Can UK websites use analytics without cookie consent in 2026?

What changed in UK cookie law in 2026?

The rule sits in the Privacy and Electronic Communications Regulations 2003, usually called PECR. It covers more than cookies: any technology that stores information on, or reads information from, a visitor’s device, including pixels, local storage, SDKs and device fingerprinting. The ICO now calls these ‘storage and access technologies’.

Section 112 of the Data (Use and Access) Act 2025 rewrote that rule and added a new Schedule A1 to PECR listing when consent is not needed. Those provisions came into force on 5 February 2026. The ICO published its final guidance on them in April 2026.

The exceptions now cover four things: storage or access that is strictly necessary for a service the user asked for; collecting statistics to improve your service or website; adapting how a website looks or works to the user’s preferences; and helping locate a person in an emergency. Everything else still needs consent.

When can analytics run without consent?

Paragraph 5 of Schedule A1 sets five conditions, and you need all of them at the same time. First, you provide an online service. Second, the sole purpose of the cookie or tag is to collect statistics about how your service or website is used, with a view to improving it.

Third, the information is not shared with anyone else, except to help you make those improvements. An analytics provider processing data for you can fit. A provider that also uses the data for its own purposes generally cannot.

Fourth, visitors get clear and comprehensive information about the purpose. Fifth, they are given a simple way to object, free of charge, and they have not objected. In practice that means an analytics switch in your cookie settings that is easy to find and that actually stops the tag.

Does Google Analytics qualify?

It depends on how you set it up, and it needs a careful look rather than a yes. The question is whether the data is used only for statistics about your site, and whether Google uses it for anything else.

Google Analytics 4 can be linked to Google Ads, can use Google signals, and has account-level data-sharing settings that let Google use data for its own products. With any of those on, the analytics is no longer clearly ‘statistics only, shared only to help improve the service’, and you should keep asking for consent.

A stripped-down configuration with advertising features and data sharing off, combined with clear information and an easy opt-out, is a stronger candidate. Privacy-focused, first-party analytics tools that count page views without cross-site identifiers are the clearest fit. Either way, document why you think the exception applies.

What still needs consent?

Anything used for online advertising: ad pixels, conversion tags, retargeting, audience building and cross-site tracking. The ICO’s guidance is clear that advertising uses need consent, and the new exceptions were not designed for them.

Tools that observe individual visitors in detail, such as session replay, are unlikely to fit the statistics exception. Chat widgets, embedded videos and social media buttons often set their own trackers too, so check what each one stores before you decide.

Consent itself has not become easier. It must still be freely given, specific, informed and unambiguous, given by a clear action, and as easy to withdraw as to give. Pre-ticked boxes and ‘by continuing to browse you accept’ do not count.

Higher fines: why mistakes now cost more

Before 2026, the maximum fine for breaching PECR was £500,000. The Data (Use and Access) Act brought PECR into line with the UK GDPR, so the maximum is now £17.5 million or 4% of worldwide annual turnover, whichever is higher.

The ICO has run cookie compliance sweeps of the UK’s most visited websites and written to organisations whose banners did not give a real choice. With higher fines available, an exemption claimed without a good reason is a real risk, not a technicality.

I also have visitors from the EU. What then?

The UK change does not reach the EU. Article 5(3) of the EU ePrivacy Directive still requires consent for storing or reading information on a device unless it is strictly necessary, and EU regulators generally treat audience measurement as needing consent unless it meets narrow conditions set by some national authorities, such as France’s CNIL.

The EU has discussed reforms, but until they are adopted, a site serving both markets has two practical choices. Use one consent-first banner for everyone, which is simplest. Or detect location and drop the consent step for analytics only for UK visitors, which saves some consent prompts but adds complexity and must be tested carefully.

For the full SafeLaunch walkthrough, see UK cookie rules 2026: analytics without consent?

How to use the new exception properly

Start with an inventory. Open your site in a fresh private window, look at every cookie and network request, and write down what each tag is for. You cannot claim an exception for a tag you do not know about.

Then put each tag into one of four groups: strictly necessary, statistics only, preferences, or everything else. Only the first three can run without consent, and the second and third only with clear information and a working opt-out.

Update your cookie notice so it explains, in plain words, what the exempt analytics measures and how to switch it off. Then test the switch: turn analytics off, reload, and confirm the tag no longer fires.