Key takeaways

• Not just cookies: The UK rules apply to any technology that stores or reads information on a user’s device, including tracking pixels, local storage, device fingerprinting and scripts and tags.
• New exceptions: Since 5 February 2026, some analytics and website appearance cookies no longer need consent, but only if users are told about them and given a simple, free way to object.
• Consent still required: Advertising, social media tracking and cross-site tracking still need prior opt-in consent, and rejecting must be as easy as accepting.
• Higher stakes: Maximum fines for breaching the cookie rules now match UK GDPR levels, and the ICO published its final guidance on these technologies on 29 April 2026.

Almost every business website uses cookies or similar technologies, whether to keep the site running, measure traffic, remember preferences or support advertising. Cookie banners have become a familiar part of browsing, but the rules behind them changed significantly in 2026. The Data (Use and Access) Act 2025 created new exceptions to the consent requirement and raised the maximum penalties , and the Information Commissioner’s Office (ICO) has replaced its earlier cookies guidance with final guidance on “storage and access technologies”.

This article explains what the UK rules now require, which cookies still need consent, and what a website’s cookies policy should say. It focuses on UK law, with reference to the EU where the two now differ.

What do the UK rules on cookies require?

The main rule is in regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). It prohibits storing information, or gaining access to information stored, on a user’s device unless the user is given clear and comprehensive information and consents, or an exception applies.

Although the rule is usually described as the “cookie rule”, it is not limited to cookies. The ICO’s guidance confirms that it applies to any technology that stores or accesses information on someone’s device, including tracking pixels, link decoration and navigational tracking, local storage, device fingerprinting and scripts and tags[4]. The rules also apply to apps and connected devices, not only websites.

Where the information collected is personal data, which it often will be, the UK GDPR applies as well. Consent under PECR must meet the UK GDPR standard: a clear affirmative act that is freely given, specific, informed and unambiguous. Where the website also targets users in the EU, the EU ePrivacy rules and the EU GDPR may apply too.

Do you need a cookies policy?

There is no legal requirement to have a document called a cookies policy. But PECR requires clear and comprehensive information about the technologies you use, and the UK GDPR (Article 5) requires transparency about any personal data they collect. A cookies policy, linked from the cookie banner and the website footer and read with the privacy notice, is the usual way to provide that information.

A cookies policy on its own does not make a website compliant. What matters is whether the technologies actually set on users’ devices match what the policy says, and whether the consent mechanism works as described. The ICO guidance states that it expects organisations to review their websites regularly for this reason.

What changed under the Data (Use and Access) Act 2025?

Section 112 of and Schedule 12 to the Data (Use and Access) Act 2025 amended regulation 6 of PECR and moved the exceptions to the consent requirement into a new Schedule A1. These changes came into force on 5 February 2026. There are now five exceptions:

The Act also brought PECR enforcement into line with the UK GDPR regime under the Data Protection Act 2018. The maximum fine for breaching the cookie rule is now the higher UK GDPR level of £17.5 million or 4% of annual worldwide turnover, whichever is greater, replacing the previous maximum of £500,000. The Act also gives the Government a power to add or change exceptions by regulations, so further changes are possible.

Can analytics cookies now be used without consent?

Sometimes, but the statistical purposes exception is narrower than “analytics” in the everyday sense. The ICO guidance says it is about how a service is used, not who uses it. It covers things like page visits, user journeys, scroll depth, device and browser types, referral sources, A/B testing, coarse location at city or region level, and page loading speeds, provided the output is aggregate statistics that cannot identify people.

The exception does not cover analytics used to track or profile individual visitors, recordings of individual sessions, measuring whether users clicked on adverts, connecting a visitor’s activity to purchases for sharing with advertising partners, or monitoring users across other websites. Individual-level information must be aggregated and not kept longer than necessary.

A third-party analytics provider can be used, but only if it acts as a processor on your behalf and uses the information solely to help you improve your website, without combining it with other data. If the same tool also feeds advertising features, such as remarketing audiences, the exception will not apply and consent is required. Because the exceptions apply only where storage or access is for the “sole purpose” specified, multi-purpose tools need particular care.

Relying on the statistical purposes or appearance exception also requires a simple, free means of objecting. The ICO guidance suggests this could be provided through the existing consent mechanism, for example an analytics toggle that is on by default and that users can switch off at any time. If a user objects, the technology must stop.

Websites with EU visitors should bear in mind that “the UK exceptions do not automatically apply to EU users; sites that target EU users should check the ePrivacy rules and any national implementation or future Digital Omnibus changes to ensure their compliance with EU law.

What should a cookies policy include?

