Do you need a cookie consent banner?
Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025
When this applies
Websites using advertising, tracking, or other non-essential cookies likely need a compliant consent mechanism, and implied consent is not sufficient. The Data (Use and Access) Act 2025 added a narrow exemption from 5 February 2026 for first-party analytics used purely to collect statistics to improve your own service. The ICO's final guidance of 29 April 2026 reads that exemption strictly, so the data must stay under your control, and analytics that also feed advertising or profiling still need consent.
When it does not apply
Cookie consent rules apply to websites and apps. Not applicable if you have no website.
What is at stake
Fines up to £17.5M or 4% of global turnover, raised from £500K on 5 February 2026 by the Data (Use and Access) Act 2025. The higher cap applies to conduct after that date.
What to do
Implement a cookie consent banner that blocks non-essential cookies until the user accepts. Strictly necessary cookies (e.g. login sessions) do not require consent, and since 5 February 2026 nor do genuinely first-party analytics cookies used only to gather statistics to improve your own service. That analytics exemption is conditional, you must still tell users about the cookies and give them a simple, free way to object, so it removes the consent pop-up, not the disclosure.
Where to get this sorted
Add a cookie consent banner (Termly) →Check all 33 regulations for your business
This is one of 33 checks getsorted runs. Answer around 12 questions and see your full compliance picture in three minutes. Free, no account.
Check your business →Reviewed: 2026-09-13 · Source: official guidance