Do you need a cookie banner before you can use analytics?

Not always, since February 2026, but that is not a reason to take your banner down. The Data (Use and Access) Act 2025 added an exception to the UK's cookie rules that lets some analytics run without consent, if strict conditions are met. Even then you must tell visitors about it and give them a simple, free way to object. Whether Google Analytics 4 qualifies depends on how it is set up, and nothing we found from the regulator, the courts or Google settles it. So this piece explains what changed and what to check. It does not tell you to remove anything.

This is part of our series checking what small businesses are told about marketing, where every claim is tested against what the law and the regulator actually say. It is not legal advice; for your own site, ask whoever advises you on data protection.

What the rule was, and what changed

The UK's cookie rule sits in the Privacy and Electronic Communications Regulations 2003 (PECR), regulation 6. It covers more than cookies: storing information on someone's device, or reading information from it. The ICO's guidance lists tracking pixels, web storage, and scripts and tags among the technologies it applies to (ICO, guidance on the use of storage and access technologies). The Data (Use and Access) Act 2025 rewrote regulation 6 so that a person "must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user", subject to a new list of exceptions (Data (Use and Access) Act 2025, section 112).

The exceptions are in a new Schedule A1 to PECR, inserted by Schedule 12 of the Act. Both came into force on 5 February 2026 (PECR, Schedule A1, as amended; Data (Use and Access) Act 2025, Schedule 12). There are five routes that do not need consent: carrying a communication, what is strictly necessary for a service the user asked for, statistical purposes, adapting a site's appearance to the user's preferences, and locating someone who needs emergency help. Everything else still needs consent.

What the statistics exception requires

Paragraph 5 of Schedule A1 lets a site store or read information on a visitor's device without consent only if all of these are true (PECR, Schedule A1, paragraph 5):

1. You provide the online service.
2. The sole purpose is to "collect information for statistical purposes about how the service is used with a view to making improvements to the service", or about how your website is used, to improve the website.
3. The information is "not shared with any other person except for the purpose of enabling that other person to assist with making improvements to the service or website".
4. The visitor is given "clear and comprehensive information about the purpose".
5. The visitor is given "a simple means of objecting, free of charge", and does not object.

Two things are easy to miss. The purpose must be the only purpose: statistics used for anything else fall outside it. And the exception still needs information and a way to object, so it does not remove the need to tell people something.

What the ICO says it covers

The Information Commissioner's Office finalised its guidance on these rules in April 2026, after consultations in December 2024 and July 2025 (ICO, about this guidance; the guidance was last updated on 29 April 2026). Its chapter on the exceptions is the most detailed statement of how the regulator reads the statistics exception (ICO, what are the exceptions?).

The ICO says the exception "is essentially for analytics purposes", but "it is not a broad exception that covers all types of analytics technologies or ways you can use them. It is about how your service is used, not about who uses it." The results must be "aggregate statistical information that you cannot use to identify people" (ICO, what are the exceptions?).

The ICO lists things likely to fit, when the information is aggregate:

• total visits, page by page, to understand journeys through the site
• interactions with pages, such as average scroll depth
• device types, browsers and operating systems
• how people reached the site, such as from an email campaign or search
• A/B testing two versions of a page
• coarse location, at city or region level, that does not identify anyone
• page loading speeds, bounce rates and exit pages

And things that need consent: recordings of individual visitors' sessions (other than for security), measuring whether people saw or clicked an advert, connecting a visitor ID to purchases "to be shared with advertising partners", tracking or profiling individuals or categories of visitor, and monitoring people's browsing across other services and apps. The ICO says plainly that the exception "does not apply to purposes related to online advertising" (ICO, what are the exceptions?).

On third-party tools, the ICO says you can use one, but "your third party provider must be a processor, not a joint controller", and you must "ensure the provider only uses the information to improve your service and does not link it with other information from any other information it works with". It gives a worked example: a site measuring scroll depth and time on page through an analytics service can rely on the exception, but once it adds settings to segment visitors "by demographic, including age group and gender", it cannot (ICO, what are the exceptions?).

Where Google Analytics 4 fits

This is the unsettled part. The ICO's guidance does not name any analytics product, and we found no ICO decision, court ruling or Google document that says whether GA4 qualifies. What Google does publish shows that the answer depends on settings.

