Law updates
Analytics cookies in the UK: when you no longer need consent
Since February 5, 2026, UK sites can run some analytics cookies without consent. The conditions, what still needs consent, and what to change on your site.
On this page
Key points
- Since February 5, 2026, UK websites can use analytics cookies without consent, but only under strict conditions.
- You must explain the analytics clearly, give a simple and free way to object, and use a provider that acts as your processor.
- Advertising cookies still need consent, with no exceptions.
- Fines for cookie breaches rose to up to £17.5 million or 4% of worldwide turnover.
For years, the UK rule was simple: any cookie that isn’t strictly necessary needs consent, including analytics. The Data (Use and Access) Act 2025 changed that. It rewrote the UK’s cookie rule, regulation 6 of the Privacy and Electronic Communications Regulations (PECR), and since February 5, 2026 some analytics and preference cookies can run without consent. Here is what the new exceptions allow, what they don’t, and what to change on your site.
What needs consent in the UK now
| Purpose | Consent needed? | Conditions |
|---|---|---|
| Strictly necessary | No | Needed for the service the visitor asked for, including security and fraud prevention |
| Analytics (statistics) | No, if every condition is met | Only to measure how your service is used, to improve it; clear information; a simple, free way to object; the provider acts as your processor |
| Appearance and functionality | No, if every condition is met | Only to make the site look or work the way the visitor chose; clear information; a simple, free way to object |
| Advertising | Yes, always | Includes ad measurement, frequency capping, click fraud detection and market research |
The conditions for analytics without consent
The analytics exception is narrow. The Information Commissioner’s Office (ICO) says all of these must be true:
- Statistics only. The sole purpose is to collect statistics about how your service is used so you can improve it, not to identify, track or monitor people.
- Aggregate results. The results don’t identify anyone, and individual-level data is kept only as long as needed to produce them.
- Clear information. You explain the purpose clearly and comprehensively, and say that you use an analytics provider and what it does with the data.
- A simple, free way to object. Visitors can easily turn the analytics off.
- A processor, not a partner. A third-party analytics provider must act only on your behalf, as your processor and not a joint controller, and must not combine the data with other information it holds.
Still needs consent: analytics that profiles or segments visitors (for example by age or gender to target content), monitors individual visitors, links visitors to purchases shared with ad partners, or tracks people across services. Check your analytics provider’s terms before relying on the exception.
Advertising cookies still need consent
Nothing changed for advertising. The ICO’s guidance is plain: “Online advertising purposes are not exempt from PECR’s consent requirements and never have been.” That covers ad measurement, frequency capping, click fraud detection, market research and device fingerprinting for ads. So a UK cookie banner is still needed on any site that uses advertising or remarketing tags.
Bigger fines, and a complaints process
The same law raised the stakes. Since February 5, 2026, cookie breaches carry the UK GDPR’s higher maximum fine: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. The cap had been £500,000. And since June 19, 2026, every organization must offer a way to make data protection complaints, acknowledge them within 30 days, and respond without undue delay.
Not in the EU: these exceptions are UK law only. If you have visitors in the EU, the EU rules still apply there, and consent remains the rule for cookies that aren’t strictly necessary. See our GDPR cookie banner guide.
Does this apply to a US website?
It can. The UK GDPR applies to businesses outside the UK that offer goods or services to people in the UK or monitor their behavior there. If your site sells to UK customers or tracks UK visitors, plan for the UK rules. Read more on our UK GDPR and PECR page.
How to update your site
- List your cookies and tags. Scan your site and note what each one does.
- Sort them by purpose. Strictly necessary, analytics, appearance and functionality, or advertising.
- Check your analytics against every condition. Statistics only, aggregate results, and a provider acting as your processor. If any condition fails, keep asking for consent.
- Explain it clearly. Update your cookie policy with what the analytics does, who provides it, and how to object.
- Make objecting easy and free. A switch in your privacy choices that visitors can reach from every page works well.
- Keep advertising behind consent. Ad and remarketing tags must still wait for a yes.
GoConsent takes the cautious route by default: visitors in European time zones, including the UK, see analytics turned off until they choose, which meets both the old rule and the new one. Advertising tags stay blocked until a visitor allows marketing. Its scanner lists the cookies and tags on your site, and its cookie-free traffic stats count visits on your own server with no cookies and no stored IP addresses. Not sure where your site stands? Run a free audit.
Frequently asked questions
Do UK visitors still need to consent to analytics cookies?
Not always, since February 5, 2026. Analytics used only to produce statistics about your own service can run without consent if you explain it clearly, offer a simple and free way to object, and your analytics provider acts as your processor. If any condition isn’t met, you still need consent.
Do advertising cookies need consent in the UK?
Yes. The ICO says online advertising purposes are not exempt from the consent requirement and never have been. That includes ad measurement, frequency capping and fingerprinting for advertising.
Can I use any analytics tool without consent?
No. The provider must act only on your behalf as your processor, not as a joint controller, and must not combine your data with other information it holds. Analytics that profiles, segments or tracks people across services needs consent. Check your provider’s terms and settings.
What counts as a “simple and free” way to object?
A way to turn the analytics off that is easy to find and costs nothing, such as a switch in your privacy choices or cookie settings that visitors can reach from every page.
How big are UK cookie fines now?
Since February 5, 2026, up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. The previous maximum was £500,000.
Does the change apply in the EU?
No. It is a change to UK law only. Visitors in the EU are covered by EU rules, where consent remains the rule for cookies that aren’t strictly necessary.
Sources
- PECR regulation 6 and Schedule A1 (exceptions)
- S.I. 2026/82 (commencement)
- ICO: What are the exceptions?
- ICO: final storage and access technologies guidance (April 2026)
- Data Protection Act 2018, section 157 (maximum penalties)
- Data (Use and Access) Act 2025, section 103 (complaints)
- UK GDPR Article 3 (territorial scope)
This post is general information, not legal advice. Laws change; check the official text and talk to a lawyer about your situation.
