Since 5 February 2026, UK websites can set some non-essential cookies without asking for consent first. The Data (Use and Access) Act 2025 (DUAA) added Schedule A1 to the Privacy and Electronic Communications Regulations (PECR), which lists five exceptions to the consent rule. Two of them are new in practice: first-party statistics used only to improve your site, and storage that applies a visitor's appearance or functionality choices. Both still require clear information and a free, simple way to object. Advertising cookies need consent as before.
What the Data (Use and Access) Act changed about cookies
The DUAA received Royal Assent on 19 June 2025. Its cookie provisions, section 112 and Schedule 12, came into force on 5 February 2026 under the commencement regulations SI 2026/82, together with the new PECR enforcement powers in Schedule 13.
Before the Act, UK cookie law mirrored the EU's: consent was needed for everything except storage strictly necessary for a service the user asked for, or for carrying a communication. Schedule A1 keeps that rule in paragraph 2 and widens the exceptions around it.
The maximum PECR fine also rose from GBP 500,000 to GBP 17.5 million or 4% of worldwide annual turnover, the same scale as UK GDPR. For the rest of the Act's changes, read what the Data Use and Access Act means in practice.
The five exceptions in Schedule A1
Each exception is tied to a single purpose. As soon as a cookie or similar technology serves another purpose as well, the exception stops applying and consent is needed. The ICO's guidance on the exceptions, finalised on 29 April 2026, explains each one.
1. Communication (paragraph 3)
Storage or access for the sole purpose of carrying out the transmission of a communication over a network. The ICO's example is a load-balancing session cookie whose only job is to pick which server receives the request. It is an infrastructure exception that most site owners never configure.
2. Strictly necessary (paragraph 4)
Storage or access strictly necessary to provide the service the user requested. Schedule A1 now gives examples: protecting information connected with the service, keeping the user's device secure, preventing or detecting fraud, detecting technical faults, authenticating the user, and remembering what the user selected or entered, such as a shopping basket. A login cookie like PHPSESSID qualifies. The ICO is blunt that no advertising purpose is strictly necessary, because necessity is judged from the user's point of view.
3. Statistical purposes (paragraph 5)
Storage or access whose sole purpose is collecting statistical information about how your service or website is used, to improve it. This is the exception for basic analytics cookies, with conditions set out below.
4. Appearance and functionality (paragraph 6)
Storage or access whose sole purpose is adapting how a website looks or works to the user's preferences, or otherwise enhancing its appearance or functionality. A remembered language choice or a dark-mode setting fits. Personalising content from inferred interests does not.
5. Emergency assistance (paragraph 7)
Storage or access that locates a user who has asked for emergency help, so that help can reach them.
Does this cookie need consent in the UK?
What the analytics exception allows
The statistical purposes exception draws the most interest, mostly from site owners who would like to run analytics without a consent prompt. It is narrower than it sounds. In the ICO's words, it is about "how your service is used, not about who uses it": counts of visits, what visitors look at and for how long, and user journeys through your site, so you can decide what to improve.
The ICO adds several limits. Results must be aggregate statistical information you cannot use to identify people, individual-level data must not be kept longer than the aggregation needs, and you must not make inferences or decisions about individuals or groups from it. Advertising is excluded, and the ICO lists ad measurement, frequency capping, ad affiliation and click fraud detection among the advertising purposes that always need consent.
The conditions in paragraph 5
All of these must hold at the same time:
- You provide an information society service, such as a website
- The sole purpose is statistics about how your service or website is used, to improve it
- The information is shared only with someone helping you make those improvements, such as an analytics provider working for you
- Visitors get clear and comprehensive information about the purpose
- Visitors get a simple, free way to object, and have not objected
Miss one and the exception does not apply, so consent is needed. Information a device emits automatically, such as Wi-Fi probe requests, is outside the exception altogether.
Google Analytics under the UK exception
Whether Google Analytics 4 fits depends on how it is set up, and the ICO's guidance does not certify any product. The test is the purpose: the data must serve only the improvement of your site. A property linked to Google Ads, with Google Signals turned on or used to build remarketing audiences feeds advertising, which the exception excludes. A third-party provider is acceptable in principle, as long as it uses the information only to help improve your website or service.
Privacy-preserving analytics tools designed around aggregate data are easier to fit, but the paragraph 5 conditions still apply to them, including the information and the opt-out.
