Cookies and analytics after the Data (Use and Access) Act

The old rule in one paragraph

Under the Privacy and Electronic Communications Regulations (PECR), storing or reading information on a visitor's device, which is what cookies and similar technologies do, has long needed the visitor's consent unless it is strictly necessary for a service they asked for. That is why so many sites show cookie banners. Analytics cookies were not treated as strictly necessary, so in principle they needed consent too.

What changed on 5 February 2026

The Data (Use and Access) Act 2025 amended PECR. The cookie changes, including new exceptions to the consent rule, came into force on 5 February 2026,^[1] when the Act's Commencement No. 6 Regulations brought most of its data protection changes into effect.^[2]

According to commentary on the ICO's updated guidance, the new exceptions include:^[1]

The ICO's guidance, as summarised in the same commentary, stresses that the exceptions are purpose-specific. Consent is only unnecessary if every purpose of a particular cookie fits the same exception. For objection, it suggests a toggle that defaults to on, can be switched off at any time, and stops the storage or access once someone objects.^[1]

The Act also extended PECR to cover "instigating" the storage of or access to information, by providing that a reference to storing or accessing information includes instigating that storage or access. A website owner who triggers third-party cookies can therefore be responsible even if they did not set the cookie directly.^[3]

What still needs consent

Advertising cookies, retargeting pixels, social media tracking and most cross-site tracking do not fit the new exceptions and still need consent before they are set. Many popular analytics tools also share data with their providers for purposes beyond simple site statistics. If a tool uses visitor data for advertising, profiling or its own product development, its cookies are unlikely to fit the statistical exception, whatever the tool's marketing says.

If you run Google Ads or social media ads with conversion tracking on your website, you will still need a consent mechanism for those tags.

What this means for a plumbing website

Most plumbing websites need very little. A typical site has pages, a contact form and perhaps some way of counting visits and call button taps. Here is a practical approach:

1. List every cookie and tag on the site. Your developer can do this in a few minutes with browser tools. Include anything set by embedded maps, videos, chat widgets or review badges.
2. Remove what you do not need. An embedded map can often be replaced with a link to the map. A chat widget that nobody answers can go.
3. Choose analytics that fit. A privacy-friendly analytics tool that sets no cookies, or one used solely for site statistics with a clear objection option, keeps you within the new rules more easily than an advertising-linked tool.
4. Explain what is left. A short cookies page saying what each remaining cookie does, why and how to object or refuse.
5. Ask for consent where you still need it. If you keep advertising tags, set them only after a visitor agrees, with refusing as easy as accepting.

A worked example

Consider a typical small plumbing website and how it might look before and after a tidy-up.

After the tidy-up, the site sets only a strictly necessary cookie and, if wanted, statistics cookies with a clear objection route. It no longer needs a full consent wall, it loads faster and it is easier to explain.

Do you still need a cookie banner?

It depends on what the site uses. A site that sets only strictly necessary cookies, such as a session cookie that protects a form from forged submissions, does not need a consent banner, although it should still explain those cookies on a cookies page.

A site using statistical cookies under the new exception does not need consent for them, but it does need to give clear information and an easy way to object. That can be a small notice with a link and a toggle rather than a full consent wall.

A site using advertising or tracking cookies still needs a consent banner, with refusing as easy as accepting and nothing set before the visitor chooses.

Penalties and enforcement

The Act also expanded the ICO's enforcement powers, which came into force alongside the cookie changes.^[2] The ICO published its finalised guidance on storage and access technologies on 29 April 2026, and commentary on it reports that enforcement will focus on advertising-related cookies, with anything touching advertising or profiling still needing consent.^[4] Small trade sites are unlikely to be a priority, but that is not a reason to ignore the rules, especially as customers notice intrusive tracking.

How we handle cookies on our builds

Our standard plumbing websites set no tracking cookies. The only cookie is a short-lived session cookie on the contact page that protects the form from spam and forged submissions, which is strictly necessary for the form to work securely. If a client wants analytics, we recommend a tool used solely for statistics, explained on the cookies page with a simple objection option. You can see our own explanation on the cookies page.

Checklist

• Every cookie and tag on the site is listed with its purpose.
• Unneeded third-party embeds and widgets are removed.
• Analytics, if used, is limited to site statistics with an objection option.
• Advertising and tracking tags load only after consent.
• A cookies page explains everything that remains, in plain language.