Do you need a cookie banner before you can use analytics?

Yes, for now. Since February 2026 a new exception has let some analytics run without asking, but its conditions are strict, and even then you have to tell visitors and let them object. Whether Google Analytics 4 meets those conditions depends on how it's set up, and nobody, not the regulator, the courts or Google, has said whether it does. Until somebody does, keep the banner.

This is part of our series checking what small and medium businesses are told about marketing, in which each claim is tested against what the law and the regulator actually say. It isn't legal advice, so for your own site, ask whoever advises you on data protection.

Our interest, stated first. We do analytics and reporting work, and our own site loads GA4 only after a visitor accepts. We're keeping it that way until these questions have a clearer answer. If you'd like your set-up checked against the ICO's guidance, ask us, though for the legal judgement itself you need a data protection adviser.

What changed in February 2026

The UK's cookie rule covers more than cookies. It covers storing anything on someone's device, or reading anything from it, and the ICO's guidance says that includes tracking pixels, web storage, scripts and tags.

On 5 February 2026 the Data (Use and Access) Act 2025 rewrote that rule and, through a schedule inserted by the Act, gave it a new list of exceptions. Five things no longer need consent: carrying a communication, whatever is strictly necessary for a service the visitor asked for, statistics, remembering how someone likes the site to look, and locating someone who needs emergency help. Everything else still needs consent.

What the statistics exception actually requires

The statistics exception is the one that matters here, and it applies only if all five of its conditions are met. You provide the service. The sole purpose is collecting statistics about how the service is used, in order to improve it. The information isn't shared with anyone except to help make those improvements. The visitor is told clearly what it's for. And the visitor is given "a simple means of objecting, free of charge", and doesn't object.

Two of those are easy to miss. "Sole purpose" means exactly that: use the statistics for anything else and the exception falls away. And because you still have to tell visitors and give them a way to object, the exception never removes the need to say something.

What the ICO says it covers

The Information Commissioner's Office finalised its guidance in April 2026, and its chapter on the exceptions is the clearest statement of how the regulator reads this one. The exception "is essentially for analytics purposes", it says, before drawing the line: "it is not a broad exception that covers all types of analytics technologies or ways you can use them. It is about how your service is used, not about who uses it." Whatever comes out has to be "aggregate statistical information that you cannot use to identify people".

The ICO says these are likely to fit, as long as the information is aggregate:

• total visits, page by page, to understand how people move through the site
• what people do on a page, such as how far down they scroll
• device types, browsers and operating systems
• how people reached the site, such as from an email or a search
• testing two versions of a page against each other
• rough location, at city or region level, that identifies nobody
• page loading speeds, bounce rates and exit pages

What still needs consent: recordings of individual visitors' sessions, unless they're for security; measuring whether someone saw or clicked an advert; linking a visitor to their purchases "to be shared with advertising partners"; tracking or profiling individuals or types of visitor; and following people across other services and apps. The ICO is explicit that the exception "does not apply to purposes related to online advertising".

If you use someone else's analytics tool, the ICO adds two conditions: "your third party provider must be a processor, not a joint controller", and you must "ensure the provider only uses the information to improve your service and does not link it with other information from any other information it works with". Its own worked example is a site measuring scroll depth and time on page, which can rely on the exception right up until it starts sorting visitors "by demographic, including age group and gender". At that point it can't.

Where Google Analytics 4 fits

This is the unsettled part. The ICO's guidance doesn't name any analytics product, and we found no ICO decision, court ruling or Google document that says whether GA4 qualifies. What Google does publish shows that the answer depends on your settings.

• Google says it's a processor, by default. Its help page on safeguarding your data says: "Google operates as a data processor for Google Analytics. This is reflected in our Ads Data Processing Terms". Google also says businesses established in the UK don't need to accept those data processing terms separately, as they're already built into their terms.
• One data sharing setting changes that. With the "Google products & services" data sharing setting on, Google's help on data sharing settings says it "can access and analyze data to better understand online behavior and trends, and use this data to improve Google products and services", and that "Google is, for GDPR purposes, an independent controller of such data". The ICO's condition is that the provider acts only as your processor and uses the information only to improve your site.
• Google signals adds demographics. According to Google's help on Google signals, with it switched on, "reporting data is enriched for users who have turned on Ads Personalization and signed into their Google accounts, such as demographic and interest data". The ICO's worked example puts demographic segmentation outside the exception.
• Links to advertising go further still. GA4 is often linked to Google Ads for conversions and audiences. The ICO's guidance on the exceptions says you must get consent "if you use a third party service for other purposes", giving the example of linking "a user's activity and purchase journey on your website to an online advert". Its guidance on managing consent in practice adds that one technology can't serve both the exception and another purpose such as advertising: "if one purpose meets the requirements of an exception but another does not, you must get consent".

