The short answer
Since 5 February 2026, the Data (Use and Access) Act 2025 lets UK websites set analytics cookies without consent when they are used only to produce statistics, visitors are told about them and can easily opt out. Advertising, session replay and analytics tools that use the data for their own purposes still need consent, and PECR fines now reach UK GDPR levels.
Key takeaways
- The UK exemption covers analytics used only to produce statistics about your own service, with clear information and an easy opt-out.
- Advertising pixels, retargeting and session-replay tools always need prior consent.
- Analytics that also feeds advertising, or lets the vendor use the data for its own purposes, is outside the exemption.
- The Data (Use and Access) Act 2025 raised PECR fines to UK GDPR levels.
- The EU did not make the same change. If you have EU visitors too, EU rules still require consent for most analytics.
On this page
01
What changed in UK cookie law in 2026?
Regulation 6 of the Privacy and Electronic Communications Regulations (PECR) requires consent before storing or reading information on a user's device, unless an exemption applies. The Data (Use and Access) Act 2025 added exemptions, which took effect on 5 February 2026. The one that matters most to websites covers analytics used only to produce statistics, provided users get clear information and a simple way to object.
| Cookie or tracker | Consent needed in the UK? | What to do |
|---|---|---|
| Strictly necessary (login session, basket, security) | No | Explain them in your cookie notice |
| Analytics used only for statistics about your site | No, if users are told and can easily opt out | Describe them clearly and offer an opt-out |
| Analytics that also feeds ads, or that the vendor uses for its own purposes | Yes | Load only after Accept |
| Advertising and retargeting pixels | Yes | Load only after Accept; stay off after Reject |
| Session replay and heatmaps | Yes | Load only after Accept |
02
Does the same apply to EU visitors?
No. The EU's ePrivacy Directive Article 5(3) has no equivalent statistics exemption in its text, and most EU regulators still require consent for analytics, with narrow exceptions some national regulators allow for privacy-preserving audience measurement. A site with UK and EU visitors either keeps consent for analytics everywhere, or shows UK visitors an opt-out and EU visitors an opt-in.
03
Does my analytics tool qualify for the UK exemption?
- 01
Is it used only to produce statistics about your own service?
Counting visits, pages and conversions for improving the site qualifies in principle. Building audiences for ads does not.
- 02
Does the vendor use the data for its own purposes?
Check the vendor's terms and your settings. Data-sharing settings that let the vendor use data for its own products or advertising take you outside the exemption.
- 03
Is it linked to advertising?
Analytics connected to ad platforms for remarketing or ad personalisation needs consent.
- 04
Do visitors get clear information and an easy opt-out?
Your cookie notice must explain the analytics, and the opt-out must be simple and work.
04
How do I test what my site actually loads?
Labels on a banner don't prove behaviour. Open your site in a private window with the browser's network tab open, before clicking anything, then click Reject and reload. Every request to an ad or replay service before Accept is a finding. SafeLaunch paid audits automate this in clean sessions, before a choice, after Reject and after Accept. Read how the real-browser test works.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked. No spam, unsubscribe in one click.
By signing up you agree to get this weekly email. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
FAQ
Frequently asked questions.
Sources and further reading
- Data (Use and Access) Act 2025 (legislation.gov.uk)
- ICO: guidance on cookies and similar technologies
- ePrivacy Directive 2002/58/EC
This article is general information, not legal advice. SafeLaunch is automated software, not a law firm; a report records what was checked on one version and is not a certificate of compliance. Read the disclaimer.
From the founder
SafeLaunch is built by Raghav R Handa, a lawyer-turned-builder in New Delhi. He writes about this topic in plain English:
See what SafeLaunch finds on your product.
Paste a link and get your score, the most serious problems and what already passes, in about a minute.
Keep reading