Answer
Usually, yes. UK websites need consent before setting non-essential cookies under PECR. Since 5 February 2026, the Data (Use and Access) Act 2025 exempts some low-risk cookies, including certain first-party analytics used only to improve a website, provided users get clear information and a free way to object. Advertising and cross-site tracking cookies still need prior consent.
The short answer
Most UK websites still need some form of cookie consent mechanism, but the rules became more flexible in 2026. Whether you need a full consent banner now depends on exactly which cookies and tracking technologies your site uses.
What changed in 2026
The Data (Use and Access) Act 2025 amended PECR's cookie rules. The changes took effect on 5 February 2026 and introduced exemptions from the consent requirement for certain low-risk purposes, while also raising maximum penalties.
| Cookie type | Before February 2026 | Since February 2026 |
|---|---|---|
| Strictly necessary | No consent needed | No consent needed |
| First-party analytics used only to improve your site | Consent required | May be exempt, with clear information and a free opt-out |
| Remembering appearance or functionality preferences | Consent often required | May be exempt, with clear information and an opt-out |
| Advertising, remarketing and cross-site tracking | Consent required | Consent still required |
Conditions for the analytics exemption
The analytics exemption is narrow. In general terms:
- The purpose must be statistical, to understand and improve your own website or service
- Users must be given clear information about the cookies
- Users must have a simple, free way to object
- Data should not be shared or used for unrelated purposes such as ad targeting
If any part of your analytics setup supports advertising or shares data with third parties for their own purposes, treat it as requiring consent.
What most UK websites should do now
- Audit every cookie and tag your site sets, including third-party scripts
- Classify each as necessary, exempt or consent-required
- Keep consent for advertising and tracking tags such as ad pixels and remarketing
- Provide clear information about all cookies, including exempt ones
- Offer an easy opt-out for exempt analytics and preference cookies
- Make sure consent-required tags do not fire before consent is given
- Review regularly, because new plugins and tools add cookies
Does this site need a banner?
If your site uses advertising pixels, remarketing or third-party tracking, yes. If it uses only strictly necessary cookies and qualifying first-party analytics, you may be able to replace a consent banner with clear information and an opt-out, but check your configuration carefully against ICO guidance.
Related reading
For setting up measurement properly, see our guide to GA4 conversion tracking.
This page provides general information, not legal advice. Check current ICO guidance or consult a qualified adviser for your specific situation.
Frequently asked questions
Is Google Analytics exempt from cookie consent in the UK?
Not automatically. The analytics exemption applies to cookies used solely for statistical purposes to improve your own service, with data not shared for other purposes. If analytics data feeds advertising, remarketing or is shared with third parties for their own purposes, consent is still required. Review your configuration carefully.
Do I need a cookie banner if I only use essential cookies?
No consent is needed for strictly necessary cookies, but you should still explain what cookies you use, typically in a cookie or privacy policy.
What are the fines for cookie breaches in the UK?
The Data (Use and Access) Act 2025 raised maximum PECR penalties to up to £17.5 million or 4% of global annual turnover, whichever is greater.