The exceptions at a glance
Only the statistical and appearance exceptions require information and an opt-out. The communication, strictly necessary and emergency assistance exceptions carry neither condition, so a login or basket cookie does not need an opt-out.
| Exception (Schedule A1) | Purpose | Clear information required | Free opt-out required | Examples |
|---|---|---|---|---|
| Communication (para. 3) | Carrying out the transmission of a communication | No | No | Load-balancing session cookie |
| Strictly necessary (para. 4) | Essential for the service the user requested | No | No | PHPSESSID, basket, security and fraud cookies |
| Statistical purposes (para. 5) | Aggregate statistics to improve your service or website | Yes | Yes | Page views, visit length, user journeys |
| Appearance (para. 6) | Adapting appearance or functionality to the user's preferences | Yes | Yes | Language choice, dark mode |
| Emergency assistance (para. 7) | Locating a user who asked for emergency help | No | No | Emergency call location |
What visitors must still be told
Exempt does not mean invisible. For statistics and appearance cookies, visitors need clear and comprehensive information about what is stored or read and why, and a simple, free way to object. The ICO expects that objection to be easy to find and use, not buried in a settings page several clicks deep.
In practice your banner changes shape rather than disappearing: analytics move from an opt-in prompt to a notice with an opt-out, while marketing cookies keep the opt-in. Your cookie policy should say which cookies rely on which exception and how to object. The consent models guide explains how opt-in, opt-out and notice-only banners differ.
How the UK now differs from the EU
The UK and the EU now apply different cookie rules. In the EU, the ePrivacy Directive still requires prior consent for everything except strictly necessary storage and communication, with no general analytics exception. The European Commission's Digital Omnibus proposal of November 2025 would move cookie rules into the GDPR and add some exceptions, but as of October 2026 it is still a proposal under negotiation, as the Digital Omnibus article explains.
| Aspect | UK (PECR with Schedule A1) | EU (ePrivacy Directive) |
|---|---|---|
| First-party analytics | Exempt if aggregate and only for improvement, with information and an opt-out | Consent required |
| Appearance and preference storage | Exempt with information and an opt-out | Consent required unless strictly necessary |
| Maximum fine | GBP 17.5 million or 4% of worldwide turnover | Set by each member state |
| Guidance | ICO guidance on storage and access technologies, finalised 29 April 2026 | EDPB guidelines and national regulators |
For a site with UK and EU visitors, that means two consent models, applied by where the visitor is. Geo-targeting shows each region the banner its rules call for, and the privacy laws by region overview sets out the differences country by country.
Practical steps for your website
- Run a cookie scan to list every cookie and tracker your site sets, including those added by third-party scripts.
- Match each cookie to one purpose and check whether an exception covers it. Anything with an advertising purpose needs consent.
- Review your analytics setup. Turn off advertising links and features if you want to rely on the statistics exception, or keep asking for consent.
- Change your banner: a notice with a clear opt-out for exempt statistics and preference cookies, opt-in for everything else.
- Update your cookie policy to name the exception each cookie relies on and explain how to object.
- Keep records of objections as well as consents, so you can show the ICO the opt-out worked.
Questions about the UK cookie exemptions
Do I still need a cookie banner after the DUAA?
In most cases, yes. Marketing and advertising cookies still need consent, and cookies under the statistics and appearance exceptions need clear information and a simple, free way to object, which a banner or notice usually provides.
Can I run Google Analytics without consent under the UK DUAA?
Only if your setup meets every condition of the statistical purposes exception: aggregate statistics used only to improve your site, no advertising use such as Google Ads links, Google Signals or remarketing, plus clear information and a free opt-out.
Does the analytics cookie exemption apply to marketing cookies?
No. The ICO says the exception does not apply to online advertising, including ad measurement, frequency capping and ad affiliation. Marketing cookies still need consent before they are set.
What happens if a user opts out of exempt analytics cookies?
The exception only applies while the user has not objected, so after an objection you must stop the storage or access for that user.
Do strictly necessary cookies now need an opt-out?
No. Only the statistics and appearance exceptions require information and an opt-out. Strictly necessary, communication and emergency assistance storage needs neither.
Are functional cookies now exempt from consent in the UK?
Cookies that adapt appearance or functionality to a preference the user set are exempt under paragraph 6, with information and an opt-out. Personalisation based on inferred behaviour still needs consent.
Set the UK consent model your banner uses
Kukie.io lets you set region rules per site, so UK visitors can see an opt-out or opt-in banner while EU visitors keep opt-in, and every choice and objection is stored as a consent record.
