Key facts
- Cookie rules come from PECR regulation 6; consent standards come from UK GDPR
- The Data (Use and Access) Act 2025 added new exceptions, in force from 5 February 2026 (SI 2026/82)
- Statistical (analytics) and appearance exceptions require clear information and a simple, free way to object (ICO)
- No exception covers advertising purposes (ICO)
- ICO: refusing must be as easy as accepting, and non-essential cookies must not be set before consent
- PECR fines now align with UK GDPR maximums: £17.5 million or 4% of global turnover
Which laws apply
Two sets of rules work together. The Privacy and Electronic Communications Regulations 2003 (PECR), regulation 6, controls storing or accessing information on a user's device: cookies, local storage, pixels and similar technologies. UK GDPR sets the standard for what valid consent looks like, and applies to any personal data the cookies collect. The Data (Use and Access) Act 2025 amended PECR. Law firms including Clifford Chance and Bratby report that the cookie changes came into force on 5 February 2026 under the Commencement No. 6 Regulations (SI 2026/82). The ICO finalised its guidance on storage and access technologies in April 2026.
What you can set without consent
The ICO's guidance lists these exceptions:
- Communication. Solely to transmit a communication, such as load-balancing cookies.
- Strictly necessary. Essential for a service the user has asked for, judged from the user's point of view: a shopping basket, a login session, security. The ICO says no advertising purposes meet this exception.
- Statistical purposes. New. Analytics solely to collect statistics about how your service is used so you can improve it, with data aggregated. You must give clear information and a simple, free means of objecting. A third-party analytics provider can be used only if it acts as your processor, not as a joint controller.
- Appearance. New. Remembering a user's preferences for how the site looks or works, such as text size or language, with the same information and objection requirements. It does not cover personalising content based on inferred interests.
- Emergency assistance. Locating a device to provide emergency help.
The ICO is clear that the statistical and appearance exceptions do not apply to purposes related to online advertising.
What still needs consent
Advertising and remarketing pixels (for example Meta Pixel or Google Ads tags), cross-site tracking, social media embeds that set cookies, and analytics that does not meet the statistical exception's conditions still need prior consent. Whether a particular analytics setup qualifies depends on how it is configured and what the provider does with the data, so check the ICO's guidance and the provider's terms rather than assuming.
The simplest way to stay on the right side of the rules is to audit what your site actually loads. Open the site in a private browser window, refuse everything, and use the browser's developer tools to see which cookies and requests appear. Anything beyond the strictly necessary should not be there.
What a compliant banner looks like
The ICO's guidance on managing consent in practice expects that:
- Non-essential cookies are not set until the user agrees. "By continuing to use this site you consent" is not valid.
- Refusing is as easy as accepting. An "Accept all" button with no "Reject all" on the same layer is given as bad practice.
- Choices start switched off; silence or inactivity is not consent.
- Users can withdraw consent as easily as they gave it, for example with a cookie settings link in the footer.
- For exempt analytics and preference cookies, users still get clear information and a simple way to object, and you must not rely only on browser settings for that.
Design matters too. A banner that covers the page on mobile, or pushes content down after load, can hurt layout shift scores; see Core Web Vitals.
Fines and enforcement
The Act raised PECR penalties to UK GDPR levels. Law firm Trethowans and other commentators report a maximum of £17.5 million or 4% of global annual turnover, whichever is greater, replacing the old £500,000 cap. Small businesses are rarely the first target, but a clear, honest banner is cheap to get right and protects trust. Related legal requirements are covered in what a UK business website must show by law.
When to call us
We set up cookie consent on every site we build, based on the scripts the site actually uses, and we can audit an existing site to see what is being set before consent. Audits and fixes are £45 an hour + VAT. This guide is general information, not legal advice. Get in touch or call 01623 650333.
Frequently asked questions
Do I still need a cookie banner in 2026?
If your site uses any cookies or similar technologies that need consent, such as advertising pixels or analytics outside the new statistical exception, yes. Even exempt analytics and preference cookies need clear information and a simple way to object. A site with only strictly necessary cookies does not need a consent banner.
Is Google Analytics exempt from cookie consent now?
Not automatically. The ICO's statistical exception covers analytics used solely to improve your own service, with aggregated data, clear information and a simple opt-out, and a third-party provider must act as your processor. Whether a given setup qualifies depends on its configuration and the provider's terms.
Can I use an Accept-only cookie banner?
No. The ICO's guidance expects refusing to be as easy as accepting, and gives an Accept all button with no Reject all option as an example of bad practice. Non-essential cookies must not be set until the user chooses.
When did the new UK cookie rules start?
The Data (Use and Access) Act 2025 changes to PECR's cookie rules came into force on 5 February 2026, under the Commencement No. 6 Regulations (SI 2026/82), as reported by law firms including Clifford Chance and Bratby. The ICO finalised its updated guidance in April 2026.
What are the fines for breaking cookie rules?
The Data (Use and Access) Act 2025 raised PECR fines to UK GDPR levels: up to £17.5 million or 4% of global annual turnover, whichever is greater, according to law firm commentary. Previously the PECR maximum was £500,000.
Related
Get a fixed quote
Free chat, clear price, a website you own. Websites from £250 + VAT.