Drawing on the ICO’s guidance, a cookies policy should usually explain:

• The technologies used. Each cookie or similar technology on the website, not just cookies, grouped into clear categories.
• Their purposes. What each one does, in plain language that anyone visiting the website can understand.
• The legal basis. Which technologies rely on an exception and which are set only with consent.
• Third parties. The identity of each third party that sets or receives information through the technologies, and what it does with it. Vague references to “partners” are not enough.
• How long each technology lasts. Durations should be proportionate to the purpose; relying on a browser or vendor default, such as a 400-day expiry, is unlikely to be justifiable.
• How users can object to exempt analytics and appearance cookies, give or withdraw consent, and revisit their preferences at any time, and what happens if they do.
• A link to the privacy notice, and information about any social media presence or embedded content, such as videos, that may set its own technologies.

Many websites present this information in a table generated by their consent management platform. This can work well, but automatic categorisation is not always correct, so the output should be checked against what the website actually does.

How should consent be obtained?

Where consent is required, the ICO’s final guidance sets out clear expectations. A compliant consent mechanism should:

• make it as easy to reject non-essential technologies as to accept them, for example with equally prominent “accept all” and “reject all” options;
• require a positive action before any non-exempt technologies are set, so that nothing is pre-enabled and silence or continued browsing is not treated as consent;
• offer granular choices for different purposes, such as advertising and social media tracking;
• identify the third parties that will receive information;
• keep consent separate from terms and conditions;
• not rely solely on browser settings as an indication of consent; and
• allow users to withdraw consent as easily as they gave it.

The ICO guidance suggests waiting a reasonable time, and gives an example of a six months preference period, before asking again a user who has refused consent. Fresh consent is needed if the website starts using technologies for new purposes or sharing information with new third parties. Website operators must also be able to show that consent was given, which in practice usually means keeping records through a consent management platform.

Who is responsible for third-party cookies?

Many cookies are set by third parties, such as advertising networks, social media platforms and video hosts. The website operator decides whether to include these on its website, and the ICO guidance treats the operator as having primary responsibility for compliance with PECR. A cookies policy cannot shift that responsibility by disclaiming liability for third-party cookies the operator has chosen to deploy.

Social media plugins that track users require consent, and the website operator and the platform may be joint controllers for the data collected. Embedded content, such as videos, should be configured where possible not to set technologies until the user chooses to play it, for example by using a privacy-enhanced mode. For ordinary links to external websites, it is reasonable to state that the operator is not responsible for the technologies used on those sites. Operators should also review their contracts with technology providers, including any consent management platform provider, to allocate data protection roles and responsibilities.

What are the risks of getting it wrong?

Cookie compliance has been a consistent ICO priority. When it published its final guidance on 29 April 2026, the ICO said that 99% of the UK’s top 1,000 websites now meet its cookie-banner compliance standards as a result of its work with industry, and that its interventions would continue. It has signalled particular focus on advertising-related tracking without valid consent.

With PECR fines now aligned with the UK GDPR, non-compliance carries much greater financial exposure than before. The ICO’s guidance states that online advertising purposes are not exempt from the consent requirement and never have been, including ad measurement, frequency capping and similar purposes. Beyond fines, poorly designed banners and inaccurate cookies policies can attract complaints and undermine user trust.

Cookies compliance: a practical checklist

For website operators, reviewing cookies compliance is likely to involve:

• Identifying every cookie and similar technology the website sets, who sets it and why, and removing any no longer needed.
• Deciding which technologies fall within an exception, and which require consent, applying the ICO’s narrow reading of each exception.
• Checking whether your analytics set-up genuinely meets the statistical purposes exception, including your provider’s role and whether data feeds advertising.
• Providing a simple, free way to object to exempt analytics and appearance technologies.
• Ensuring “reject” is as prominent as “accept”, nothing non-exempt is set before consent, and choices are granular.
• Updating the cookies policy to name third parties, give proportionate durations and explain users’ choices.
• EU users. Considering whether EU rules apply and, if so, whether analytics consent is still needed.
• Re-checking the website regularly, and whenever new tools, plugins or third parties are added.

At Maybrook Law, we advise technology companies, SaaS providers and other online businesses on cookies and online tracking, website terms and policies, privacy notices and data protection compliance. If you are reviewing your website’s cookies policy or consent mechanism, or would like to discuss any of the issues raised in this article, we would be pleased to advise on your position.

This article reflects the law as at 21 September 2026. Our insights, articles and guides do not, and are not intended to, constitute legal advice or be an exhaustive review of all legal developments. Although every effort is made to ensure that the information provided in this article is accurate as of the publication date, please be aware that this area of law is developing rapidly and may be subject to change. Please seek legal advice before applying the information provided to any specific circumstances, transactions or legal issues.