Do I still need a cookie banner in 2026? What actually changed for analytics

Yes — almost every UK website still needs a consent mechanism. Since 5 February 2026 a narrow set of analytics and appearance technologies no longer need consent, but only if you tell people what you are doing and give them a free, simple way to object. Nothing has changed for advertising.

Last updated 31 July 2026. This page explains the law as it stands on that date. It is general information, not legal advice.

What changed on 5 February 2026

Section 112 of, and Schedule 12 to, the Data (Use and Access) Act 2025 came into force on 5 February 2026 under SI 2026/82. Section 112(2) replaced regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), and the new Schedule A1 inserted into PECR is the one set out in Schedule 12 to the Act.

Regulation 6(1) now says simply that, subject to Schedule A1, "a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user". All the detail moved into Schedule A1, which contains consent plus five exceptions.

Note what is not on that list. The changes did not touch cookie rules for advertising, and they did not create a general "low-risk cookie" exemption.

Does that mean Google Analytics no longer needs consent?

Usually not. It depends entirely on how the tool is configured and what else the data is used for. Paragraph 5 of Schedule A1 sets a narrow test, and all of it must be satisfied:

• You provide an information society service (a website or app).
• The sole purpose of the storage or access is collecting statistical information about how your service or website is used, with a view to improving it.
• Any information collected is not shared with anyone else, except to enable them to assist you with making those improvements.
• The subscriber or user is given clear and comprehensive information about the purpose.
• The subscriber or user is given a simple means of objecting, free of charge — and does not object.

The ICO's guidance is direct about the limits. On advertising it says: "Online advertising purposes are not exempt from PECR's consent requirements and never have been." That covers frequency capping, ad affiliation, ad measurement and performance, click fraud detection, market research, product improvement and debugging. The exception also does not permit logs or recordings of individual visitors and the actions they took (unless obtained for security purposes), connecting a visitor ID to site activity, conversions shared with advertising partners, or tracking people across services.

Two more conditions catch out common set-ups. If you use a third-party analytics provider, it must act as your processor, not a joint controller, and must not link your data with anything else it works with. And under paragraph 5(2) the exception does not cover collecting or monitoring information automatically emitted by a device — the ICO gives wifi probe requests as its example.

You have moved to opt-out, not to nothing

Both new exceptions are conditional. Drop either condition and you are not using the exception correctly, which means you are back to needing consent.

Clear and comprehensive information

PECR does not define the phrase, but the ICO says you must tell people:

• what storage and access technologies you intend to use
• the purposes you intend to use them for
• any third parties who store, access or process the information, and what for
• how long information will be stored, or access granted, for (for example, cookie duration)

A simple means of objecting

This is one of the two sub-chapters the ICO added when it finalised its guidance. PECR does not define it either. The ICO says you could provide it through your existing consent mechanism — for example, with your statistical or appearance toggles switched on by default and the ability to switch them off at any time. If someone objects you must stop; if they later toggle back on, you can rely on the exception again. The ICO also warns that you must not rely solely on browser settings as an indication that someone has not objected.

What the ICO's final guidance covers beyond cookies

The ICO published its final Storage and Access Technologies (SATs) guidance on 29 April 2026, replacing its old detailed cookies guidance after two consultations. Despite the everyday name, it is not just about cookies. It covers cookies, tracking pixels, link decoration and navigational tracking, local storage, device fingerprinting, and scripts and tags — plus the UK GDPR where those technologies involve personal data.

It is equally clear about what it does not cover: other areas of PECR outside regulation 6, and wider UK GDPR and Data Protection Act 2018 obligations except where they bear on PECR. So it is not a complete data protection manual. The April 2026 update added two new sub-chapters — "what does a 'simple means of objecting' mean?" and "can we use the same storage and access technology for multiple purposes?" — along with clarifications requested during consultation.

How prominent do 'Accept all' and 'Reject all' have to be?

Equally prominent. The first item on the ICO's consent-mechanism checklist is that "our consent mechanism makes it as easy to refuse consent as it is to accept". Its good-practice illustration shows equally prominent "accept all" and "reject all" buttons alongside a "more options" button. Its bad-practice illustration is the familiar one: "accept all" plus "more options", with no way to reject in a single click.

The full checklist asks whether your mechanism:

• makes refusing as easy as accepting
• requires a positive action before non-exempt technologies are set — silence, inactivity or continued browsing is not consent
• actually works, so nothing is set until valid consent is given or an exception applies
• offers granular options for different purposes
• names the third parties data will be shared with, and lets users control each one
• tells users how to revisit their preferences
• does not incorrectly use legitimate interests as a lawful basis, with toggles pre-set to on

Neither PECR nor the UK GDPR sets a time limit on consent. The ICO says you should not repeatedly prompt people who have already refused, and recommends six months as a suitable general timeframe before asking again — sooner only if your purposes or activities change.