• Google says it is a processor, by default. "Google operates as a data processor for Google Analytics. This is reflected in our Ads Data Processing Terms" (Google Analytics Help, safeguarding your data). Google says businesses established in the UK do not need to accept those terms separately, as they are already built into their terms (Google Analytics Help, data processing terms).
• One data sharing setting changes that. With the "Google products & services" data sharing setting on, Google "can access and analyze data to better understand online behavior and trends, and use this data to improve Google products and services", and "Google is, for GDPR purposes, an independent controller of such data" (Google Analytics Help, data sharing settings). The ICO's condition is that the provider acts only as your processor and uses the information only to improve your site.
• Google signals adds demographics. With Google signals on, "reporting data is enriched for users who have turned on Ads Personalization and signed into their Google accounts, such as demographic and interest data" (Google Analytics Help, Google signals). The ICO's worked example puts demographic segmentation outside the exception.
• Links to advertising go further still. GA4 is often linked to Google Ads for conversions and audiences. The ICO says you must get consent "if you use a third party service for other purposes", giving the example of linking "a user's activity and purchase journey on your website to an online advert" (ICO, what are the exceptions?). It also says one technology cannot serve both the exception and another purpose such as advertising: "if one purpose meets the requirements of an exception but another does not, you must get consent" (ICO, how do we manage consent in practice?).

So a GA4 property with data sharing, Google signals or advertising links switched on is hard to square with what the ICO describes. A GA4 property with all of them off is closer, but whether it meets every condition, including the ICO's point that the provider must not link the information with anything else it holds, has not been tested by anyone whose view settles it. The evidence here is thin, which is why the sensible course is to keep asking for consent until someone has checked your set-up properly.

If you want to know what GA4 is telling you in the meantime, our guide to the five GA4 reports worth reading explains why its numbers rarely match other tools, and consent choices are part of the reason.

What does not change

• Advertising still needs consent. Retargeting pixels, conversion tags shared with ad platforms and similar tools are outside the exception, as the ICO says. Our comparison of Meta ads and Google Ads covers why retargeting depends on consent.
• You still have to tell people and let them object. Even analytics that qualifies needs clear information and a simple, free way to object. The ICO says this can be part of your existing consent tool, "for example, by having your 'statistical purposes' or 'appearance' toggles on by default, with the ability for users to change them to off at any time", and that you "must not solely rely on browser settings" as a sign someone does not object (ICO, what are the exceptions?).
• Everything else still needs a decision. Embedded videos and fonts loaded from other companies' servers can collect information too, and the ICO's guidance covers both (ICO, what are the exceptions?). Whatever you decide about analytics, these may still need consent or a way to object. Our guide to what a website costs lists a consent tool among the running costs for this reason.

What to check before changing anything

• List every tag and script on your site, and what each one is for.
• In GA4, check the data sharing settings, whether Google signals is on, and which Google Ads accounts are linked.
• Ask whether any analytics data is used for anything other than improving your site, including advertising.
• If you use another analytics tool, ask the provider whether it acts only as your processor and whether it combines your data with anything else.
• Check what your privacy notice says about analytics, and whether visitors have a simple, free way to object.
• Take advice from whoever handles data protection for you before removing or changing a consent step.

Our interest

We do analytics and reporting work, and our own site loads GA4 only after a visitor accepts. We are keeping it that way until the questions above have a clearer answer. If you want your set-up checked against the ICO's guidance, ask us; for the legal judgement itself, you need a data protection adviser.

Where the evidence is thin

• No ICO decision, court ruling or Google document we found says whether GA4, in any configuration, meets the statistics exception.
• Consent mode. Google's consent mode has an advanced version in which, while consent is denied, "the Google tags send measurements without cookies" (Google, consent mode). The ICO has published nothing on consent mode, basic or advanced: its guidance does not mention it, and we found nothing else from the ICO on it. So there is no regulator view on whether measuring visitors who have said no in this way fits the exception. Note that the rewritten regulation 6 now also covers "collecting or monitoring information automatically emitted by the terminal equipment" (Data (Use and Access) Act 2025, section 112), so "without cookies" does not by itself mean outside the rules.
• The ICO says the enforcement regime for these rules is changing under the Act, and that it will update its guidance on enforcement once the new regime is in force (ICO, what happens if we don't comply?).

The verdict

Still true in practice, for now. Since 5 February 2026 the law no longer requires consent for every kind of analytics: analytics used only to produce aggregate statistics that improve your own site can run without it, provided visitors are told and can object. But whether Google Analytics 4 meets those conditions depends on how it is set up, and no regulator, court or Google document says it does. The ICO has published nothing on Google's consent mode. Keep asking for consent until someone has checked your set-up against the ICO's guidance, and keep it for advertising tags regardless.