Do UK websites still need a cookie banner? What the Data (Use and Access) Act changed for analytics cookies

What the DUAA actually changed (and what it did not)

Most UK websites still need a cookie banner. The UK Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, with its main data protection provisions taking effect on 5 February 2026. It inserted new exempt categories into PECR. The ICO's final guidance on storage and access technologies followed on 29 April 2026. None of this replaced PECR or the UK GDPR. It amended them.

The practical consequence is narrower than most summaries suggest. A handful of cookie categories no longer need prior consent. Everything else, including the advertising and remarketing tags most commercial sites depend on, still does. And the fine for getting it wrong jumped by a factor of 35 on the same day the exemptions came in.

The five new exempt categories

Schedule A1 of PECR now lists five categories that do not require consent: analytics for aggregate statistics used to improve the service; security cookies for fraud prevention and device security; functionality cookies that enhance service features; software update cookies; and interface customisation cookies (remembering a dark-mode preference, for example).

These are not blanket permissions. Each category has conditions. The ICO's guidance is explicit that the function determines the category, not the label a vendor sticks on it. A tag that fires for analytics and remarketing is not analytics. It is remarketing, and it needs consent.

The fine increase already in force

On 5 February 2026, the maximum PECR fine rose from £500,000 to £17.5 million or 4% of global annual turnover, whichever is higher. The previous requirement to prove substantial damage and distress before a penalty could be issued was dropped at the same time. The enforcement ceiling is higher and the floor to reach it is lower. If your consent setup has been drifting, this is the point at which drifting became expensive.

Most UK websites still need a banner

The temptation after any regulatory loosening is to remove the thing people hate. Resist it. If you run Meta Pixel, LinkedIn Insight Tag, Google Ads conversion tags, TikTok Pixel, a chat widget that fingerprints visitors, or almost any affiliate script, you are still placing non-exempt cookies and still need prior, informed, specific consent before they fire.

The ICO reported in April 2026 that 99% of the UK's top 1,000 websites now meet compliance standards for cookie banners, and said its work and interventions would continue to drive for a fairer, more transparent online tracking ecosystem. That is not the tone of a regulator about to go quiet. The direction of travel is more scrutiny of how banners work in detail, not less.

The analytics exemption is narrower than you think

Paragraph 5 of Schedule A1 removes consent for cookies used to collect statistical information about how a service is used, with a view to making improvements. The conditions are cumulative: data stays with you, is not shared with third parties for their own purposes, does not cross-track users across other sites, is used only to improve the service, and you provide a clear and simple way to object at any time.

Miss any one condition and the exemption falls away for the whole tag. The ICO's new sub-chapter on multi-purpose technologies even suggests it may be easier to meet PECR obligations by using a separate technology for each purpose, rather than trying to configure a single tag to stay inside the exempt lane.

Why GA4 does not qualify by default

GA4 sends data to Google's servers. That is third-party sharing in the plain reading of Schedule A1, and the statistical exemption requires data to stay with the website operator. A default GA4 install, with Google Signals on, advertising features on, and User-ID tracking active, sits clearly outside the exemption. Consent is still required.

Could a locked-down GA4 (Signals off, ads features off, retention minimised, no linked ads accounts) approach the threshold? Some commentators say yes. Others say the fundamental data-sharing architecture disqualifies it categorically. The ICO has not published a named-tool ruling. Our position when advising clients: do not bet a £17.5 million cap on a contested reading of a six-month-old guidance document. If you want GA4, keep consent in front of it.

This has knock-on effects for measurement that we have written about separately in the context of server-side GA4 and conversion tracking signal loss. Moving tagging server-side does not change the consent question. The user still needs to agree before you collect in the first place.

Tools that are more likely to meet the conditions

Self-hosted Matomo, Plausible Analytics and Fathom Analytics are more likely candidates because they are first-party by design and do not share data with the vendor for their own purposes. None of these is explicitly named in ICO guidance. The conditions decide, not the brand. If your self-hosted Matomo instance is actually hosted by a vendor that reserves the right to use the data, you are back where you started. Read the terms before you assume.

