CookieCrumbs
Start free

blog · 5 September 2026 · 8 min read

UK cookie rules after 5 February 2026: the statistics exemption, explained

The UK loosened one corner of its cookie rules and tightened the penalty for everything else. Here is what the Data (Use and Access) Act changed, and what it did not.

What changed on 5 February 2026

The Privacy and Electronic Communications Regulations (PECR) are the UK’s cookie law, and until this year they required consent for every cookie that was not strictly necessary, the same as the EU. The Data (Use and Access) Act 2025 amended them, and the cookie provisions took effect on 5 February 2026. The Act added a new Schedule A1 to PECR with a short list of purposes for which storage and access no longer need consent, and it raised the maximum fine for PECR breaches from £500,000 to the UK GDPR level. The ICO finalised its guidance on storage and access technologies on 29 April 2026, after two consultations, and that guidance is now the reference for how the exemptions work in practice.

The exemptions, and their conditions

Three new purposes are exempt from consent. Cookies used solely for statistical purposes, where the resulting information is used only by the operator of the site to improve it. Cookies used solely to customise the appearance or function of the site to the visitor’s preferences, accessibility and display settings being the obvious examples. And cookies needed to provide emergency assistance, such as location for an emergency service. The word that carries the weight is solely: an analytics cookie that also feeds advertising, or a preference cookie that doubles as an identifier for a third party, does not qualify.

PECR after the Data (Use and Access) Act: two narrow exemptions, both conditional on information and an objection route. Advertising and third-party analytics still need consent.

Two conditions apply to the statistics and appearance exemptions and both are easy to miss. First, the visitor still has to be given clear information about what is stored and why. Second, they have to be given a simple way to object, and the objection has to be honoured. So the banner does not go away; it changes shape. For an exempt statistics cookie, an information notice with an opt-out is enough. For everything else, the consent rule is unchanged.

  • Advertising and retargeting cookies and pixels, every one.
  • Social media embeds and share buttons that set cookies.
  • Analytics that is shared with, or used by, anyone other than the site operator.
  • Cross-site tracking of any kind, including “statistics” that identify a person across sites.
  • Anything the ICO guidance calls intrusive: fingerprinting, session recording with personal data, A/B tools that profile.

Does GA4 qualify?

This is the question every UK site asks, and the honest answer is: not in its standard configuration. The exemption is for statistics used only by the site operator. A standard GA4 property sends the data to Google, where it is processed under Google’s terms and, unless you switch every sharing setting off, used for Google’s own purposes as well. That is not “used only by the operator”. A self-hosted or first-party analytics tool that never shares the data is the clear case; GA4 with data sharing off is arguable and the ICO has not blessed it. CookieCrumbs ships the UK rule set with the exemptions modelled, and treats GA4 as consent-bound unless you tell it otherwise, which is the conservative reading and the one we would defend.

Fines now match UK GDPR

The other half of the Act is the part sites tend to skip. PECR fines were capped at £500,000; they are now capped at £17.5 million or four percent of global annual turnover, whichever is higher, which is the UK GDPR ceiling. The ICO has said it will use the new powers. In other words, the UK loosened the rule for the least intrusive cookies and made the penalty for the intrusive ones thirty-five times larger.

What to do on your site

  1. Scan the site and sort every cookie by purpose. The exemptions are per purpose, not per vendor.
  2. Decide whether your analytics is “used only by you”. If it is GA4 as shipped, it is not. Keep it behind consent.
  3. For cookies you classify as exempt statistics or appearance, keep the information notice and add an objection route. A “manage cookies” link that lets someone turn them off is enough.
  4. Keep opt-in for advertising, social and third-party analytics, with Reject as easy as Accept.
  5. Keep the records. The burden of proof did not move.

The regions guide shows how the UK rule set is applied per visitor, alongside the EU, Swiss, Brazilian, Canadian and US rules, from one banner.

Sources

  1. Practical Law (Thomson Reuters), “Changes to UK cookie rules: Data (Use and Access) Act 2025”
  2. Stevens & Bolton, “The Data (Use and Access) Act 2025: cookies, what is changing and what you need to know”
  3. Womble Bond Dickinson, “New exceptions for non-intrusive cookies: the ICO’s updated guidance has landed”, 2026
  4. Clifford Chance, “Key aspects of the Data (Use and Access) Act take effect”, February 2026
  5. CookieCrumbs regulation watch, “UK PECR Schedule A1”, ICO guidance finalised 29 April 2026

Written by the CookieCrumbs team, published 5 September 2026. Facts carry their dates; if one has moved on, tell us and we will correct it.

next step

See what your site loads before consent

The free scan reads your homepage and lists the trackers. No account, nothing stored.

Run a free scan Start free