UK cookie law: PECR, the ICO and analytics without consent

What does UK cookie law require?

UK cookie law requires consent before you store or read information on a visitor's device, unless one of a small number of exceptions applies. The rule sits in regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR), and the Information Commissioner's Office (ICO) enforces it. The Data (Use and Access) Act 2025 added new exceptions to PECR, and the ICO published its final guidance on storage and access technologies on 29 April 2026. In practice this means some low-risk analytics and preference cookies can now run without a consent click, while advertising and ad measurement still need consent.

PECR is not limited to cookies. The ICO guidance covers tracking pixels, link decoration, local storage, scripts and tags, and device fingerprinting. If a technique stores something on the device or reads something from it, the same rule applies. Where personal data is involved, the UK GDPR applies as well, and consent under PECR has to meet the UK GDPR standard: freely given, specific, informed and unambiguous. This article is not legal advice.

Which exceptions does PECR now allow?

PECR now lists several situations where you do not need consent. Two of them are long established, three are new. The new ones come with conditions, and the two that matter most for marketing sites, statistics and appearance, also require that you give the visitor clear information and a simple, free way to object.

→ Cookie banner with Consent Mode v2: compliant, with no monthly licence

When can analytics run without consent?

The statistical purposes exception covers storage or access that is used solely to collect statistics about how your service is used, so that you can improve it. According to the ICO, the data has to be aggregated, and you must not keep personal data longer than the aggregation needs. The exception does not allow you to monitor or track individual visitors, to make decisions about people, or to support online advertising in any way.

Third-party analytics tools can fit the exception, but only under strict conditions. The ICO says the provider must act on your behalf as a processor, use the information only to help you improve your service and not combine it with other data it holds. You also have to tell visitors that you use a third-party provider and what it does. If the provider uses the data for its own purposes, for example to connect activity with adverts, you need consent again.

Whether Google Analytics 4 (GA4) qualifies therefore depends on your configuration and contract, not on the tool name. Links to Google Ads, Google signals, audiences for remarketing and data sharing settings all point towards advertising. Before you move a GA4 tag out of the consent flow, write down which features are switched on and compare them with the ICO criteria. When in doubt, keep GA4 behind consent and use Google Consent Mode v2 so that Google receives the correct signals.

What still needs consent under PECR?

Everything connected with advertising still needs consent. The ICO states that ad measurement and performance tracking require consent, including measuring whether someone saw or clicked an advert. For a typical UK business site this list stays behind the consent banner:

• Meta Pixel, TikTok Pixel, LinkedIn Insight Tag and Pinterest Tag
• Google Ads conversion tracking and remarketing tags
• Microsoft Advertising UET tag
• Session recording and heatmap tools that follow individual visitors
• Analytics settings that feed audiences or advertising reports

Google also has its own rule on top of the law. Its EU user consent policy covers users in the European Economic Area and the United Kingdom, so Google Ads and GA4 expect consent signals for UK visitors. A correct Google Consent Mode v2 setup sends ad_storage, analytics_storage, ad_user_data and ad_personalization with the state the visitor actually chose.

→ Setting up Google Consent Mode v2 correctly: no warning in Tag Assistant

How should a UK cookie banner look now?

A UK cookie banner now has two jobs: asking for consent where it is needed and offering an easy way to object where an exception is used. The ICO suggests that a toggle in your existing consent settings, switched on by default for statistics or appearance, can serve as the simple means of objecting. Advertising toggles must stay off until the visitor switches them on. If someone objects, you must stop the storage or access, and you must not rely only on browser settings to detect that.

A practical layout keeps ‘Accept all’ and ‘Reject all’ equally visible on the first layer, offers a settings link with one toggle per purpose, and explains in plain English what each purpose does and which providers are involved. Your cookie policy should name the statistics provider, describe the exception you rely on and show how to object later, for example through a link in the footer that reopens the settings.

How do you check your site against PECR?

The quickest check is to load your site three times in a private window: once without touching the banner, once after ‘Reject all’ and once after ‘Accept all’. Open the browser developer tools, go to the network and storage panels, and note which requests and cookies appear in each state. Advertising requests before consent or after a rejection are the most common finding on UK sites.

Take a real example. A plumbing firm in Manchester runs Google Ads and the Meta Pixel and recently switched GA4 to the statistical exception. The test shows that GA4 still has Google signals and a Google Ads link enabled, and the Meta Pixel fires on the first page view before any choice. The fix is to keep GA4 behind consent until those features are reviewed, to load the Meta Pixel only after consent, and to retest all three states.

Free check and fixed-price repair

The free Trackum check at trackum.app/check opens your home page in a real browser three times, with the banner unanswered, rejected and accepted, plus two subpages, and lists which tags and cookies load in each case. It costs nothing, needs no sign-up and takes about two minutes. If it finds problems, we fix them in your existing Google Tag Manager for a fixed €79 plus VAT, tested with and without consent, including a short report. The Trackum cookie banner shows ‘Reject all’ with equal weight on the first layer, works in English and supports Consent Mode v2.