When Can UK Websites Use Analytics Without Cookie Consent?

ON THIS PAGE

For years, UK website owners assumed that analytics cookies are optional, thus, they need Cookie Consent. Recently, the Data (Use and Access) Act 2025 (DUAA) changed that assumption by introducing a new statistical purposes exception in the Privacy and Electronic Communications Regulations (PECR).

The relevant DUAA provisions came into effect on 5 February 2026, and the Information Commissioner's Office (ICO) finalized its updated guidance on storage and access technologies on 29 April 2026. 

The change does not mean that analytics can now run without consent. PECR Cookie Consent rules state that the analytics cookie exemption applies only to analytics used solely to produce statistical information about how a website is used, and it depends on what the technologies do and their purposes.

The blog explains the UK Cookie Consent exemption, when UK websites use analytics without Cookie Consent, what safeguards must be met, and when consent is still needed.

What Is the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 (DUAA) is a UK law that was enacted to reform data protection, digital verification, and public data sharing.

DUAA became law in the UK on 19 June 2025.

It is being implemented in stages. The final provisions came into force on 19 June 2026.

You can review official details and regulatory guidance on the ICO Legislation Hub.

DUAA introduced these key changes for organizations:

  • Cookie consent changes
    Removes the need for user consent for low-risk tracking technologies used for basic statistics, appearance, or emergency help.
  • Subject Access Requests (DSARs)
    Under the UK’s DUAA, DSARs allow individuals to ask an organization for a copy of their personal data and details on how it is processed. DUAA introduced a "stop the clock" feature that allows organizations to pause the one-month response deadline if a request is broad or unclear. However, DUAA limits data searches only to "reasonable and proportionate" data, reducing the need for costly or excessive internal investigations.
  • Complaints process
    Requires companies to formally acknowledge privacy complaints within 30 days.
  • Legitimate interests
    Creates clear, presumed grounds for data use in crime prevention and fraud reduction.

When Can UK Websites Use Analytics Without Cookie Consent?

A UK website may be able to use analytics without obtaining prior cookie consent where it falls within PECR's statistical purposes exception.

According to the ICO analytics cookies guidance, UK websites could use analytics to create of aggregate statistics that help an organization understand how visitors use its website or service, when those insights are needed for site or service improvements.

To qualify for an exemption, an analytics cookie must meet these conditions:

  • A cookie can solely be used to understand how visitors use your own website, not for advertising or profiling;
  • Analytics does not follow users across other websites or apps;
  • Websites cannot share the data with third parties; and
  • Visitors must still be able to opt out, even under the exemption.

 

For example, you could potentially use analytics for UK websites without cookie consent for:

  • Counting total page views and visits;
  • Measuring page load speeds and performance;
  • Measuring interactions with page content;
  • Understanding how visitors arrived at the website;
  • Tracking high-level, raw geographic data, like country or region;
  • Monitoring user’s device, browser, or operating system types;
  • Running simple A/B testing.

 

Thus, website operators need to evaluate whether analytics qualify for the exemption. To use analytics cookies without consent in UK, websites must examine the tool's actual configuration, the data collected, and any secondary uses made by the analytics provider.

With CookieScript Cookie Scanner, you can scan your website for cookies and detect all website trackers, including analytics, that are running on your website:

What Conditions Must Be Met for analytics cookies to be exempt from Consent?

To rely on the statistical purposes exception rather than obtaining prior consent, websites need to meet several requirements.

  • Purpose of collecting or storing user information
    The sole purpose of accessing information on the users’ devices must be to collect statistical information about how the service or website is used, that could be used to improve that service or website. Websites need consent for collecting data for advertising, profiling or other non-exempt purposes.
  • Do not identify individuals
    Organizations should collect aggregate information that cannot be used to identify individuals. Individual-level information is allowed to be collected temporarily to produce those statistics, but do not retain longer than necessary for the aggregation process.
  • Be transparent
    Organizations should explain to visitors what technologies a website uses, what they do, and why they are used. The Privacy Policy should cover all technologies used for analytics.
  • Provide an opt-out option
    Analytics can potentially operate without a prior opt-in, but users must still be able to opt out easily. Websites must give users a simple and easy way to object to analytics. The ICO says organizations could use an existing cookie banner for opting out. Statistical-purpose analytics could be initially enabled but should easily be switched off.
  • No data sharing
    You cannot share the raw analytics data with third parties for their own use.
  • Proper configuration of analytics providers
    You may use a third-party provider for analytics, but you can share the information with it only to improve the website or service. The provider cannot use this information for advertising, profiling or unrelated purposes. You can use popular tools like Google Analytics 4 (GA4) only if you manually turn off data sharing, disable Google signals, and restrict data retention.

 

Note that UK GDPR still applies. If the analytics involves personal data, UK GDPR still applies. The organization must have an appropriate lawful basis and comply with UK GDPR requirements such as transparency, data minimization, security and data protection by design. The ICO confirms that where a PECR exception applies, the appropriate UK GDPR lawful basis does not necessarily have to be consent.

When Does Analytics Still Require Consent?

Consent for analytics cookies on UK websites is still required where analytics are used for identifying, monitoring, profiling or tracking individual visitors.

The new exception doesn’t mean that analytics could be run without consent.

UK analytics cookie consent is still required when analytics technologies are used to:

  • Monitor or track individual visitors;
  • Profile people or categories of people,
  • Perform cross-site or cross-service monitoring;
  • Identify individual people;
  • Support online advertising.

