UK cookie rules in 2026: what the Data (Use and Access) Act changed
Some cookies no longer need consent, the fines got much bigger, and the ICO has published new guidance. A plain-English summary for small business websites.
On this page 5 sections
Key takeaways
- PECR still requires consent before setting non-essential cookies and similar technologies such as pixels and local storage.
- Since 5 February 2026, low-risk uses such as first-party analytics for improving your own site can run without consent, if you explain them and offer an easy opt-out.
- Advertising, retargeting and cross-site tracking still need opt-in consent before anything is set.
- The maximum fine for breaking PECR rose from £500,000 to UK GDPR levels: £17.5 million or 4% of global turnover.
- The ICO published its final guidance on storage and access technologies on 29 April 2026.
For years the rule in the UK was simple: if a cookie was not strictly necessary, you needed consent before setting it. That is why almost every site shows a banner. The Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025, relaxed that rule for a few low-risk uses and, at the same time, made the penalties for getting it wrong far more serious.
This is a practical summary for small business websites, not legal advice. Check the ICO guidance, or ask a specialist, before changing how your site handles consent.
What still counts as a “cookie”#
The rules cover any technology that stores information on, or reads it from, a visitor’s device. The ICO’s guidance calls these storage and access technologies. That includes cookies, tracking pixels, local storage, device fingerprinting, and scripts or tags that do the same job.
Which uses need consent now#
| Purpose | Typical example | Consent needed? |
|---|---|---|
| Strictly necessary | Shopping basket, login session, security checks | No |
| Statistics to improve your own site | Counting visits and popular pages | No, if you tell people clearly and offer a simple way to object |
| Remembering a visitor’s choices | Language, text size, light or dark mode | No, where it adapts the site to the visitor’s own preferences |
| Advertising and retargeting | Ad network pixels, marketing cookies | Yes, opt-in before anything is set |
| Embedded third-party content | Videos, maps, social feeds | Usually yes, if they set their own non-essential cookies |
The new exemptions only apply when the technology is used solely for that purpose. An analytics tool that also shares data for advertising does not qualify.
What changed, in order#
- 19 June 2025. The Data (Use and Access) Act 2025 became law.
- 5 February 2026. The new exemptions to the cookie consent rule took effect, along with higher maximum fines for breaking PECR.
- 29 April 2026. The ICO published its final guidance on storage and access technologies, replacing its earlier cookie guidance.
The maximum fine for breaking PECR used to be £500,000. It now matches UK GDPR: up to £17.5 million or 4% of global annual turnover, whichever is higher.
A banner that does its job#
- Nothing non-essential loads before the visitor has made a choice.
- “Reject” is as easy to find and press as “Accept”. No pre-ticked boxes.
- Each category explains what it does in plain language.
- People can change their mind later, for example from a link in the footer.
- You keep a record of consent and refresh it when your cookies change.
- Your cookie policy lists what you use, why, and for how long.
- Third-party embeds load on click, or only after consent.
What we do on this site#
This website uses no advertising or analytics cookies. The only thing it stores is your light or dark theme choice, in your own browser, and only after you press the theme button. That is the simplest compliance strategy there is: collect only what you actually use.
Before buying a consent platform, list every script on your site and ask whether you still need it. Removing a tool is often cheaper than managing consent for it, and it makes the site faster too.
Sources and further reading
- Data (Use and Access) Act 2025 — legislation.gov.uk legislation.gov.uk
- Direct marketing and privacy and electronic communications — ICO ico.org.uk
- Current UK cookie laws: insights from the final ICO guidance — Bird & Bird twobirds.com
- Storage and access technologies: ICO publishes updated guidance — Brodies brodies.com