UK analytics cookies need no consent if they only produce aggregate statistics

Since 5 February 2026, a website or app in the UK can set analytics cookies without asking the visitor first 2. The exemption covers analytics that only counts how your product is used, run by you or by a vendor acting only on your behalf, and you still have to tell visitors and give them a free way to say no 1. Your banner's analytics toggle can be that way to say no, switched on by default. The exemption is UK law, so it is written for UK websites and apps; if your company is based in the EU, assume your own country's consent rule still covers your UK visitors. Before you switch the toggle on, check four things about each analytics tool. They are my practical version of the law's five conditions and the ICO's rule on keeping data:

• whether it records individual sessions,
• whether it ties events to a logged-in user,
• whether the vendor, or an ad platform, uses the data for its own purposes,
• and whether it keeps per-visitor data after counting it.

If any answer is yes, that tool still needs consent in the UK. In my reading that rules out the two most common setups: Google Analytics, whose shortest setting keeps per-visitor data for two months, and PostHog with logged-in users identified. For visitors in the EU, nothing has changed yet.

What did the UK change on 5 February 2026?

The UK's cookie rule is in the Privacy and Electronic Communications Regulations, usually shortened to PECR. A 2025 UK law, the Data (Use and Access) Act, added an exemption for analytics to it, in force since 5 February 2026 1 2. The exemption applies only when all five of these conditions hold 1:

1. You provide an online service. A website or app you run as a business qualifies.
2. Statistics to improve the service is the sole purpose. The cookie or script exists only to collect statistics about how the service or website is used, with a view to improving it.
3. Nobody else uses the data for their own ends. You may share what you collect only with someone who helps you make those improvements.
4. The visitor is told. They get clear and comprehensive information about the purpose.
5. The visitor can object, for free, and has not. They are given a simple means of objecting, and they did not use it.

The fines changed on the same date. The ICO, the UK's data protection regulator, now enforces PECR under the same penalty regime as the UK GDPR 2 4. A breach of the cookie rule now sits in the higher penalty tier 4: for a business, up to £17.5 million or 4% of worldwide annual turnover, whichever is higher 5.

What does the ICO count as "statistical purposes"?

Statistics about visitors as a group, such as counts and averages, and nothing that describes a single visitor. The ICO finalised its guidance in April 2026, and it reads condition 2 narrowly: the exception "is about how your service is used, not about who uses it", and it "is not for identifying, tracking or monitoring people or groups of people who use your service" 3.

The ICO gives examples that are likely to qualify, as long as the output is aggregate statistics 3:

• A/B tests comparing two versions of a page
• Location at city or region level, coarse enough that nobody is identified
• Total visits to each page, to understand user journeys
• How visitors arrived, such as the referring URL or an email campaign

The ICO also limits how long you keep the raw data. It notes that this kind of analytics is likely to collect individual-level information first. You must then aggregate it and keep the individual-level data only as long as the aggregation needs. The ICO suggests daily aggregation may be appropriate, and it says that keeping the individual-level information after aggregating it takes you outside the exception 3.

The guidance leaves one question open that matters for almost every analytics tool. Most tools set a visitor ID that lasts across visits, and the ICO does not say whether that fits the exemption. Its consent list includes "connecting a visitor ID to their site activity", with an advertising example 3. My reading is that a visitor ID used only to count returning visitors, and deleted with the raw data, is defensible, and that one kept for months to follow a visitor's history is not.

The exemption only removes the need for consent under PECR. Where the records are personal data, the UK GDPR still applies to them as usual 3.

So look at what your analytics tool keeps once the counting is done. If it keeps counts and averages, the exception can apply. If it keeps a list of visitors and what each of them did, it cannot.

Which analytics setups still need consent in the UK?

Each of the following needs consent for that tool, even where the rest of your analytics qualifies.

Session recordings

Tools that replay a visitor's session (mouse movements, clicks, scrolling, typing) produce exactly the record the exception excludes. The ICO lists "logs or recordings of individual visitors to your website and the actions they took" as needing consent, unless they are kept for security 3.

Events tied to a logged-in user

Product analytics often links events to an account. PostHog's documentation on identify() describes the standard pattern: once a visitor logs in, their anonymous history is merged into an identified person, keyed on something stable such as a user ID or an email address. That is useful for per-account funnels and for knowing which customer is stuck. It is also a record of who did what, which the ICO puts on the consent side of the line 3.

