For years, the safe shorthand for many UK website owners was simple: analytics cookies are optional, so they should not run until the visitor has consented. That is no longer the whole picture.
Changes introduced by the Data (Use and Access) Act 2025 created a new statistical purposes exception in the Privacy and Electronic Communications Regulations (PECR). The change came into force on 5 February 2026, and the Information Commissioner's Office (ICO) finalised its updated storage and access technologies guidance in April 2026.
The important word is exception. This is not a blanket rule saying that analytics can now run without consent. Whether it applies depends on what the technology does, why it is being used and what happens to the information it collects.
What does the statistical purposes exception allow?
Under the ICO's current guidance, consent is not required under PECR where storage or access on a user's device is used solely to collect statistical information about how a website or online service is used, with a view to improving it. The resulting information must be aggregate statistical information rather than something used to identify, track or make decisions about individual visitors.
The ICO gives examples that may fit the exception when used in this limited way. These include measuring page visits, average scroll depth, device or browser types, how visitors reached the site, page-loading performance, bounce or exit rates and some A/B testing.
That makes the exception useful for ordinary questions such as: Which pages are being visited? Are people reaching an important part of the site? Are visitors encountering slow pages? Which areas appear to need improvement?
But qualifying analytics must be about how the service is used, not who is using it. That distinction is where many real-world setups become more complicated.
What still needs consent?
The exception does not cover every activity that happens to appear in an analytics dashboard. The ICO says consent is still required where storage or access technologies are used to monitor or track individual visitors, profile people or categories of people, follow them across services, or support online advertising.
Advertising measurement is an important dividing line. Connecting a visitor identifier to a purchase and sharing that conversion with an advertising partner is not the same purpose as producing aggregate statistics to improve your own website. Nor does the exception cover measuring whether someone viewed or clicked an advert for advertising-performance purposes.
This means labels can be misleading. A tag called "analytics", a report called "conversions" or a familiar analytics product does not determine whether the exception applies. The actual configuration and purpose do.
Using a third-party analytics provider does not automatically rule it out
The ICO allows for the statistical purposes exception to be used with a third-party analytics provider, but there are conditions. The provider must be acting to help improve your website or service, and information collected through the storage or access cannot be shared for unrelated purposes.
You also need to tell users about the third party and explain what it does with the information. Where personal data is involved, UK GDPR obligations still apply even if the PECR consent exception is available. The ICO's guidance on PECR and UK GDPR makes clear that meeting a PECR exception does not make the wider data-protection questions disappear.
So it would be risky to decide that a particular analytics product is "consent-free" in all configurations. The sensible question is whether your specific implementation satisfies the exception.
You still need to tell people and let them object
Running qualifying statistical analytics without prior consent does not mean running it silently. To rely on the exception, the ICO says users must receive clear and comprehensive information about the purpose of the storage or access and have a simple, free way to object.
That changes the interaction from an opt-in consent requirement to an objection mechanism for the qualifying activity, but transparency still matters. It may also mean your consent platform, privacy information or analytics controls need adjustment rather than simply being removed.
And if the same technology serves more than one purpose, the exempt purpose does not cover the others. The ICO specifically warns that where one purpose meets an exception but another does not, consent is required for the non-exempt use.
Before changing your cookie banner, inspect what is actually running
For most businesses, the practical task is not to ask whether analytics needs consent in the abstract. It is to understand the live setup.
- Identify the technologies: check analytics tags, tag managers, advertising pixels, heatmaps, session-recording tools and anything else collecting behavioural information.
- Record each purpose: distinguish aggregate website improvement from advertising, profiling, remarketing, individual tracking and cross-service measurement.
- Check what is retained: the ICO says individual-level information should not be kept longer than necessary for the aggregation process when relying on the statistical purposes exception.
- Check third-party use: establish who receives the information and whether they use it only to assist with improving your website or service.
- Review transparency and objections: make sure people are clearly told what happens and can object easily where the exception is being relied upon.
- Keep consent for non-exempt purposes: advertising and other tracking should not start merely because statistical analytics can run without prior consent.
If you are not sure what external tools are currently loading, Roled's guide to reviewing third-party website scripts is a useful place to start. Tracking setups tend to grow over time, particularly when different campaigns, agencies or teams have added tags.
The 2026 change gives UK website owners more flexibility, but it rewards precise configuration rather than broad assumptions. Some genuinely statistical analytics can now operate without prior PECR consent. That is very different from saying every analytics tool can bypass consent.
Before changing a banner or allowing a tag to load automatically, work out what that tag really does. In this area, the purpose behind the data is more important than the label on the dashboard.
