Do Analytics Cookies Still Need Consent in the UK? What Changed in 2027

 



If you run a UK website, you may have heard that analytics cookies no longer need consent. That is partly right. The change is real, but it comes with conditions, and it does not cover advertising.

What changed

The Data (Use and Access) Act 2025 amended the UK's cookie rules in the Privacy and Electronic Communications Regulations (PECR). The relevant section came into force on 5 February 2026, and the ICO published its final guidance on storage and access technologies on 29 April 2026.

Two new exceptions let you set some cookies without asking first:

• Statistical purposes: cookies used only to understand how people use your site so you can improve it.
• Appearance and functionality: cookies that adapt how the site looks or works to the visitor's preferences, such as remembering a chosen language.

The conditions

For both exceptions, the ICO says you must give clear and comprehensive information about the purpose and offer a simple, free way to object. If someone objects, you have to stop.

For analytics, any outside provider must act for you as a processor, and the data can only be shared to help improve your site. The ICO also says this exception does not cover analytics about who your visitors are.

What still needs consent

Advertising. The ICO's guidance says you cannot rely on any of the exceptions for advertising purposes, including ad measurement, frequency capping and fingerprinting for ads. Meta pixels, Google Ads tags and similar tools still need a clear opt-in.

What about EU visitors?

The UK change does not apply to them. EU law has no matching exception, although some regulators, such as France's CNIL, allow tightly limited audience measurement without consent. If you have both UK and EU visitors, they may need different banners.

What to do now

1. List your analytics tools and check whether each provider uses the data only on your behalf.
2. Update your privacy information so it explains the analytics purpose in simple words.
3. Add an easy way to object, such as a toggle in your preference centre.
4. Keep advertising tags blocked until the visitor agrees.
5. Show UK and EU visitors the banner that fits their location.

Step 5 is hard to manage by hand. Seers lists the UK's Data (Use and Access) Act among the laws it covers, and its automatic region detection shows each visitor the banner that matches their local rules. UK visitors can see the new options while EU visitors keep the opt-in their law requires.

Conclusion

The 2026 change makes UK analytics simpler for sites that meet the conditions. Records, withdrawals and tag control still matter as much as before, and Seers sets out those wider consent management best practices for growing businesses.