# UK Cookie Law 2026: New Consent Exemptions and £17.5m PECR Fines Explained By [Eoin Villarin](https://amvprosox.com/about). Published 2026-10-29. Canonical: https://amvprosox.com/blog/uk-cookie-law-2026-data-use-and-access-act > New UK exemptions let some analytics cookies skip consent, but PECR fines now match the UK GDPR. Here is what changed in 2026 and how to fix your cookie banner. ## What changed in UK cookie law in 2026? The UK cookie law 2026 changes came into force on 5 February 2026 under the Data (Use and Access) Act 2025. Websites can now use analytics and preference cookies without consent if strict conditions are met, including an easy way to object. Advertising cookies still need consent, and PECR fines now reach £17.5 million or 4% of global turnover. **Key takeaways** - New PECR consent exceptions from the Data (Use and Access) Act 2025 came into force on 5 February 2026. - UK websites can use analytics cookies without consent only if the sole purpose is statistics to improve the service and users get a simple, free way to object. - Since 5 February 2026 the ICO can fine up to £17.5 million or 4% of global turnover for PECR breaches, up from a £500,000 maximum. - The ICO published final guidance on cookies and similar storage and access technologies on 29 April 2026. - In December 2025 the ICO said 979 of the UK's top 1,000 websites passed its cookie banner checks after it issued 17 preliminary enforcement notices. UK cookie law 2026 changes are the biggest shift in the rules since cookie banners appeared. The Data (Use and Access) Act 2025 added new exceptions that let UK websites run some analytics and functionality cookies without asking for consent, and since 5 February 2026 the Information Commissioner's Office (ICO) can fine businesses up to £17.5 million or 4% of global turnover for breaking the cookie rules. Advertising cookies and tracking pixels still need consent, and the ICO has been testing the UK's busiest websites to make sure they ask properly. This guide is for UK businesses, online stores and agencies that run websites with analytics, ad pixels or embedded tools. You get what changed, what the ICO's final guidance allows, what it does not, and a checklist for your cookie banner and tags. Dates, fines and exceptions come from [legislation.gov.uk](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/made), the [ICO's guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/) and ICO announcements, linked throughout. This post is general information, not legal advice. ## UK Cookie Law 2026 at a Glance | Change | Date | What it means for websites | | --- | --- | --- | | Data (Use and Access) Act 2025 receives Royal Assent | 19 June 2025 | Starts staged reform of UK GDPR and PECR | | New cookie consent exceptions (section 112, Schedule 12) | 5 February 2026 | Some analytics and functionality storage no longer needs consent | | New ICO enforcement powers for PECR (section 115, Schedule 13) | 5 February 2026 | Fines up to £17.5 million or 4% of global turnover | | ICO final storage and access technologies guidance | 29 April 2026 | Covers cookies, pixels, fingerprinting and similar tech | | Data protection complaints procedure required | 19 June 2026 | You need a clear way for people to complain to you | | Advertising cookies and pixels | No change | Still need prior consent | ## What Changed in UK Cookie Law in 2026? Cookies in the UK are governed by the Privacy and Electronic Communications Regulations (PECR), which sit beside the UK GDPR. Regulation 6 of PECR bans storing or reading information on a user's device unless an exception applies. Until 2026, apart from consent, the exceptions only covered transmitting a communication and storage that was strictly necessary, so analytics needed consent. That is why nearly every UK site shows a banner asking about analytics. The Data (Use and Access) Act 2025 received Royal Assent on [19 June 2025](https://www.gov.uk/government/news/new-data-laws-will-make-life-easier-for-british-people-cutting-life-admin-easing-traffic-and-speeding-up-roadworks). Its section 112 and Schedule 12 rewrote regulation 6 with a new list of exceptions, and the government's [Commencement No. 6 Regulations](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/made) brought those changes into force on 5 February 2026, together with the ICO's new PECR enforcement powers. ![UK government graphic announcing Royal Assent for the Data Use and Access Bill behind UK cookie law 2026](https://amvprosox.com/api/img/1793276939159-bjjplf) *The Data (Use and Access) Bill became law on 19 June 2025. Image: GOV.UK (DSIT)* ## Which Cookies No Longer Need Consent? The ICO's [guidance on the exceptions](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/) lists five. Each has conditions, and missing one means you need consent after all. ### 1. Strictly necessary Storage that is essential to provide the service the user asked for, judged from the user's point of view. This includes security, fraud prevention and keeping users logged in. The ICO is direct about one point: "there are no advertising purposes that meet the strictly necessary exception". ### 2. Statistical purposes (analytics) This is the big change. You can use cookies or similar technology without consent if the sole purpose is collecting statistical information about how your service is used in order to improve it. The conditions: - No tracking or monitoring of individuals, and no advertising use. - The data is not shared with anyone except to help you improve the service. - A third-party analytics provider is allowed only if it acts as your processor, not as a joint controller using the data for its own purposes. - You give clear and comprehensive information about it, and a simple, free way to object that you actually honor. ### 3. Appearance and functionality Storage whose sole purpose is to adapt how your site looks or works to the user's preferences, such as language, region or display settings. The same information and objection rules apply. Personalizing content based on interests or behavior does not qualify. ### 4. Communication and 5. Emergency assistance Storage needed only to transmit a communication, and location access used only to provide emergency help after a request. These rarely affect business websites. ### What still needs consent Everything else, which for most commercial sites means ad pixels (Meta, TikTok, LinkedIn, Google Ads), remarketing, affiliate tracking that profiles users, session recording tools that track individuals and most embedded social or video content that sets tracking cookies. The