Probably not the one you have. Since 5 February 2026 UK law lets a small business website run basic, first-party analytics with an opt-out instead of a consent pop-up, and any site that sets no tracking cookies at all needs no banner. You still need consent for advertising, cross-site tracking and anything that profiles individual visitors. The change came from the Data (Use and Access) Act 2025, and most of the cookie advice you will find online was written before it.
This page covers the rules for UK websites as they stand on 22 October 2026, with every rule linked to the regulation itself and to the Information Commission’s guidance, which was last updated on 29 April 2026.
Do I need a cookie banner on my website in the UK?
Only if your website stores or reads something on a visitor’s device for a purpose that is not one of the five exceptions in the law. Regulation 6 of the Privacy and Electronic Communications Regulations, rewritten on 5 February 2026, bans storing or accessing information on someone’s device unless an exception in Schedule A1 applies. Consent is one exception. The other five do not need it.
So the honest answer for a typical trade, practice or shop site is this. If all you run is the site itself, a contact form and privacy-friendly analytics, you can run without a consent pop-up, provided you tell people clearly and let them opt out of the analytics. If you run advertising pixels, retargeting, or session recording tools that watch individual visitors, you need consent before they load.
What are the five exceptions that do not need consent?
Five, set out in Schedule A1 and explained in the Information Commission’s guidance:
| Exception | What it covers | What you must still do |
|---|---|---|
| Communication | Technical storage needed only to carry a communication, such as a load balancer routing your request | Nothing extra |
| Strictly necessary | Things the visitor asked for and cannot have without it: a shopping basket, staying logged in, security, fraud prevention, remembering a cookie choice | Nothing extra |
| Statistical purposes | Aggregate analytics about how your site is used, so you can improve it | Tell people clearly, and give a simple, free way to object |
| Appearance | Adapting how the site looks or works to a visitor’s preference, such as a dark mode or text size setting | Tell people clearly, and give a simple, free way to object |
| Emergency assistance | Finding someone’s location when they ask for emergency help | Nothing extra |
Everything else, including all advertising, needs consent.
Can I use Google Analytics without a cookie banner in 2026?
Possibly, and only under strict conditions. The statistical purposes exception allows a third-party analytics provider, but the Information Commission says the provider must act as your processor, not a joint controller, must only use the data to help you improve your site, and must not link it with other information it holds. The exception covers aggregate figures only: visits per page, scroll depth, device and browser types, where visitors came from, A/B tests, coarse location at city or region level, page speed and bounce rates.
It does not cover advertising measurement, conversions shared with advertising partners, demographic segmentation, recordings of individual sessions, or anything that tracks a visitor across other sites. If your analytics setup does any of those, or your provider uses the data for its own purposes, the exception does not apply and you need consent. Check your provider’s terms and your data-sharing settings against those conditions before switching your banner off. We have not tested any particular tool against them, and you should not take anyone’s word that a product is compliant without reading its terms.
What does “a simple means of objecting” mean?
A way for visitors to say no that is free, easy, and actually works. For the analytics and appearance exceptions you must give clear information about what you are doing and let people object, and if they object you must stop. A link in your footer or privacy policy to a page where analytics can be switched off is the usual approach. If you cannot give people a working way to object, you cannot rely on the exception and you are back to needing consent.
Do advertising and tracking cookies still need consent?
Yes, always. The Information Commission is explicit that online advertising purposes are not exempt and never have been. That covers ad measurement, frequency capping, retargeting, affiliate tracking, conversion tracking shared with ad platforms, social media tracking pixels, and device fingerprinting for advertising. If any of those load on your site, they need consent before they run, which means a banner that blocks them until someone says yes.
Do embedded YouTube videos need consent?
Not if you set them up properly. The guidance says to configure the embed so it does not set anything when the page loads, use the platform’s privacy mode where it has one, and put a line underneath telling people that pressing play will set cookies. Someone who presses play having been told has asked for the content. An embed that sets tracking cookies the moment the page opens does need consent.
Is a cookie that remembers my banner choice allowed?
Yes. A cookie whose only job is to remember someone’s cookie preferences can rely on the strictly necessary exception, even if it lasts a while, as long as the information is used for nothing else.
What happens if my cookie banner is wrong?
The Information Commission can take enforcement action, including fines, against a site that sets non-exempt cookies without consent. In practice the commonest small business mistakes are the opposite way round from what people expect: a banner that asks permission for analytics the site does not run, or a “reject all” button that does not actually stop anything loading. Both are worth checking before anything else.
What should a small business actually do?
- List what your site sets. Open your site in a private browser window and look at the cookies and local storage. You cannot decide what needs consent until you know what is there.
- Remove what you do not use. Old tracking pixels from a campaign that ended are the most common thing we find, and removing them is free.
- Decide which exception each one relies on, using the table above.
- Write it down plainly in your privacy policy, including how to object to analytics.
- Only then decide whether you need a banner, and if you do, make sure “reject” genuinely blocks the scripts.
For what it is worth, this website sets no analytics, advertising or tracking at all, so the only cookie we set remembers your banner choice. Our privacy policy says so, and so does our banner.
This is general information about UK law as it stood on 22 October 2026, not legal advice for your circumstances. If you process sensitive data or run advertising at scale, talk to a data protection specialist.
More on website law and tax: does your website need a privacy policy, the ICO data protection fee, are website costs tax deductible, can you reclaim VAT on a website.
Get web & SEO tips that actually move the needle
Short, occasional emails for business owners: what's changing in Google, how to win more enquiries, and the fixes worth your time. No spam, no jargon.