So a GA4 property with data sharing, Google signals or advertising links switched on is hard to square with what the ICO describes. One with all of them off is closer, but whether it meets every condition, including the ICO's point that the provider mustn't link the information with anything else it holds, hasn't been tested by anyone whose view settles it. That's why the sensible course is to keep asking for consent until someone has checked your set-up properly.

In the meantime, GA4's numbers rarely match other tools, and consent choices are part of the reason, so bear that in mind when you work through the five GA4 reports worth reading.

What doesn't change

• Advertising still needs consent. Retargeting pixels, conversion tags shared with ad platforms and similar tools are outside the exception, as the ICO says. That's also why retargeting depends on consent whichever side of Meta ads versus Google Ads you come down on.
• You still have to tell people and let them object. Even analytics that qualifies needs clear information and a simple, free way to object. The ICO's guidance on the exceptions says this can be part of your existing consent tool, "for example, by having your 'statistical purposes' or 'appearance' toggles on by default, with the ability for users to change them to off at any time", and that you "must not solely rely on browser settings" as a sign someone doesn't object.
• Everything else still needs a decision. Embedded videos and fonts loaded from other companies' servers can collect information too, and the same ICO guidance covers both. Whatever you decide about analytics, these may still need consent or a way to object, which is why we list a consent tool among the running costs in what a website costs.

What to check before changing anything

• List every tag and script on your site, and what each one is for.
  What good looks like

  You have a written list of every tag, pixel and script your site loads, including embedded videos and fonts from other companies, with a line on what each is for and who receives the data.

  Takes an hour or two, longer on an older site. Covered in Google Consent Mode, explained: what is settled and what is not.

• In GA4, check the data sharing settings, whether Google signals is on, and which Google Ads accounts are linked.
  What good looks like

  You have written down whether the "Google products & services" data sharing setting is on, whether Google signals is on, and every Google Ads account linked to the property.

  Takes twenty minutes, with admin access. Covered in full above.

• Ask whether any analytics data is used for anything other than improving your site, including advertising.
  What good looks like

  Everyone who uses your analytics, including any agency, has confirmed in writing what they use it for, and you know whether any of it feeds advertising audiences or conversion tracking.

  Takes a few emails. Covered in full above.

• If you use another analytics tool, ask the provider whether it acts only as your processor and whether it combines your data with anything else.
  What good looks like

  The provider has told you in writing that it acts only as your processor and does not combine your data with anything else, and you have kept that reply.

  Takes one email, then a wait for the answer. Covered in full above.

• Check what your privacy notice says about analytics, and whether visitors have a simple, free way to object.
  What good looks like

  Your privacy notice describes the analytics you actually run, and a visitor can object to it through a simple, free route such as a setting in your consent tool.

  Takes an hour. Covered in full above.

• Take advice from whoever handles data protection for you before removing or changing a consent step.
  What good looks like

  Whoever handles data protection for you has seen your list of tags and settings, and has agreed any change in writing before a consent step is removed or altered. If nobody in the business does, the Information Commissioner's Office has advice for small and medium organisations, including self-serve tools that generate tailored advice.

  Takes depends on your adviser.

What nobody has settled

The other open question is Google's consent mode, which we cover in Google Consent Mode, explained. In Google's advanced version of consent mode, while consent is denied, "the Google tags send measurements without cookies". We found nothing from the ICO on consent mode, basic or advanced, and its guidance on storage and access technologies doesn't mention it. So there's no regulator view on whether measuring visitors who have said no in this way fits the exception. Nor does "without cookies" by itself put it outside the rules: regulation 6, as rewritten by section 112 of the Data (Use and Access) Act 2025, now also covers "collecting or monitoring information automatically emitted by the terminal equipment".

Enforcement is moving too. The ICO says the enforcement regime for these rules is changing under the Act, and that it will update its guidance on what happens if you don't comply once the new regime is in force.

So since 5 February 2026 the law no longer requires consent for every kind of analytics, but nobody has said whether your GA4 set-up is the kind it lets through. Keep asking for consent until someone has checked your set-up against the ICO's guidance, and keep it for advertising tags whatever they find.