Does your website still need a cookie banner for analytics?

Possibly not, for analytics alone. Since 5 February 2026, UK law lets a website set analytics cookies without asking first, as long as the data is used only to produce statistics that improve the site, visitors are told clearly what happens, and they can object for free. Default Google Analytics usually falls outside that exception, and anything to do with advertising still needs consent.

What changed in UK cookie law in 2026?

The Data (Use and Access) Act 2025 added new exceptions to the Privacy and Electronic Communications Regulations, usually called PECR, which is the law behind cookie banners. According to Clifford Chance's summary of the commencement , consent is no longer required for cookies used purely for statistics, appearance or emergency assistance from 5 February 2026. The government's commencement plan confirms most of the data and privacy provisions came into force that day.

The Information Commissioner's Office, the UK regulator, then finalised its guidance on cookies and similar technologies on 29 April 2026 . That guidance is what tells you, in practice, whether your setup qualifies.

The stakes went up at the same time. Fines for breaking PECR were capped at £500,000, and the maximum is now £17.5 million or 4 percent of global annual turnover , the same level as UK GDPR.

What exactly does the analytics exception allow?

The analytics exception allows a website to store or read cookies without consent when the only purpose is counting how the site is used so you can improve it. The wording in Schedule 12 of the Act sets out the conditions, and all of them have to be true at once:

• The sole purpose is collecting statistics about how your site or service is used, to improve it.
• The information is not shared with anyone else, except someone helping you make those improvements.
• Visitors get clear and comprehensive information about the purpose.
• Visitors get a simple way to object, free of charge, and have not objected.

The ICO's guidance on the exceptions adds that the result should be aggregate figures that do not identify anyone, and that you should not use the data to make decisions about an individual visitor.

What counts as statistics, and what does not?

Statistics, in the ICO's reading, means totals and trends about the site rather than records about people. The ICO lists visit counts, page interactions, device and browser types, where visitors came from, A/B testing, rough city or region location, page load speed and bounce rate as likely to qualify.

The same guidance rules out several things small businesses often switch on without thinking:

• Recordings or logs of individual visitors, such as session replay tools, unless they are used only for security.
• Measuring how adverts perform.
• Linking a visitor's identity to purchases and sharing that with advertising partners.
• Profiling individuals or groups, including demographic segments such as age and gender.
• Tracking people across other websites or services.

The ICO gives a useful pair of examples. A publisher measuring scroll depth, time on page and bounce rate to plan content is fine. The same publisher adding age and gender segmentation to target content is not, because that has become profiling.

Does Google Analytics qualify for the exception?

Google Analytics in its default setup does not usually qualify, because Google can use the data for its own purposes. The ICO guidance says a third party analytics provider must act only on your behalf, should not link your data with other information it holds, and must be a processor under UK GDPR rather than a joint controller.

Google's own help page on data sharing settings explains that one optional setting lets Google analyse your data "to improve Google products and services". That is exactly the kind of reuse the exception does not allow.

Some compliance guides argue Google Analytics 4 can be brought inside the exception with changes. CookieScript's guide , for example, suggests turning off Google signals, turning off data sharing with Google products and services, setting the shortest data retention period, and checking no linked service receives user data. Treat that as a reasonable reading rather than an ICO ruling. If your site also feeds Google Ads, remarketing audiences or demographic reports, consent is still needed for those, and mixing them into one exempt tag does not work.

Which analytics tools are easiest to run without consent?

Tools that store nothing on the visitor's device are the simplest, because there is no cookie to ask about. Plausible's data policy , for instance, says it does not use cookies, browser cache or local storage, and that its daily visitor identifier is rebuilt from a salt that is deleted every 24 hours.

A cookieless tool still processes some personal data, such as IP addresses on the way in, so it belongs in your privacy notice. It just removes the consent question for analytics.

The other route is analytics you host and control yourself, configured to keep data aggregated and unshared. That fits the exception well, but someone has to look after it.

What should a small business change on its website?

A small business should start by listing every script that sets a cookie or reads from the device, then sort each one into exempt or consent needed. Most sites have more than the owner expects: analytics, a chat widget, embedded videos, a booking tool, an advertising pixel.

Then work through these steps:

1. Decide on analytics. Either configure your current tool to meet the four conditions, or move to a cookieless tool. Strip out anything advertising related from the analytics setup.
2. Keep the banner for anything that needs consent. Advertising pixels, remarketing, session recording and most social embeds still need a proper opt in. Many sites will still need a banner, just with fewer switches on it.
3. Give people a way to object. Exempt analytics still needs a simple, free opt out. CookieScript reports the ICO's view that an existing cookie banner can be used for opting out, which suits most small sites.
4. Rewrite the cookie and privacy notice. Say plainly what each tool does, who provides it and what happens to the data. The exception depends on clear and comprehensive information.
5. Check fonts and embeds. The ICO notes that externally hosted font libraries can collect IP addresses. Self hosting fonts removes the issue.

If any of this sounds like work your site was never built to support, it is usually a small change in a modern web app or website build , and a larger one on an old template. The same logic applies inside mobile apps, which use storage on the phone in exactly the same way.

Is it worth removing the cookie banner at all?

Removing analytics from the consent banner is worth doing for most small sites, because analytics that only runs after consent misses everyone who ignores or rejects the banner. With an exempt setup, your visitor numbers reflect everyone who did not object, which makes the figures far more useful for decisions.

Removing the banner completely is only possible if nothing else on the site needs consent. For a brochure site with cookieless analytics and self hosted fonts, that can be realistic. For a shop running advertising, it is not.

The ICO says 99 percent of the UK's top 1,000 websites now meet its standards for cookie banners , so the regulator's attention is moving to the long tail. Getting this right is cheaper now than after a complaint.

Not sure what your site is setting, or whether it is worth changing? Book a free 15 minute call and we will tell you straight.

Frequently asked questions

Do I need a cookie banner if my website has no cookies?

Not for PECR purposes, if genuinely nothing is stored on or read from the visitor's device beyond what is strictly necessary. You still need a privacy notice explaining any personal data you process, such as contact form submissions. Check embedded maps, videos and fonts before assuming there are no cookies.

Can I just hide the analytics opt out in my privacy policy?

The law requires a simple means of objecting that is free of charge, and clear information about the purpose. A setting buried several clicks deep is unlikely to count as simple. A visible link or toggle, for example in the footer or an existing banner, is the safer approach.

Does the analytics exception apply to mobile apps?

Yes, the exception covers storage and access on any device, not only browsers. An app that records usage statistics to improve itself can rely on it under the same conditions. Analytics kits that also feed advertising networks still need consent.

Is it still legal to use Google Analytics with a consent banner?

Yes. Asking for consent remains a valid way to run any analytics tool, including Google Analytics with its default settings. The exception is an option to collect without prior consent, not a requirement to change.