has to be built and tested, because a mistake in the detection means an EU visitor gets the UK treatment. The EU is also reviewing its own rules: the digital omnibus on cookies may move the EU closer to the UK model, but nothing has changed in EU law yet.

Checking your own site in twenty minutes

Open your site in a private window, with your browser's developer tools on the Application or Storage tab, and do not click the banner.

If you also process personal data through the site, through a contact form or a shop, you need a privacy notice as well; see do I need a privacy policy. Our own approach is in our cookie policy.