ICO's April 2026 guidance confirms online advertising, including frequency capping and ad measurement, currently requires consent. ## How Big Are the New PECR Fines? The ICO's [commencement statement](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/statement-on-the-commencement-of-the-data-use-and-access-act-duaa) of 5 February 2026 confirms the Act allows PECR fines of up to £17.5 million or 4% of global turnover, the same ceiling as the UK GDPR. Under the old regime the maximum PECR fine was £500,000. The ICO also gained powers to compel interviews and demand technical reports. ![ICO graphic reading Data use and access: the law is changing](https://amvprosox.com/api/img/1793276938499-v98bwg) *The ICO's campaign graphic for the Data (Use and Access) Act changes. Image: ICO* ### What the ICO is actually checking The ICO has spent two years testing banners on the UK's 1,000 most visited websites. In [December 2025](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/12/ico-action-secures-increased-cookie-compliance/) it said 979 of them passed, after letters, investigations and 17 preliminary enforcement notices. Its tests focused on three points: - Whether advertising cookies were set before the user made a choice. - Whether rejecting was as easy as accepting. - Whether advertising cookies were set even when the user had not consented. By [April 2026](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/04/final-storage-and-access-technologies-guidance-published/) the ICO said 99% of the top 1,000 sites met its standards and that its work would continue. Smaller sites have not had letters yet, but they face the same law and the same tests. ### Could advertising cookies be next? Possibly, but not yet. The Act lets the government add new exceptions through regulations. In May 2026 the ICO sent the government [advice on a possible exception](https://ico.org.uk/media2/yefdqvk4/20260505-report-for-dsit-on-changes-to-regulation-6-pecr-for-online-advertising.pdf) for lower-risk advertising by the publisher a user deals with directly, while keeping consent for behavioral advertising. Until regulations are made, consent rules for advertising stay as they are. If you also sell to EU customers, remember that EU rules still require consent for analytics cookies. ## What UK Cookie Law 2026 Means for Your Website The reform is a chance to show a lighter banner, or none for some simple sites, but only if your setup really qualifies. Here is the checklist I use for UK clients. - **Audit everything that stores or reads data.** Cookies, local storage, tracking pixels, fingerprinting scripts, app SDKs and embedded iframes. The ICO guidance covers all of them, not just cookies. - **Sort each item into a category.** Strictly necessary, analytics, functionality or advertising. Write down why, because you need to justify any exception you rely on. - **Check your analytics really qualifies.** A first-party or processor-only tool with data sharing and advertising features switched off may fit the statistical exception. A setup linked to ad platforms, or one where the vendor uses the data for its own purposes, needs consent. - **Add a working objection option** for exempt analytics and functionality: a clear notice and a free, simple switch that actually stops the scripts and remembers the choice. - **Fix the banner against the ICO's three tests.** No advertising tags before a choice, a Reject button as prominent as Accept on the first layer, and no tags firing after a rejection. - **Test your consent tool, not just its settings.** Open the site in a clean browser, reject everything and check the network tab. Google, Meta and TikTok tags can load through a tag manager outside the banner's control. - **Keep the banner fast and accessible.** Heavy consent scripts hurt [Interaction to Next Paint](https://amvprosox.com/blog/interaction-to-next-paint-inp-guide), and the banner needs keyboard access and readable contrast. - **Update your cookie and privacy notices** to explain exempt analytics, how to object and which tools need consent. - **Publish a complaints route.** Since 19 June 2026 organizations must have a procedure for data protection complaints, so add a clear contact method to your privacy page. Shopify merchants should combine this with the [move from script tags to pixels](https://amvprosox.com/blog/shopify-script-tag-deprecation-pixels-migration), which changes how tracking respects customer privacy settings. ## Frequently asked questions ### Do UK websites still need a cookie banner in 2026? Most do. The Data (Use and Access) Act lets you skip consent for strictly necessary, qualifying analytics and preference cookies, but you still need clear information and an objection option for analytics. Any advertising cookie, tracking pixel or third-party tool that uses data for its own purposes still needs consent, which requires a banner. ### Is Google Analytics exempt from cookie consent in the UK? Only if your setup meets the statistical purposes exception. The sole purpose must be measuring use of your own service to improve it, the provider must act as your processor and not use the data for its own purposes, and users must get information and a simple way to object. Analytics linked to advertising features does not qualify. ### What is the maximum fine for breaking UK cookie rules? Since 5 February 2026 the ICO can fine up to £17.5 million or 4% of global annual turnover for breaches of PECR, which includes the cookie rules. Before the Data (Use and Access) Act the maximum PECR fine was £500,000. The ICO can also issue enforcement notices and compel information. ### When did the new UK cookie exemptions come into force? The new exceptions in section 112 and Schedule 12 of the Data (Use and Access) Act 2025 came into force on 5 February 2026 under the Commencement No. 6 Regulations. The ICO published its final storage and access technologies guidance explaining them on 29 April 2026. ## Lighter Banners, Bigger Fines UK cookie law in 2026 rewards websites that know exactly what each script does. Simple sites can cut consent prompts for basic analytics, while sites with advertising tags face a regulator that now has GDPR-level fines and a habit of testing banners. If you want your cookie banner, analytics and pixels audited and set up properly for the new rules, [send me a message](https://amvprosox.com/#contact-form) and I will review your site on WordPress, Shopify or a custom stack and fix what needs fixing, during UK working hours. You can see my work in my [case studies](https://amvprosox.com/case-studies). I will reply within 24 hours.