Last Updated on July 1, 2026
The law changed, but probably not in the way you have been told.
Since 5 February 2026, the Data (Use and Access) Act lets some UK websites run basic analytics without asking for consent first. That sounds like a gift. No more banner blocking your homepage, no more lost visitors clicking away before they read a word.
Then the advice started doing the rounds. “Cookie banners are dead.” “Rip it out.” “The government scrapped the rules.” Most of it is wrong, and acting on it could cost you a great deal more than the banner ever did.
Here is what actually changed, and what to do about it.
What actually happened
The new rules created a narrow exemption. If the only thing your analytics does is measure how people use your site so you can improve it, you may be able to run it without a consent banner.
That is the whole exemption. It is for performance and statistics, nothing else.
To qualify, your analytics has to tick every box:
| Condition | What it means |
|---|---|
| Statistics only | The data is used to understand and improve your site, not to target ads |
| No third-party sharing | The data does not get passed to advertising platforms |
| Opt-out available | People can still turn it off |
| No marketing use | Nothing feeds remarketing, lookalike audiences, or ad targeting |
Miss one box and the banner comes straight back.
Why most small business sites do not qualify
Here is the part the headlines skip.
A typical small business website is not running analytics on its own. It is running Google Analytics next to a Facebook Pixel for ads, maybe Hotjar for heatmaps, maybe a remarketing tag from a previous agency that nobody remembers installing.
Any one of those pulls you straight back into needing consent. The Facebook Pixel feeds advertising, so it does not qualify. Most default Google Analytics setups share data in ways that do not qualify either.
So the realistic position for most owners is simple. The law technically changed. Your obligations did not. You still need the banner, because you are still running things the exemption does not cover.
The mistake to avoid
The mistake is treating a narrow legal change as a green light to remove protection you still need.
PECR breaches, which include getting cookie consent wrong, now carry fines of up to £17.5m or 4% of global turnover. That is the same exposure as a serious data breach. No small business is going to be fined £17.5m for a cookie banner, but the Information Commissioner’s Office does act on complaints, and “I read online that banners were scrapped” is not a defence.
Removing your banner to chase a few extra clicks, when your site does not qualify, is the definition of fixing the wrong thing.
What to do instead
Start with structure, not tactics.
First, find out what is actually loading on your site. Most owners have no idea. A free browser extension or a quick look in your tag manager will show you every tracker firing. You cannot make a decision about consent until you know what you are consenting to.
Second, sort your trackers into two piles. One pile is pure site analytics. The other is anything touching advertising, remarketing, or third parties. If the second pile has anything in it, keep your banner. It is that blunt.
Third, if you genuinely only run basic analytics and nothing else, then you have a real decision to make, and it is worth getting a short professional check before you remove anything. The ICO has said small business guidance is coming later this year, so there is no rush.
The takeaway
The cookie law got slightly more relaxed for a small number of very simple sites. For most UK businesses, nothing has changed except the noise around it.
Do not rebuild your site around a headline. Find out what you are actually running, keep the banner if anything touches advertising, and spend the saved energy on something that moves revenue. A clean, honest analytics setup is worth more than a removed banner, every time.
