TL;DR
Most UK small business sites still need a cookie banner, but since 5 February 2026 it can ask for less than it used to. Analytics used only to improve your site, and cookies that remember a visitor's settings, can run without consent, as long as you explain them and give people a simple, free way to object. Advertising and cross-site tracking still need consent first. The maximum fine has gone up to £17.5 million or 4% of global turnover.
Why trust this page: I build and fix websites for small businesses, so I spend a lot of time looking at what tags and cookies a site actually fires. I'm not a lawyer. Every legal point below links to the legislation itself or to the ICO's own guidance, checked on 25 October 2026. This is general guidance, not legal advice. If your site does anything unusual with data, read the ICO's guidance or ask a solicitor.
What changed in UK cookie consent law in 2026?
The Data (Use and Access) Act 2025 rewrote the cookie rule in PECR, the UK regulations that cover cookies and similar technologies. The general rule is the same: you can't store or read information on someone's device without consent. What's new is a list of five exceptions, two of which cover everyday small business sites. They came into force on 5 February 2026.
The rule isn't only about cookies. It covers anything that stores or reads information on a visitor's phone or laptop, including tracking pixels, local storage and device fingerprinting. It also covers you if you "instigate" it, which means the tags third parties run on your site count as yours. The full text is in section 112 and Schedule 12 of the Act.
Do I still need a cookie banner in the UK?
Probably, yes, but a lighter one. If your site only runs strictly necessary cookies, you don't need consent at all. If it runs analytics or preference cookies under the new exceptions, you need to explain them and let people object, which most sites will still do through a banner or settings panel. If it runs anything for advertising, you need consent before it fires.
The ICO's guidance says the objection can sit inside your existing consent tool, for example with analytics and appearance toggles switched on by default and easy to turn off. So for most small firms the banner stays, and the practical change is that analytics can run from the first page view instead of waiting for a click.
Which cookies no longer need consent?
PECR now has five exceptions, listed in the Act and confirmed in the ICO's guidance. Some blogs give a different number, so go by the legislation. Two of them are new and matter most to small business sites: statistical purposes (analytics) and appearance (remembering someone's settings). Both come with conditions.
| Purpose | Consent needed? | Conditions |
|---|---|---|
| Carrying a communication over the network (for example load balancing) | No | Only for that purpose |
| Strictly necessary for a service the visitor asked for (log-in, basket, security, fraud prevention, remembering form entries) | No | Necessary from the visitor's point of view, not yours |
| Analytics to see how your site is used and improve it | No, if conditions met | Clear information, a simple free way to object, aggregate data only, shared only to help improve the site |
| Remembering how the visitor wants the site to look or work (language, dark mode, text size) | No, if conditions met | Clear information and a simple free way to object |
| Finding someone's location after they ask for emergency help | No | Only for that purpose |
| Advertising, retargeting, cross-site tracking, ad pixels | Yes, before it fires | No exception covers advertising |
Source: Schedule A1 to PECR and the ICO's chapter on what the exceptions are.
Can I run analytics without asking first?
Only if your set-up fits the statistical purposes exception. The analytics must be used solely to understand how your site is used and improve it. The results must be aggregate figures that don't identify anyone. You must tell visitors what's happening and give them a simple, free way to object. If any of that isn't true, you still need consent.
The part most people will trip on is the analytics provider. The ICO says you can use a third party to run your analytics, but only if they use the information to improve your site and nothing else. If the tool feeds the data into its own products or links it to advertising, the exception doesn't cover it. Check your provider's terms and switch off any advertising or audience features before you rely on it.
The ICO is also clear that this exception is about how your site is used, not who is using it. Session recordings that follow individual visitors, or anything that builds a profile of a person, sit outside it.
For what it's worth, on my own site Google Analytics only runs if a visitor accepts. That is the safe default until you've checked your own set-up against the conditions. Waiting for a click costs you some data. Getting the exception wrong costs a lot more.
Before a click: what can load
Sort each tool by purpose, then check the conditions.
Only what the visitor needs for the service they asked for.
Clear information, an easy free objection, and the other conditions must be met.
Ad pixels and retargeting tags wait until the visitor opts in.
What still needs consent?
Anything to do with advertising still needs consent before it loads. The ICO says no advertising purpose counts as strictly necessary, and the statistical exception doesn't cover it either. That means ad pixels, retargeting tags, conversion tracking for ad platforms and anything that follows people across sites.