Is the UK about to scrap consent for contextual advertising?

Possibly, eventually — but nothing has changed in law. On 18 May 2026 the ICO published advice to government showing how regulation 6 could be amended to allow certain low-risk forms of online advertising without consent, while continuing to require consent for advertising that involves intrusive tracking and profiling of people over time and across services. Its assessment is that privacy risks are lower where advertising is based on the context of the content being viewed rather than information about a person's past online activity.

Any change needs government action. New PECR regulation 6A lets the Secretary of State add, omit or vary exceptions, but only after consulting the Information Commissioner and such other persons as the Secretary of State considers appropriate, and a draft must be laid before and approved by both Houses of Parliament. As at 31 July 2026 no such regulations have been made. Do not rebuild your consent flow for a rule that does not yet exist.

Fines, enforcement, and what to change this month

PECR penalties changed on the same day as the cookie rules. Section 115(8) of, and Schedule 13 to, the DUAA replaced PECR Schedule 1 on 5 February 2026. Paragraph 18 of that Schedule modifies section 157 of the Data Protection Act 2018 so that breaches of regulations 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23, 24 and 32B(4)–(5) attract the higher maximum: £17,500,000 or, in the case of an undertaking, 4% of total annual worldwide turnover in the preceding financial year, whichever is higher. Regulation 6 — storage and access — is on that list. The old PECR ceiling was £500,000.

On enforcement, the picture is mixed and worth stating plainly. The ICO's published enforcement register shows its 2026 PECR penalties so far have been for marketing calls and texts, not cookies — for example KRA Consultancy Ltd, fined £300,000 on 20 May 2026 under regulations 22 and 23 for more than 5.5 million unlawful texts. Its cookie work has run through warning letters and industry engagement instead, and on 29 April 2026 it said 99% of the UK's top 1,000 websites now meet compliance standards for cookie banners. It has also said it will take action against organisations that act irresponsibly, and on 29 July 2026 it executed search warrants at residential and business premises linked to five companies over car finance marketing texts. PECR enforcement is live, even if cookies have so far been handled by persuasion.

1. Step 1 Audit what your site actually sets List every cookie, pixel, script, tag and local storage item, on every template, including anything a third party drops. The ICO expects an audit, not a guess.
2. Step 2 Sort each item into a bucket Communication, strictly necessary, statistical, appearance, emergency, or consent-required. Anything touching advertising, cross-site tracking, social plugins for logged-out users, or individual-level profiling goes in the consent bucket.
3. Step 3 Check that 'sole purpose' really holds If one tag serves two purposes and only one is exempt, you need consent. Consider splitting the technology per purpose.
4. Step 4 Fix the banner Make 'Reject all' as prominent as 'Accept all'. Set nothing non-exempt before a positive action. Make the categories granular and name your third parties.
5. Step 5 Turn analytics into a genuine opt-out If you want to rely on the statistical exception, tell people plainly, keep the toggle switchable, and honour objections. If you cannot meet the conditions, keep analytics behind opt-in consent.
6. Step 6 Check your analytics contract Your provider must be a processor acting only on your instructions, using the data solely to improve your service and not linking it to anything else. Check international transfers too.
7. Step 7 Update your cookie notice Cover the technologies, purposes, third parties and durations, and explain how people change their mind later.

This page is general information about what the law says, not legal advice. If your set-up is complex — particularly if advertising, ad measurement or a large third-party stack is involved — check the ICO guidance itself or take specialist advice.

Common questions

Sources

This page summarises the following primary sources. Where they disagree with this summary, they take precedence.

• PECR 2003, regulation 6 (as substituted 5 February 2026) — legislation.gov.uk
• PECR 2003, Schedule A1 — consent and the five exceptions
• PECR 2003, regulation 6A — power to add, omit or vary exceptions
• SI 2026/82 — Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, bringing ss.112 and 115 and Schs.12 and 13 into force on 5 February 2026
• Data (Use and Access) Act 2025, section 115 — Commissioner's enforcement powers (s.115(8) substitutes PECR Schedule 1)
• PECR 2003, Schedule 1 paragraph 18 — regulations attracting the higher maximum penalty
• Data Protection Act 2018, section 157 — higher and standard maximum amounts
• ICO — Guidance on the use of storage and access technologies (final, 29 April 2026)
• ICO — What are the exceptions? (statistical purposes, appearance, emergency assistance, 'a simple means of objecting')
• ICO — How do we manage consent in practice? (consent mechanism checklist, six-month guideline, multi-purpose technologies)
• ICO news, 29 April 2026 — Final storage and access technologies guidance published
• ICO blog, 18 May 2026 — Our advice to government on potential changes to online advertising rules
• ICO enforcement action — KRA Consultancy Ltd monetary penalty notice, 20 May 2026
• ICO news, 31 July 2026 — Multiple properties searched across UK after millions of car finance complaints