UK Lets Some Analytics Cookies Run Without Consent

What Changed

The UK's Data (Use and Access) Act became law on June 19, 2025.¹ Its cookie changes took effect on February 5, 2026, along with new enforcement powers for the Privacy and Electronic Communications Regulations (PECR), the UK's rules on cookies and electronic marketing.²

Section 112 of the Act rewrote PECR's cookie rule and gave the government power to add exceptions to it. The rule still bans storing or accessing information on a person's device without consent unless an exception applies, and it now explicitly covers collecting information a device sends out automatically.³

The New Exceptions

The UK's data protection regulator, the Information Commissioner's Office (ICO), published final guidance on the changes on April 29, 2026. Two new exceptions matter most for websites:⁴

• Statistical purposes. Consent isn't needed when the only purpose is collecting statistics about how a service or website is used, to improve it. Sites must still explain the purpose and offer a simple, free way to object. The ICO says this is about how a service is used, not who uses it. A third-party analytics provider qualifies only if it acts on the site's behalf and uses the information only to help improve the service.
• Appearance. Consent isn't needed to adapt how a site looks or works to a visitor's preferences.

Neither exception covers advertising, so ad cookies, pixels and remarketing tags still need consent.

Higher Fines

The Act also raised the maximum fine for breaking PECR's rules from £500,000 to £17.5 million or 4% of annual global turnover, in line with the UK GDPR.¹ The higher maximum has applied to the cookie rule since February 5, 2026.⁵ The ICO had already signalled tougher enforcement. In January 2025 it expanded its review of cookie compliance from the UK's top 200 websites, where it had raised concerns with 134, to the top 1,000, and to apps and connected TVs for the first time.⁶

Why It Mattered

It was the first time on this timeline that a major market loosened consent rules rather than tightening them. UK sites can now run privacy-friendly analytics for every visitor, which closes part of the measurement gap that declined cookie banners create.

The gap stays for advertising. Conversion pixels and remarketing still depend on consent, now backed by much larger fines. And the UK has moved away from the EU, where GDPR and the ePrivacy rules still require consent for most analytics cookies, so sites serving both need their banners to behave differently by region.