A vendor that also uses the data for itself

Condition 3 allows a vendor only if it helps you improve your service. The ICO adds that the vendor must act as your processor, and "not a joint controller" that decides its own uses 3. In some tools this is a setting you can check. In Google Analytics, turning on the "Google products & services" data sharing setting lets Google use the data to improve its own products, and Google's help page on data sharing settings says that for that data Google is "an independent controller", meaning Google decides its own uses for it. With that setting on, condition 3 fails. Google Analytics also fails on retention (below), but the same question applies to every analytics vendor you use: check whether its terms let it use your data for itself.

Ad conversions and audiences

The exception "doesn't apply to things like online advertising" 3. Measuring whether an ad led to a sign-up, or passing a visitor ID and their purchase to an ad platform, needs consent. So does using your analytics tool to connect a visitor's journey on your site to an ad they clicked earlier 3.

Raw events kept for months

Google Analytics shows the problem. Its standard reports are aggregated counts, and Google's data retention page says the retention setting does not affect them. The setting governs each visitor's user-level and event-level data, and the shortest option is two months. So the counting is done, and the per-visitor data stays for at least two more months. Keeping individual-level data after aggregating it is what the ICO says takes you outside the exception 3. The ICO sets no fixed number, so this is my reading: I would not rely on the exemption for Google Analytics with its event-level data kept for two months or more, and I would keep asking UK visitors for consent for it.

Does this change anything for visitors in the EU?

No. The UK exemption is UK law. Visitors in the EU are covered by the EU's cookie rule, Article 5(3) of the ePrivacy Directive, as each member state has implemented it, and that rule allows storing or reading information on a device "only" with consent or where it is necessary for a few specific purposes 6. Analytics is not one of those purposes in the Directive itself.

Some EU regulators have built their own narrow routes. France's regulator, the CNIL, for example, exempts audience measurement that meets seven conditions, which I walked through in my post on whether legitimate interest covers product analytics. The EU's proposed cookie reform would exempt some aggregated audience measurement too, but it is still a proposal.

If your company is based in the EU, assume your own country's consent rule still covers your whole site, UK visitors included, and that the UK exemption probably does not help you. Which country's cookie law governs a visit depends on where the company is based and whom its product is aimed at, so check your home country's rule before relying on the UK one.

What should you do if your product has UK visitors?

You have two options.

• Keep one consent prompt for everyone. This meets the rules in the UK and the EU, and it is what I would do unless the next option clearly fits. The cost is that UK visitors who decline are missing from your analytics.
• Switch the analytics toggle on by default for UK visitors only. I would only do this as a UK company with a mostly UK audience and an analytics tool that passes all four checks from the top of this post. A tool that falls outside the exemption and runs without consent breaks PECR, with the fine ceiling described above.

For the second option, do these five things first.

1. List what your product stores on the device. Open your site with the browser's developer tools on the Application tab and note every cookie and local storage entry, then match each one to the tool that set it.
2. Sort each tool into three groups. Strictly necessary (login, security, fraud checks), aggregate statistics that pass all four checks, and everything else. Session replay, identified product analytics, ad pixels, and any tool that keeps per-visitor data for months after counting it go in the third group, so they keep the consent prompt.
3. Check your vendor settings. Confirm the analytics vendor is your processor under its terms, turn off any data sharing that lets it use the data for itself, set retention as short as the tool allows (if the shortest setting is still months, the tool stays behind consent), and check how the data leaves the UK if the vendor stores it elsewhere.
4. Give UK visitors a way to object. The ICO suggests an analytics toggle in your cookie settings, on by default, that the visitor can switch off at any time 3. Once a visitor switches it off, the script must stop storing or reading anything on their device.
5. Update your cookie notice and privacy policy. Say what the analytics measures, that a vendor runs it and what the vendor does with the data, and how to object 3.

Then keep the sorting current. A compliant setup can stop being compliant when a later pull request adds a replay script or an ad pixel to the same page. That is the kind of change Lawcel, a compliance tool that reads your code changes and flags when your legal documents need updating, is built to catch.