UK Cookie Law Changes 2026: What the Data Act Means for Your Website
Quick answer: Since 5 February 2026, UK websites no longer need consent for some analytics and functionality cookies, provided people are told clearly and can opt out for free. Consent is still required for advertising and third-party tracking, and the maximum fine for breaching the cookie rules has risen to £17.5 million or 4% of global turnover. This is general information, not legal advice.
What actually changed
The Data (Use and Access) Act 2025 amended the Privacy and Electronic Communications Regulations, usually called PECR, which is the law behind cookie banners. According to a Stevens & Bolton summary, the cookie changes took effect on 5 February 2026. Three categories no longer need prior consent: statistical or analytics cookies, appearance or functionality cookies, and emergency assistance cookies.
There are conditions. For analytics and functionality cookies you must give clear, comprehensive information about what they do and offer a simple, free way to opt out. The analytics exemption also applies only where the data is used by you, the site operator. If it is passed to third parties for advertising, consent is still needed.
What still needs consent
Anything that tracks people for advertising, retargeting or profile building across sites. That covers most ad pixels, social media tracking tags and third-party marketing scripts. If your site loads them before someone clicks accept, you are exposed.
Why this matters more now: the fines
The maximum penalty for breaching PECR cookie and electronic marketing rules rose from £500,000 to £17.5 million or 4% of global annual turnover, whichever is higher, putting it in line with UK GDPR. Most small businesses will never see a fine near that level, but the signal is clear: regulators now treat cookie compliance as a serious matter.
A practical audit in an afternoon
- List every cookie and script. Use a scanner or your browser's developer tools to see what loads on a fresh visit, including scripts added by plugins, chat widgets, embedded video and maps.
- Sort them into buckets. Strictly necessary, analytics, functionality, and advertising or third-party.
- Decide what your banner needs to say. If you now rely on an exemption for analytics, your site must still explain it and offer an opt-out. If you use marketing tags, you still need a proper consent choice.
- Make "reject" as easy as "accept". Buried or confusing options remain a risk.
- Update your cookie and privacy policy so it matches what the site really does.
- Test after every change. Marketing tools love to sneak scripts back in through tag managers.
Analytics choices to consider
If you only want to understand which pages people read, a privacy-friendly analytics setup that does not share data with advertisers is the easiest route under the new exemption. If you run Google Ads or Meta campaigns, keep consent in place for the tags that power them.
What not to do
Do not assume the changes mean you can delete the banner. Do not leave pre-ticked boxes. And do not copy another company's policy word for word, because it will describe cookies you do not use and miss the ones you do.
FAQs
Do I still need a cookie banner in the UK?
Often yes, if you use advertising or third-party tracking cookies. A site that uses only strictly necessary cookies and exempt analytics may need less, but still has to provide clear information.
When did the new rules start?
The cookie changes took effect on 5 February 2026.
Is Google Analytics covered by the exemption?
It depends on how it is configured and whether data is used only by you. Check the current ICO guidance and, if in doubt, take legal advice, as guidance was still being finalised when the sources for this article were published.
What are the new fines?
Up to £17.5 million or 4% of global annual turnover.
Related reading: UK Online Store Lost Traffic in 2026? A Practical Recovery Plan After Google's March Core Update
Want a compliance check on your site?
Websigntist works with UK businesses on web design, development and ongoing support. If you would like your cookie setup, forms and policies reviewed alongside performance and SEO, contact us.
Source: Stevens & Bolton LLP, The Data (Use and Access) Act 2025: cookies. This article is general information and not legal advice.
Get a fixed, itemised quote for your project
Written by
Muhammad Adnan
Founder & Director, Websigntist
Muhammad Adnan is the founder and director of Websigntist, a digital solution and global IT consulting company. He has 14+ years of experience working with 120+ clients from 10+ countries helping businesses with website design and development, eCommerce, SEO, digital marketing, branding and custom digital solutions. He's all about building practical, reliable and results-driven solutions that help businesses achieve online growth, as reflected by a 98% client satisfaction rate.