- Ad and social pixels. If you run ads, or ever might, these are usually the tags firing without permission.
- Embedded third-party tools. Video players, chat widgets, maps and review badges often set their own cookies. Check what each one sets and why.
- Analytics that don't fit the exception. Tools that identify people, record sessions or share data for the provider's own use still need consent.
- Device fingerprinting for advertising. The ICO calls this out by name.
What are the fines now?
The ICO can now fine up to £17.5 million or 4% of global turnover under PECR. The old ceiling was £500,000. The ICO confirmed the new power on 5 February 2026 and says it will use the higher fines for the most serious cases.
A small firm is unlikely to be the ICO's first target for a cookie banner. But the fine isn't the only cost. A site that drops ad pixels on people before they've agreed is the kind of thing a competitor, a customer or a journalist can spot in thirty seconds, and it doesn't look good next to a privacy notice that says otherwise.
A checklist to run on your site this week
You can do most of this in an hour with a browser and your analytics settings open. Do it in private browsing so you see what a first-time visitor sees.
- List what fires before anyone clicks. Open your site in a private window, open the browser's developer tools and check the cookies and network requests on the first page load. Write down every tool you see.
- Sort each one into a purpose. Strictly necessary, analytics, appearance or advertising. If you can't say why a tag is there, it probably shouldn't be.
- Stop advertising tags firing early. Ad and social pixels should wait for consent. Many sites load them in the page code, outside the consent tool.
- Check your analytics settings. Turn off advertising and audience features, and read what your provider does with the data before you rely on the exception.
- Add a simple way to object. If analytics or appearance cookies run by default, visitors need an easy, free off switch that's always available, such as a link in the footer.
- Update the privacy and cookie notice. Say what runs, why, and how to object, in plain English. The exceptions depend on "clear and comprehensive information".
- Simplify the banner. Ask only for what genuinely needs consent, with accept and reject equally easy to find.
- Check again after any change. New plugins, embeds and ad campaigns are how tags creep back in.
If you're having a site built or redesigned, ask for this at the start. Getting tracking right is part of a proper build, the same as forms that actually reach someone. My guide to what a website costs in the UK covers what else to ask for, and if you're working on search, what SEO costs explains why clean analytics matter for judging it.
The practical summary
- Since 5 February 2026, PECR has five exceptions to the consent rule.
- Analytics used only to improve your site, and cookies that remember visitor settings, can run without consent if you explain them and offer a simple, free way to object.
- Your analytics provider must only use the data to help improve your site.
- Advertising, retargeting and cross-site tracking still need consent first.
- The maximum fine is now £17.5 million or 4% of global turnover.
- Most small sites still need a banner or settings panel, just a simpler one.
If you'd like a second pair of eyes, book a free 15-minute call. I'll look at what your site fires before anyone clicks and tell you what I'd change. If you want it fixed for you, that's part of my website design work.
Fair questions
Do UK websites still need a cookie banner in 2026?
Most do. Since 5 February 2026, some analytics and preference cookies can run without consent, but only if you explain them and give people a simple, free way to object. Anything used for advertising or tracking people across sites still needs consent first. So the banner usually stays, but it can ask for less.
Can I use analytics cookies without consent in the UK?
Sometimes. The new statistical purposes exception covers analytics used only to see how your site is used and improve it, producing aggregate figures that don't identify people. You must tell visitors and let them object. If your analytics provider uses the data for its own purposes or for advertising, the exception doesn't apply.
When did the UK cookie rules change?
The new exceptions came into force on 5 February 2026. They were added to PECR by the Data (Use and Access) Act 2025, which received Royal Assent in June 2025. The ICO finalised its guidance on cookies and similar technologies in April 2026.
How much can the ICO fine for cookie breaches now?
The ICO says the Data (Use and Access) Act lets it fine up to £17.5 million or 4% of global turnover under PECR, up from the old £500,000 ceiling. It has said it will use the higher fines for the most serious cases and is writing separate guidance on them.
Do advertising pixels need consent?
Yes. The ICO says no advertising purpose counts as strictly necessary, and the statistical exception doesn't cover advertising. Ad pixels, retargeting tags and anything that tracks people across sites still need consent before they fire.
