As of 5 February 2026, the Data (Use and Access) Act 2025 has changed how you handle cookies on your website.
What’s Changed
You don’t need permission before setting certain low-risk cookies anymore. For many websites, this means cookie banners can be simplified or removed entirely.
Cookies You Can Use Without Asking Permission
1. Analytics Cookies
You can track how visitors use your site to make improvements without asking first, provided:
- You’re using the data solely to improve your website or service
- You’re not sharing the data with anyone else (except those helping you make improvements)
- You tell users clearly what you’re doing
- You give them an easy way to opt out for free
- They haven’t opted out
Example: Google Analytics configured to collect anonymous usage statistics purely for your internal website improvements.
2. Functionality Cookies
You can remember user preferences without asking, such as:
- Font size preferences
- Language choices
- Layout preferences
- Colour scheme settings
You still need to tell users clearly what you’re doing and give them an easy way to opt out for free.
3. Essential Cookies
You never needed permission for these:
- Login sessions
- Shopping baskets
- Security features
- Fraud prevention
- Cookies That Still Need Permission
You must get opt-in consent before using:
- Advertising cookies (Google Ads, Facebook Pixel, retargeting)
- Marketing cookies (tracking for promotional purposes)
- Third-party tracking that follows users across websites
- Any cookie serving multiple purposes (analytics that also feeds advertising, for example)
This is critical: if your cookie does more than one thing, or shares data with advertisers, you still need permission.
Do You Still Need a Cookie Banner?
Not necessarily. The law only requires:
- Clear information about what cookies you use and why
- A simple, free way for users to opt out
You could meet these requirements by:
- Putting information in your privacy policy (linked in your footer)
- Adding a preference centre where users can toggle cookies on and off
- Using a small, non-intrusive notice that doesn’t block content
- Respecting browser settings like Do Not Track
However, you still need a banner if you use advertising or marketing cookies, because those require permission before being set.
What Information Must You Provide?
For any cookies you use, explain:
- That you’re using cookies
- Which specific cookies
- What each one does
- How long they last
- Who else might access the data
This can be in a privacy policy or cookie policy on your website. It doesn’t have to be in a pop-up.
What About the Opt-Out?
For analytics and functionality cookies, users need an easy way to refuse them. Common approaches include:
- A cookie settings page with toggle switches
- Respecting browser cookie settings
- A preference centre accessible from your footer
The key is it must be free and genuinely simple to use.
Penalties for Non-Compliance
Businesses that fail to comply with the UK Cookie Law Changes 2026 may face penalties of up to:
- £17.5 million
- Or 4% of global annual turnover
What Should You Do Now?
Audit your cookies
List every cookie your site uses and identify which category each falls into.
Separate your cookies
Essential and low-risk cookies can load immediately. Advertising cookies must wait for consent.
Update your approach
If you only use analytics and functionality cookies, you can simplify or remove your banner. If you use advertising cookies, keep a consent banner but you can let analytics run in the background.
Provide clear information
Update your privacy policy, consider a cookie settings page, and make opt-out genuinely accessible.
The Bottom Line
If you run a simple business website with just Google Analytics (configured for internal use only) and basic functionality cookies, you can now set those immediately without a blocking banner. Just make sure users can find information about them and opt out if they want to.
If you run advertising, remarketing, or track users for marketing purposes, you still need proper opt-in consent before setting those cookies.
The law gives you more freedom for legitimate business purposes whilst maintaining protection against invasive tracking.