Privacy-friendly analytics and cookie consent (UK and EU, 2026)

Last checked: 12 November 2026. Plain-language guidance, not legal advice.

The basic rule

In both the UK and the EU, storing or reading information on a visitor's device, through cookies, pixels, local storage and similar technologies, needs consent unless an exception applies. Strictly necessary cookies, such as those that keep a shopping basket or a login working, have always been exempt.

What changed in the UK in 2026

The Data (Use and Access) Act 2025 added new exceptions to the UK's cookie rules (PECR), in force from 5 February 2026. The most relevant is a statistical purposes exception: storage or access used only to produce aggregate statistics about visitors in order to improve the service. The ICO published its final guidance on these technologies in April 2026.

The conditions are strict:

• It must be solely for aggregate statistics to improve your own service.
• Visitors must be told clearly and given a simple, free way to object.
• Data used for advertising, profiling or sharing for other purposes does not qualify. Advertising cookies still need consent.

Whether a particular tool qualifies depends on how it is configured. A tool that also feeds advertising, or shares data for the provider's own purposes, is unlikely to qualify.

The EU position

In the EU, the ePrivacy rules still require consent for non-essential cookies, including most analytics, with national differences. If you serve EU visitors, plan for consent.

Consent mode

Google's consent mode lets Google tags adjust their behaviour to each visitor's choice, using signals for analytics storage, ad storage, ad user data and ad personalisation. In a basic setup, Google tags do not load until the visitor responds to the banner. In an advanced setup, tags load and send cookieless signals when consent is denied. Choose deliberately and describe it in your notices.

Privacy-friendly analytics options

Compliance checklist

• List every cookie, pixel and script on the site, and what each is for.
• Block advertising and non-essential tracking until consent where required.
• If you rely on the UK statistical exception, make sure the tool is used only for aggregate statistics, tell visitors, and offer a clear opt-out.
• Give equal prominence to accept and reject on your banner.
• Configure consent mode if you use Google tags.
• Keep your cookie and privacy notices accurate.
• Re-check after every new tool or website change.

The VAULT Business Audit shows which analytics and consent tools it can detect on your site.