 

For example, suppose an e-commerce website records an analytics identifier to calculate page views. If that identifier is used to improve the service, aggregated analytics could be used without consent. However, if the identifier is linked to purchases and shared with an advertising platform so that the platform can measure campaigns or retarget customers, this falls outside the exemption.

Particular care is therefore needed with analytics platforms that support multiple functions. You may use third-party providers only if you manually turn off data sharing, disable advertising tags, and restrict data retention.

If you use analytics for statistics and also for other purposes, you still need consent for the non-exempt data access.

Can I Use Google Analytics 4 Without Consent For UK Websites?

Google Analytics 4 qualifies for the analytics cookie exemption if you manually disable data sharing with Google, turn off Google signals, and configure data retention correctly.

By default, Google Signals are often enabled and Google Analytics 4 (GA4) shares data with Google for advertising purposes. Sharing data with a third party without consent is not allowed. Thus, if you use GA4’s default setup, GA4 4 doesn’t qualify for the analytics cookie exemption.

GA4 qualifies for the analytics exemption if you configure it correctly.

To configure GA4 for the exemption, perform these steps:

  1. Go to Admin > Data Settings > Data Collection, and turn off “Google signals data collection.”
  2. Go to Admin > Data Settings > Data Sharing, and disable all data sharing with Google products and services.
  3. Then, go to Admin > Data Settings > Data Retention, and set the retention period to the minimum: months for event data.
  4. Lastly, review any other services connected to your GA4 property. None of them should receive user data from GA4.

Do I Need a Cookie Banner If I Only Use Google Analytics?

If your GA4 is correctly configured to run analytics only to improve your site’s services in the UK, you may not need a consent banner. However, you still need a banner if you use analytics for other purposes, such as monitoring users’ devices, advertising or profiling.

Even if you use Google Analytics for the PECR exemption, you still need to tell visitors what analytics tools you are using and why. To inform users, you could use a cookie notice (users no longer need to click ‘Accept’, the banner is used to inform), or a Cookie Policy.

If your site uses any other non-essential cookies such as tracking pixels (e.g., Meta pixel, LinkedIn pixel), local storage, live chat, retargeting, or other scripts, you need consent. In practice, most small business sites usually use some trackers like Hotjar for heatmaps or the Meta Pixel for ads alongside GA; thus, UK sites therefore still need consent banner.

How Can UK Websites Comply with ICO?

If you want to use analytics for UK websites without consent, make sure your analytics tools qualify for the PECR exemption and are used solely for your site’s or service’s improvement.

To qualify for the exemption and comply with ICO, use this practical guide:

  1. Perform your site’s audit
    Identify all cookies, analytics tags, tag managers, advertising pixels, heatmaps, session-recording tools, SDKs, and other storage or access technologies to identify all technologies that could be collecting behavioral information on your site.
  2. Map each technology to its actual purpose
    If analytics is intended to operate without prior consent, configure it only to collect statistical measurements for improving the website or service. Separate functions related to advertising, remarketing, personalized content, cross-site tracking, or individual profiling.
  3. Make retention periods short
    When relying on the statistical purposes exception, do not keep individual-level information longer than necessary for the aggregation process. Check retention periods and ensure they are short, no longer than necessary.
  4. Review their analytics providers
    Establish who receives the analytics information and what they do with it. Sign contracts or adjust technical settings that prevent third parties from using exempt analytics information for their own unrelated purposes.
  5. Be transparent with users
    Prepare cookie and privacy information that clearly explains what statistical analytics your website uses and why, what it measures, whether any third party receives the information, whether it uses the information for other purposes, and how visitors can object.
  6. Implement an opt-out mechanism
    Provide an appropriate mechanism and honor a user's objection by stopping the relevant data access.
  7. Update your site’s setup regularly
    Review your setup regularly or whenever you add new tags, change analytics settings, or integrate advertising features. A configuration that qualifies for the exception today could fall outside it if the same identifiers are later used for unrelated purposes, such as advertising or profiling.
  8. Obtain consent for non-exempt purposes
    You still need prior consent for advertising and other tracking tools that run on your website.

 

The practical effect of the Data (Use and Access) Act 2025 doesn’t therefore mean you could use analytics without consent. Instead, it creates an opportunity for genuinely statistical, privacy-conscious website analytics to operate without prior PECR consent, provided visitors are properly informed, can easily object, and the information is not used for other unrelated purposes, such as profiling or advertising.

If you use cookies or analytics tools for other purposes, you still need a Cookie Consent banner to obtain user consent. Use CookieScript CMP to manage user consent.

CookieScript CMP has the following features:

 

Register for free Show pricing plans

Frequently Asked Questions

When can UK websites use analytics without cookie consent?

A UK website may be able to use analytics without obtaining prior cookie consent for the creation of aggregate statistics that help an organization understand how visitors use its website or service, when those insights are needed for site or service improvements.

What conditions must be met for analytics cookies to be exempt from consent in the UK?

The analytics must be used only for statistical purposes related to improving the website or service. Users must be given clear information about analytics, a simple and free way to object, and the data must not be repurposed for advertising, profiling, cross-site tracking, or other unrelated purposes.

When do analytics cookies require consent in UK?

Consent for analytics cookies on UK websites is still required where analytics are used for identifying, monitoring, profiling or tracking individual visitors. Businesses should use a CMP like CookieScript to deliver a Cookie Banner and obtain cookie consent.

Does the PECR statistical purposes cookie exception apply to all UK websites?

PECR cookie consent exception applies to UK-based websites where it falls within PECR's statistical purposes exception. If your website targets users in the EU or EEA, EU Cookie Law (eprivacy Directive) applies, and you still need obtain cookie consent from users.