The Data (Use and Access) Act 2025 changed the UK cookie rules in two ways that matter. Some analytics, used only to improve your own site, can run without prior consent if you give clear information and an easy way to object. And fines for breaking the cookie rules now go up to 17.5 million pounds or 4 percent of worldwide turnover. Advertising still needs consent.
This article is general information, not legal advice. For a decision that carries risk, speak to a qualified lawyer. We are marketers and engineers, and our job is to make sure what your tags actually do matches what you say they do. That is part of our tracking and website ecosystem service.
What are the rules called, and what changed?
The cookie rule sits in regulation 6 of the Privacy and Electronic Communications Regulations (PECR). It says you need consent before storing or reading information on a visitor’s device, unless an exception applies. The Act added new exceptions. The Information Commissioner’s Office (ICO) says in its guidance on the exceptions that one of them is for statistical purposes, also called the analytics exception.
When does the analytics exception apply?
The ICO sets conditions. In summary:
- Sole purpose. The storage or access must be for the sole purpose of collecting statistical information to improve the service or website. Using the same data for another purpose at the same time, such as advertising, removes the exception.
- Information. You must give people clear and comprehensive information about the use.
- An easy way to object. People must be able to refuse simply.
The ICO also says that if one purpose meets an exception and another does not, you need consent. So a tag that measures your site and also builds ad audiences needs consent.
What still needs consent?
Online advertising. The ICO says that if you use storage or access technologies for advertising, you cannot rely on any of the exceptions, and it lists ad measurement and performance among the purposes outside them. Where consent is needed, it must meet the UK GDPR standard: a clear positive action, no pre-ticked boxes, and continuing to browse is not consent. Refusing must be as easy as accepting.
How big are the fines?
The ICO has said the Act gives it power to fine under PECR up to 17.5 million pounds or 4 percent of worldwide turnover, whichever is higher. Its statement on commencement says the next phase began on 5 February 2026, and that it wants to give businesses notice before using the new powers, while keeping them for the most serious cases. It is also working on separate guidance for the higher fines.
Is the ICO guidance final?
The ICO has been consulting on revised guidance, and its pages have changed during 2025 and 2026. Check the live ICO pages before you rely on any summary, including this one.
A checklist for your site
- List every tag. Open Tag Manager and write down each tag, who receives data, and why. Our free tracking check reads the public setup of a page, but it cannot see what loads after a click, so confirm in your own container.
- Sort them. Essential, analytics only, or advertising. If a tool does more than one job, treat it by its strictest purpose.
- Choose your approach for analytics. Either ask for consent, as we do on our own site, or rely on the exception and meet every condition. If you share the data with an ad platform, you cannot rely on the exception.
- Fix the banner. Accept and Reject should look and work alike. No pre-ticked boxes. A link to change the choice later.
- Set denied by default. Make sure tags load in a denied state until a choice is made. Our guide to Google Consent Mode shows how.
- Update your policies. Your privacy and cookie policies should list the real tools and the real lifetimes. You can see how we do it in our cookie policy and privacy policy.
- Test. Open the site in a private window and check cookies before you click anything.
Questions people ask
Can we keep running GA4 with no banner? Only if you meet every condition of the exception, including no advertising use of the data and an easy way to object. Most sites that link analytics to ads cannot.
Does this apply to US visitors? The UK rule applies to people in the UK. US privacy laws are different and vary by state, so take advice for each market you serve.
Is a banner enough on its own? No. The banner has to match what your tags do. A banner that says “off” while a tag is firing is the problem the rules are aimed at.
If you want a second pair of eyes on your tags, send us the brief.
