Do You Still Need Cookie Consent for Google Analytics? UK Rules Explained for 2026

For years the rule for UK websites was simple: Google Analytics sets cookies, so you need consent before it runs. For many small businesses that meant a large hole in their reporting every time a visitor clicked "reject".

That rule has now changed. A new exception for analytics cookies came into force in 2026, and the Information Commissioner's Office (ICO) has published final guidance on how it works. So, do you still need cookie consent for Google Analytics in the UK? Sometimes not for analytics alone, but almost certainly yes for anything connected to advertising. Here is what changed and what to do about it.

Cookies and similar technologies are governed by the Privacy and Electronic Communications Regulations (PECR). Until this year, the main exemption from PECR's consent rule covered storage that was "strictly necessary" to provide the service a visitor asked for. Analytics never qualified, so it needed opt-in consent.

The Data (Use and Access) Act 2025 amended PECR to add new exceptions, including one for statistical purposes. That change came into force on 5 February 2026. On 29 April 2026 the ICO then finalised its guidance on storage and access technologies, which now includes a chapter explaining each exception.

In plain terms, you can now set analytics cookies without asking first, as long as you meet some specific conditions.

The wording is in paragraph 5 of the new Schedule A1 to PECR. Paraphrasing closely, consent is not needed for storing or accessing information on a visitor's device if:

• you provide an online service (a website or app counts);
• the sole purpose is to collect information for statistical purposes about how your service or website is used, with a view to improving it;
• the information is not shared with anyone else, except to help you make those improvements;
• visitors are given clear and comprehensive information about the purpose; and
• visitors are given a simple, free way to object, and they have not objected.

If someone does object, you must stop. If they later change their mind, you can start again.

The ICO guidance on the exceptions is clear that this is a narrow exception. It is about how your service is used, not about who uses it. Activities it gives as likely to qualify, when using aggregate statistics, include:

• page-by-page visit totals and user journeys;
• scroll depth and interactions with sections of a page;
• device types, browsers and operating systems;
• how people reached your site;
• coarse location at city or region level.

It does not cover identifying, tracking or monitoring individual visitors, building profiles, recording what individuals did on your site (other than for security), or anything related to advertising. The ICO also says you should aggregate the data and not keep individual-level information for longer than you need to do that.

The exception does allow a third-party analytics provider. However, the ICO sets some firm expectations. Your provider must only act on your behalf and use the information to help you improve your service. To rely on the exception, the provider must be a processor rather than a joint controller, and it must not link the data with other information it holds. You also need to tell visitors that you use a third party and explain what it does with the data.

Whether a standard Google Analytics 4 setup meets those tests depends on how it is configured and on your terms with Google. Features that send data into Google's advertising products go beyond the exception. If you cannot confidently say your setup stays within it, keep analytics behind consent.

The ICO states that online advertising purposes are not exempt from PECR's consent requirements and never have been. That includes ad measurement and performance, frequency capping and similar advertising-related uses.

For a typical SME website, that means you still need opt-in consent before loading:

• Google Ads conversion tracking and remarketing tags;
• the Meta Pixel and other social media tracking tags (the ICO says social media tracking technologies need consent whether or not visitors use that network);
• LinkedIn, TikTok, Microsoft Advertising and similar ad tags;
• Google Analytics features that pass data to Google Ads, such as linked audiences or conversions shared with advertising partners; and
• session recording tools that log what individual visitors do.

Google's own EU user consent policy, which also applies to visitors in the UK, requires you to get valid consent for cookies where the law requires it and for personalised advertising. If you run paid campaigns, a proper consent mechanism is still essential.

Google has also changed how Analytics and Ads controls work together. From 15 June 2026, the Google Signals setting in Google Analytics no longer controls whether Google Ads cookies and IDs are collected through the Analytics tag. Instead, Google says Consent Mode becomes the single control for that data, with ad_storage deciding whether Ads cookies and IDs are used. Google Signals now only controls whether Analytics data is associated with signed-in users for reporting.

Google has also said that later in 2026 it will make the Consent Mode ad_personalization setting the sole control over whether linked Analytics data is used for ad personalisation.

The practical point: if your banner does not pass the right signals to Google, your advertising data may not reflect what visitors agreed to.

List every tag and cookie on your site, including anything added years ago by a plugin, theme or former agency. Check your tag manager, your site's code and your browser's developer tools, then group each item by purpose: strictly necessary, analytics, advertising or functionality.

If your analytics is purely about understanding how the site is used, and you can configure it to stay within the ICO's conditions, you may be able to run it without opt-in consent. If you use the same data for advertising, audience building or profiling, keep it behind consent.

Your banner still has work to do. If you rely on the exception, the ICO suggests the simple means of objecting can sit inside your existing consent tool, for example as an analytics toggle that is on by default and can be switched off at any time. You should not rely solely on browser settings to decide whether someone has objected. Advertising categories must stay off until a visitor actively agrees.

In GA4, review which properties are linked to Google Ads, whether Google Signals is switched on, and your account's data sharing settings. Then check your Consent Mode setup. For UK visitors, ad_storage, ad_user_data and ad_personalization should default to denied and only change to granted after someone accepts advertising cookies. Make sure the analytics setting behaves the way your chosen approach requires, and test both the accept and reject paths in Google Tag Assistant.

The exception depends on clear and comprehensive information. Explain what analytics you use, why, which provider is involved, what it does with the data and how to object. Keep it in plain English and easy to find.

• Every tag and cookie is listed and grouped by purpose.
• You have decided, and written down, whether you rely on the analytics exception.
• Analytics data is not shared with Google Ads or other ad platforms without consent.
• Advertising and social tracking tags only fire after opt-in consent.
• Visitors have a simple, free way to switch analytics off, and it works.
• Consent Mode defaults to denied for advertising signals for UK visitors.
• Both accept and reject paths have been tested.
• Your privacy and cookie information explains analytics clearly.

Under the Data (Use and Access) Act, the ICO can now issue PECR fines of up to £17.5 million or 4% of global turnover. For most SMEs the more immediate risks are commercial: unreliable reporting and campaigns optimised on incomplete data.

Done properly, the new exception can give you a fuller view of how people use your site while keeping advertising data clean and consented.

Please note: this article is a general guide based on the ICO's published guidance and the legislation as of 2026. It is not legal advice. If you are unsure how the rules apply to your business, speak to a qualified data protection adviser.

At Rise By Digital we build and host websites, run paid campaigns and set up tracking properly. If you want a second pair of eyes on your tags, cookie banner and Consent Mode, our marketing audits cover exactly this, and our website design, hosting and PPC teams can fix what we find.

Book your initial discovery call