UK cookie rules in 2026: PECR after the Data (Use and Access) Act
Since 5 February 2026, UK law has new exceptions for some analytics and appearance cookies. Advertising cookies still need consent.
Short answerIn the UK, storing or reading information on a visitor's device needs consent unless an exception applies. The Data (Use and Access) Act 2025 added new exceptions, in force since 5 February 2026: statistical analytics to improve your own site, and remembering appearance or functionality choices - both only with clear information and a simple, free way to object. Advertising cookies still need consent.
What changed, and when?
Section 112 and Schedule 12 of the Data (Use and Access) Act 2025 rewrote regulation 6 of the Privacy and Electronic Communications Regulations (PECR) and added a schedule of exceptions. They came into force on 5 February 2026 (DUAA s.112; SI 2026/82). The rule now also covers "instigating" storage or access, not only doing it yourself.
Which cookies no longer need consent?
The exceptions in the new schedule (DUAA Schedule 12) are:
- Strictly necessary for a service the visitor asked for - as before.
- Statistical purposes: information collected to improve your own website or service, not shared except to help improve it, with clear and comprehensive information and a simple, free way to object.
- Appearance or functionality: remembering how the visitor chose to see the site, with the same information and objection conditions.
- Communication transmission and emergency location assistance.
The ICO's guidance adds conditions for the statistical exception: the sole purpose must be aggregate statistics to improve your own service, and a third-party analytics provider may act only as your processor and must not link the data with anything else (ICO: what are the exceptions). The appearance exception cannot be used for interest-based personalisation.
What still needs consent?
Advertising and remarketing cookies, cross-site tracking, and analytics that is shared with a provider for its own purposes. A possible exception for online advertising is still being studied and is not law (ICO advice to DSIT, April 2026).
What does the ICO expect from a cookie banner?
The ICO published its final guidance on storage and access technologies on 29 April 2026 (ICO news). In its review of the UK's top 1,000 websites it checked whether advertising cookies were placed before or without consent, and whether rejecting was as easy as accepting. By December 2025, 979 of the 1,000 sites met the standard and 17 had received preliminary enforcement notices (ICO, December 2025).
Does UK GDPR still apply?
Yes. PECR decides when you may store or read information on a device. UK GDPR still applies to any personal data you collect that way: you need a lawful basis and a clear privacy notice.
Where Sadang fits
A Sadang site can set its default consent level (by region, with region detection on), shows Reject all next to Accept all, and keeps a record of each choice. What counts as an exception on your site is your decision: Sadang applies the level you configure, and you describe it in your cookie notice. See consent management and what Sadang stores on this site.
This guide is general information, not legal advice. Laws and regulator guidance change; check the sources linked above and take advice on your own site.