Tick the cookies your site uses to get a plain-English cookie policy, and find out whether you need a consent banner.
Loading the tool…
UK cookie rules in 2026
| Cookie type | Consent needed in the UK? |
|---|---|
| Strictly necessary (logins, baskets, security) | No |
| Preferences such as language or layout | No, if you explain them |
| Your own analytics for aggregate statistics only | No, if you explain them and offer an opt-out |
| Third-party analytics that share or reuse data | Usually yes |
| Advertising and cross-site tracking | Yes |
| Embedded videos, maps and social posts | Usually yes |
What changed
The Data (Use and Access) Act 2025 added exemptions to the UK’s cookie rules (PECR). They took effect on 5 February 2026. Some low-risk cookies, such as analytics used only for aggregate statistics, no longer need prior consent, but you must still tell people about them and let them opt out. Advertising and tracking cookies still need consent first.
Visitors from the EU are still covered by stricter EU rules, so many sites keep a consent banner for everyone.
Frequently asked questions
Do I need a cookie banner?
If you use advertising, cross-site tracking or most third-party tools, yes. A policy alone isn’t enough.
Does Google Analytics need consent?
Usually, because data is processed by a third party. Check the ICO’s guidance for your setup.
Where should I put the policy?
Link to it from every page, usually in the footer, and from your cookie banner.
Is this legal advice?
No. It’s a starting point; get advice for complex sites.
Sources
Last updated: