What UK cookie consent rules require in 2026
PECR governs the use of cookies and similar technologies that store information on, or access information from, a visitor's device. The ICO's final guidance, updated in April 2026, reflects the changes introduced by the Data (Use and Access) Act 2025.
The important change is that not every non-essential technology now needs consent. PECR contains limited exceptions, including one for statistical purposes where the sole purpose is to collect aggregate information about how a service is used so it can be improved. To rely on that exception, the ICO says users must receive clear information and a simple, free way to object. The exception does not cover profiling, individual tracking or online advertising.
That makes a blanket rule such as 'all analytics must wait for consent' too crude in 2026. The correct treatment depends on what the technology does, why it is used, what data is retained and whether any third party uses the information for its own purposes.
A cookie banner should reflect the tags behind it
A polished banner is useless if scripts load before the visitor's choice is applied. The practical job is to map the site's storage and access technologies, classify their purposes and then make the banner behaviour match that inventory.
Advertising remains the clearest case. The ICO says storage or access used for online advertising requires consent, including advertising measurement and cross-site or cross-device tracking. By contrast, strictly necessary technologies can be exempt where they are essential to provide a service the user has requested.
Consent also needs to remain usable. Visitors should be able to understand the choices, operate the controls by keyboard and revisit their preferences. If the banner itself creates a keyboard trap, hides focus or gives vague purpose labels, it introduces a new accessibility problem on the first layer of the site. Our wider website accessibility guidance explains how WCAG considerations apply to interactive components.
Google Consent Mode is a technical signal, not legal permission
Sites using Google Ads or Google Analytics often need the consent mechanism to pass the visitor's choice into Google tags. Consent Mode v2 includes signals such as ad_storage, analytics_storage, ad_user_data and ad_personalization. Those settings control how Google tags behave, but they do not decide whether your use of a cookie or tag is lawful.
This distinction matters when an older setup says consent is denied in the banner while a tag manager container fires advertising or measurement code anyway. It also matters when a business assumes that Consent Mode itself replaces a consent banner. Google describes Consent Mode as a way to communicate consent status to its tags, and the ICO's rules still determine when consent or an exception is required in the UK.
Where Google advertising is involved, we treat the legal purpose classification and the tag configuration as two connected checks rather than one setting.
What we check on a cookie consent setup
The work starts with the technologies present on the site, not the wording on the banner. We check when tags load, what purpose each one serves, how preferences are stored and whether changing a choice actually changes the site's behaviour.
- Storage and access: cookies, local storage, tracking pixels, scripts and similar technologies are identified and classified.
- Consent behaviour: technologies that require consent are held back until the relevant choice is made, while any claimed PECR exception is checked against its conditions.
- Measurement: where Google tags are used, consent signals are checked so the tag state follows the visitor's choice.
Cookie compliance is not a one-time text exercise. New analytics, embedded media, advertising scripts or plugins can change what the site stores or accesses. If your wider site needs regular technical oversight, see website management.