The 2026 UK cookie rules: what changed and what didn’t

What changed, and when

The Data (Use and Access) Act 2025 rewrote the cookie exceptions in PECR. The new rules, in a new Schedule A1 to PECR, came into force on 5 February 2026. The ICO published its final guidance on them on 29 April 2026.

The basic rule hasn’t moved: you can’t store or read information on someone’s device without their consent, unless one of the exceptions applies. What changed is the list of exceptions.

The exceptions

Strictly necessary

As before: storage that’s strictly necessary for a service the visitor asked for. The law now names examples, including security, preventing fraud, authentication and remembering what someone has selected. Advertising never qualifies.

Statistics (new)

Analytics can go without consent only if all of these are true:

• The only purpose is collecting statistics about how your site is used, so you can improve it.
• You give visitors clear information about it.
• You give them a simple, free way to object, and they haven’t.
• The data is shared only with someone helping you make those improvements.

The ICO reads this narrowly. An analytics provider has to act only on your instructions, as your processor, and mustn’t combine the data with anything else it holds. Profiling visitors, building audiences, measuring adverts and linking visits to ad campaigns are all outside the exception. Browser settings alone don’t count as a way to object.

Appearance and functionality (new)

Storage whose only purpose is to make your site look or work the way a visitor prefers, with the same conditions about telling people and letting them object. The ICO’s examples are remembering a language or a light or dark theme, and serving fonts from your own site. Personalising content from a profile of the visitor isn’t covered.

Emergency assistance (new)

Finding a visitor’s location when they’ve asked for, or clearly need, emergency help. Unlikely to apply to a business website.

Can I drop the banner for Google Analytics?

For most businesses, no. The ICO doesn’t name products, but a typical Google Analytics set-up is linked to Google Ads, builds audiences or uses Google signals, and each of those takes it outside the statistics exception. You’d also still need to tell visitors and let them object, which on a website usually means a notice of some kind anyway.

A carefully set-up, privacy-first analytics tool used only to improve your own site may qualify. If you rely on the exception, write down why each condition is met, so you can explain it if asked.

Asking for consent for statistics cookies remains the safest route, and it’s what Cookie Copilot does by default.

What didn’t change

• Advertising, retargeting and ad measurement still need consent.
• Consent still has to meet the UK GDPR standard: a clear action, with rejecting as easy as accepting.
• You still need to be able to show that people consented.

Bigger fines

Also from 5 February 2026, the ICO can fine up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for breaching the cookie rules. The old maximum was £500,000. Breaches that happened before 5 February 2026 are still dealt with under the old limits.

What might change next

In May 2026 the ICO advised the government that the rules could be changed so that low-risk contextual advertising doesn’t need consent. That’s advice, not law. The ICO says nothing has changed yet.