UK Cookie Rules After the Data (Use and Access) Act 2025
Short answer: Since 5 February 2026, UK websites and apps no longer need opt-in consent for first-party analytics used only to improve the site, or for cookies that remember how a visitor wants the site to look or work, as long as visitors are told clearly and can object easily and free of charge. Advertising, retargeting, social media pixels and anything that shares data with a third party for its own purposes still need consent. For many small sites, that means the banner can shrink to a notice with an opt-out for analytics, plus a genuine opt-in only if you run ads or tracking pixels.
What changed, and when
The Data (Use and Access) Act 2025 (DUAA) rewrote regulation 6 of the Privacy and Electronic Communications Regulations (PECR), the rule behind every cookie banner. Section 112 of the Act replaces the old wording and moves the exceptions into a new Schedule A1 to PECR. The commencement regulations (SI 2026/82) brought section 112 into force on 5 February 2026. The same instrument also commenced section 115, which reworks the Information Commissioner's enforcement powers for PECR, bringing them into line with its data protection enforcement regime.
One detail that matters for businesses with apps: the new schedule says "website" includes a mobile application and any other platform used to provide an online service. Your app's SDKs fall under the same rules as your site's cookies.
Before and after
| Purpose of the cookie or similar technology | Before 5 Feb 2026 | Now (as of November 2026) | Conditions under the new rules |
|---|---|---|---|
| Carrying a communication over the network | No consent | No consent | Sole purpose must be the transmission |
| Strictly necessary for a service the user asked for (basket, login, security, load balancing) | No consent | No consent, with a clearer list | Examples now written into law: security, fraud prevention, detecting technical faults, authentication, remembering selections or information entered |
| First-party analytics to improve the site or service | Consent | No consent | Statistical purposes only; data not shared except with someone helping you make improvements; clear information; simple, free way to object |
| Remembering display preferences (language, font size, dark mode, region) | Consent unless strictly necessary | No consent | Clear information; simple, free way to object |
| Advertising, retargeting, ad conversion pixels | Consent | Consent | Opt-in before setting |
| Social media plugins and pixels that track visitors | Consent | Consent | Opt-in before setting |
| Third-party analytics where the provider uses data for its own purposes | Consent | Consent in practice | Fails the "not shared except to help improve" condition |
The new analytics and preferences exceptions are not "no rules." They are opt-out regimes: you must tell people what you do and give them a simple, free way to say no, and then respect it.
What this means for a typical small UK site
Picture a hypothetical Leeds physiotherapy clinic with a booking widget, a first-party analytics tool, an embedded map and a Meta pixel for ads.
- The booking widget's session cookies: strictly necessary, no banner needed.
- First-party analytics, data kept to the clinic and its analytics processor: now allowed without opt-in, with a clear notice and an easy opt-out.
- The embedded map: depends on what the provider sets. If it loads tracking cookies on page load, it still needs consent or a click-to-load placeholder.
- The Meta pixel: still needs opt-in consent before it fires.
So the clinic can no longer justify a banner that blocks the whole site to ask about analytics, but it still needs a consent step for the pixel. If it dropped the pixel, it could replace the banner with a short notice and an "object to analytics" control.
The hard part: is your analytics tool really "first-party statistics"?
The statistical exception has strict conditions. Information can't be shared with anyone else "except for the purpose of enabling that other person to assist with making improvements to the service or website." In practice, ask your analytics provider three questions:
- Does it use your visitors' data for its own purposes, such as product benchmarking, advertising or cross-site profiles?
- Can those data-sharing settings be switched off, and have you switched them off?
- Does it combine your data with data from other sites?
If any answer is yes and can't be turned off, treat it as needing consent. Tools that fingerprint devices also need care: the exception doesn't cover collecting information that a device "automatically emits," so passive fingerprinting isn't rescued by it.
Banner checklist for November 2026
- [ ] List every cookie, local storage item, pixel and SDK on the site and app, with its purpose and who receives the data.
- [ ] Mark each as strictly necessary, statistics, preferences, or other (advertising, social, third-party).
- [ ] For statistics and preferences: write a plain notice saying what you collect and why, and add a simple, free objection control that actually stops the collection.
- [ ] For everything else: keep an opt-in that blocks the script until the visitor agrees, with "reject" as easy as "accept."
- [ ] Turn off analytics vendors' data-sharing options you don't need.
- [ ] Replace auto-loading embeds (maps, videos, social feeds) with click-to-load placeholders where they set tracking cookies.
- [ ] Update your privacy notice and cookie policy to match the new categories.
- [ ] If you target customers in the EU, remember EU rules haven't changed: analytics there generally still needs consent, so you may need location-based behaviour or keep the stricter banner for everyone.
- [ ] Re-test after every new plugin, tag or marketing tool.
The Information Commissioner's Office publishes detailed guidance on storage and access technologies, including a chapter on the new exceptions; check it for edge cases such as session recording or A/B testing tools before relying on an exception.
This is a practical summary as of November 2026, not legal advice for your particular setup.
FAQ
Can I remove my cookie banner completely now?
Only if everything on your site is strictly necessary, first-party statistics or preference cookies (or the narrow emergency-location case), and you give clear information and an easy way to object to the last two. Any advertising or third-party tracking still needs consent.
Does the analytics exemption apply to Google Analytics?
It depends on configuration rather than brand. If the provider can use your visitors' data for its own purposes, the "not shared except to help improve" condition isn't met. Review its data-sharing settings and the ICO's guidance before deciding.
Do the new rules apply to my mobile app?
Yes. The new schedule defines "website" to include mobile applications, so SDKs that store or read data on a phone follow the same exceptions and consent rules.
Is an opt-out link in the footer enough?
The law asks for a "simple means of objecting, free of charge." A buried link on a separate page is hard to defend. A visible control near your notice is safer.
If you want a second pair of hands auditing the scripts and tags on your site against the new rules, tell us what your site runs on.