UK Cookie Rules Changed in 2026. Is Your Tracking Built to Use Them?
The UK Relaxed Its Cookie Rules. Most Tracking Setups Can't Take Advantage.
For years, UK organisations have lived with a measurement problem. Opt-in cookie consent meant that a large share of visitors were never counted, attribution was incomplete, and marketing decisions were made on partial data.
In 2026, the rules changed. Amendments to the Privacy and Electronic Communications Regulations (PECR) made by the Data (Use and Access) Act 2025 came into force on 5 February 2026, and the Information Commissioner’s Office (ICO) published its final guidance on 29 April 2026 (Bird & Bird, 27 May 2026). For the first time in years, some analytics cookies no longer need opt-in consent.
But there is a catch, and it is technical rather than legal. The new exemptions only apply if your tracking is built in a particular way. For many organisations, the tag setup they have built over the years doesn’t qualify.
This article is general information, not legal advice. Seek advice on how the rules apply to your specific setup.
What actually changed
Before the change, cookies and similar technologies, including tracking pixels, scripts and tags, needed opt-in consent unless they were used solely to transmit a communication or were strictly necessary for a service the user requested.
The Act added new exemptions. Opt-in consent is no longer required for cookies used solely for statistical purposes, such as aggregated visit counts and page interaction data, or solely to remember a user’s appearance and functionality preferences, such as language. In both cases, users must receive clear, comprehensive information about each cookie’s purpose and a free, simple way to opt out.
According to the ICO’s final guidance, as summarised by Bird & Bird, this means cookies used solely for these purposes can be switched on by default, with users able to switch them off through the cookie banner. Websites must respect that choice, and should not rely on browser settings as a signal of whether a user objects.
The catch: "solely" means solely
The most important word in the exemption is “solely”. The ICO’s guidance is clear that the exemptions are purpose-specific. If a cookie or tag is used for any non-exempt purpose, such as advertising, cross-site tracking, or building profiles for targeting, it still needs consent. Bird & Bird note that relying on more than one exemption for the same cookie is also challenging, because each exemption applies only where the relevant purpose is the cookie’s sole purpose.
This is where most real-world setups fall. A typical marketing site loads a mixture of analytics tags, advertising pixels, heatmaps, and third-party scripts through a tag manager, many of which collect data for several purposes at once and share it with platforms that use it for their own ends. Very little of that is “solely” statistical.
Bird & Bird’s practical takeaway is that organisations wanting to use the exemptions will need to consider how their multi-purpose cookies affect the exemptions available, and “any architectural changes that may be required”. In other words, this is an engineering job.
What a compliant, useful measurement setup looks like
The organisations that benefit from the new rules will be the ones that separate their measurement by purpose, and can prove it.
Separate statistical measurement from advertising. Isolate first-party analytics used only to understand how your site performs from advertising and retargeting tags, with no onward sharing that would add a non-exempt purpose.
Take control of data flows. Server-side tagging routes data through infrastructure you control before anything reaches third parties. That lets you decide exactly what is collected and where it goes, minimise what leaves your environment, and enforce users’ choices in one place.
Make opt-outs actually work. When a user switches statistical cookies off, they must stop firing. That requires your consent platform and your tagging to be wired together properly, not just a banner that records a preference nobody acts on.
Keep consent for everything else. Advertising, retargeting and cross-site tracking still need opt-in consent. A clean architecture makes that boundary clear, not blurred.
Document what every tag does. An inventory of each cookie and tag, its purpose, the data it collects and where that data goes is what lets you claim an exemption with confidence, and defend it if the ICO asks.
One important point: server-side tagging is not a way around the rules. Where it still involves storing or accessing information on a user’s device, PECR applies, and UK GDPR applies to any personal data you process, wherever the processing happens. Its value is control and transparency, not avoidance.
Why this is also an attribution opportunity
Rebuilding measurement around purpose is not only about compliance. Organisations that untangle their tracking usually end up with better data: fewer duplicated events, cleaner attribution, faster pages because fewer third-party scripts load in the browser, and a single source of truth for marketing performance instead of a dozen platforms each claiming credit.
Better page performance also helps Core Web Vitals, which affects both user experience and search visibility. The same work that makes your tracking compliant often makes your site faster.
What may change next?
The Act also allows the government, after consulting the ICO and others, to make further changes to the UK’s cookie rules, and the ICO has published advice to government on online advertising. Organisations that build a clean, purpose-separated measurement architecture now can adapt to future changes through configuration, rather than starting again.
Where Human fits
Server-side tracking, attribution engineering and performance optimisation are core parts of what we do. Human provides senior engineers who audit your existing tag and cookie setup, map every data flow, and re-architect measurement so statistical analytics, advertising and consent are cleanly separated and properly enforced. We work remotely, inside your systems, and can deliver directly or white-label for agencies that want to offer this capability to their own clients.
A practical next step
Open your tag manager and list every tag that fires on your site. For each one, write down what it is for, what data it collects and who receives it. If more than a handful have more than one purpose, or nobody knows what some of them do, your setup is unlikely to qualify for the new exemptions, and is probably slowing your site down too.
Frequently asked questions
Do analytics cookies still need consent in the UK?
Not always. Since 5 February 2026, you can use cookies used solely for statistical purposes without opt-in consent, provided users get clear information and a free, simple way to opt out. Analytics that also serve advertising or other non-exempt purposes still need consent.
When did the UK cookie rules change?
The relevant amendments made by the Data (Use and Access) Act 2025 took effect on 5 February 2026. The ICO published its final guidance on 29 April 2026.
Can cookies be on by default now?
Cookies used solely for statistical or appearance and functionality purposes can be switched on by default, with users able to switch them off through the cookie banner. Other non-essential cookies still need opt-in consent.
Does server-side tracking avoid the need for consent?
No. Server-side tagging gives you more control over what data you collect and share, but PECR still applies where information is stored on or accessed from a user’s device. UK GDPR applies to personal data wherever it is processed.
Can Human rebuild our tracking under our agency’s brand?
Yes. We work white-label for agencies, delivering server-side tracking and attribution engineering under your brand while you keep the client relationship.
Want measurement that is compliant, accurate and fast?
Get in touch: david@designbyhuman.com.
tags:
News & Resources