Opt-out is not the same as doing nothing

The shift for qualifying analytics is from opt-in to opt-out. It is not from opt-in to silent collection. You still owe users clear information about what you are collecting and why, and you must give them a simple, free way to object at any time. In practice that means:

• A visible notice (not necessarily a full consent banner, but not nothing) telling visitors that first-party analytics is running.
• A persistent control to switch it off, reachable from every page and not buried four clicks deep in a privacy policy.
• No pre-firing of non-exempt tags before the user has made a choice.

If your current "we use cookies" strip at the bottom disappears after the first visit and offers no way back, you are not compliant under the opt-out model either.

Get plain-English guides like this in your inbox.

One short email a month. WordPress, Shopify, SEO, no fluff. Unsubscribe in one click.

Email address

Website

Subscribe →

We never share your email.

The instigation rule: third-party scripts are now your liability

A quieter but significant change: the DUAA expands PECR liability to organisations that "instigate" storage or access on devices, not just those who set the cookie directly. If you embed a third-party widget that drops a tracking cookie, you are in scope even though the cookie technically belongs to the third party.

That matters because the modern site is a tag soup. A typical ecommerce page might load Meta Pixel, TikTok Pixel, a reviews widget, an affiliate network script, a session-replay tool, a chat SDK and three or four Tag Manager containers. Under the instigation rule, each of those is your problem. The old "but the vendor set it, not us" defence is gone.

The ICO's April 2026 guidance deliberately drops "cookies" as the primary frame and talks about "storage and access technologies": cookies, pixels, device fingerprinting, HTML5 local storage, IndexedDB, scripts, tags and link decoration. All of it is in scope. You cannot avoid PECR by using a technology that performs the same function as a cookie while technically not being one.

UK vs EU: you now need two different configurations

This is the angle most agencies are quietly dreading. The UK now permits an opt-out model for qualifying first-party analytics. The EU ePrivacy Directive still requires prior opt-in consent for the same category. A single global banner configured for UK rules fails EU rules, and vice versa.

If your traffic is UK-only, pick a UK configuration. If you serve both markets, you need geo-aware consent: detect the visitor's jurisdiction reliably (which means a defensible IP lookup, not browser locale guesswork) and serve the correct banner logic. Most consent management platforms support this, but it is rarely on by default and almost never configured correctly out of the box. We check it on every discovery audit now, because it is the single easiest way to be in breach of one regime while thinking you comply with the other.

This is the kind of work that sits awkwardly between legal, marketing and engineering, which is why we usually fold it into web design and development engagements rather than treating consent as a bolt-on after launch.

What a compliant UK banner looks like in 2026

Working from the ICO's April 2026 guidance and the Schedule A1 conditions, here is the shape of a banner that holds up today.

First layer (visible on first visit, before any non-exempt tag fires):

• Clear, plain-English description of what you collect and why.
• An "Accept" button and a "Reject" button of equal prominence. The reject button must be on the first layer. The ICO has described sites without one as "breaking the law".
• No pre-ticked boxes for anything that requires consent. A single tick covering analytics, marketing and personalisation does not count as valid consent.
• No cookie walls. Do not block content behind the banner.
• No "by continuing to browse you agree" fallback. Continued browsing is not consent.

Behaviour:

• No non-exempt scripts fire before the user chooses.
• First-party analytics (if it genuinely qualifies) can run under opt-out, but the user must be told and must have an always-available control to switch it off.
• The choice is remembered and reversible. A persistent link ("Cookie settings") in the footer or a floating icon lets users change their mind.

Second layer:

• Per-category toggles for granular consent.
• A list of the actual cookies and storage items in each category, with purposes and retention periods.
• Clear information about third-party recipients and whether data leaves the UK.

Behind the scenes:

• Audit against the actual tags your site loads, not what you think it loads. A monthly scan catches drift when marketing teams add new tags without telling anyone.
• Geo-aware logic if you serve EU visitors.
• A consent log that proves, per visitor, what they chose and when. If the ICO comes asking, "we had a banner" is not an answer. "Here is the signed, timestamped record" is.

The engineering is not hard. Keeping it accurate as your tag stack grows is where most sites fail. If this reads like something you have been meaning to look at since February, you probably should. We cover related ground in our technical SEO guide because consent, tag loading and page performance are now the same problem.

If you want a second pair of eyes on your current setup, you can request a free website audit and we will tell you honestly where you stand against the April 2026 guidance.