Practical guide · Search topic: do I need a cookie banner for Google Analytics UK

Do you need a cookie banner for Google Analytics in the UK?

Possibly not, but don't assume it. Since 5 February 2026, UK law has allowed websites to use analytics without consent when the only purpose is collecting statistics to improve the site. The information must not be shared except to help with that, and visitors must get clear information and a simple, free way to object. Whether your Google Analytics setup meets those conditions depends on how you have configured it. Check it before you remove a cookie banner.

What changed in February 2026

The Privacy and Electronic Communications Regulations, usually shortened to PECR, set the rule on cookies. Strictly, the rule covers storing any information on a visitor's device, or reading information from it, so it reaches further than cookies.

Section 112 of the Data (Use and Access) Act 2025 rewrote that rule. It also added a new schedule to PECR, Schedule A1, which lists the cases where you don't need consent. legislation.gov.uk records section 112 as in force from 5 February 2026, except for parts that started earlier. (legislation.gov.uk, s.112)

The ICO's guidance lists five exceptions: communication, strictly necessary, statistical purposes, appearance and emergency assistance. Statistical purposes is the one that matters for analytics. (ICO)

The five conditions for analytics without consent

Paragraph 5 of Schedule A1 sets five conditions. In plain English, they are:

You provide an online service. The law says "information society service". The ICO describes this as being an "ISS provider". A business website will normally count, but confirm this for your own case.
Statistics is the only purpose. You collect information about how your website is used so that you can improve it.
The information isn't shared, except with someone helping you make those improvements.
Visitors get clear and comprehensive information about what you are doing and why.
Visitors can object simply and for free, and they haven't objected.

(PECR Schedule A1, paragraph 5)

All five have to be true. If one fails, you need consent.

What the ICO says is in and out

The ICO's guidance gives examples. It says these are "likely to meet" the exception when you use them for aggregate statistics:

total visits to your website, page by page
interactions with your pages, such as average scroll depth
device types, and browser or operating system versions
how people reached you, such as an email campaign or search results
A/B testing of two versions of a page
coarse location, such as city or region, that doesn't identify anyone
page loading speeds, bounce rates and exit pages

It says you need consent for:

logs or recordings of individual visitors and what they did
measuring whether people saw or clicked an advert
connecting a visitor ID to purchases so that it can be shared with advertising partners
tracking or profiling individual visitors, or groups of visitors
following people's browsing across different services
anything for online advertising

(ICO: What are the exceptions?)

Can you use a third-party tool like Google Analytics?

The ICO says yes, you can use a third-party analytics provider under this exception. There are conditions, though. The provider can only act on your behalf, and can only use the information to help you improve your service. The ICO also says the provider must be a processor, not a joint controller. You must tell visitors that you use a provider and explain what the provider does with the information. (ICO)

The ICO's guidance doesn't name Google Analytics or any other product. The question is whether your own setup meets the conditions. These are the parts of Google Analytics worth checking. All facts below come from Google's help pages, checked 28 Oct 2026.

Data sharing settings. Google describes several optional settings. With "Google products & services" switched on, Google can use your data to improve Google products, including Google Ads tools. Google also says that for data used under this setting it is "an independent controller". If every setting is off, Google says your data is only used to provide and maintain the Analytics service. Google also notes that data can still flow to other Google products you have explicitly linked. (Google: data sharing settings)
Google Ads links. Google says that when a property is linked to a Google Ads account, its tags set extra cookies for measuring adverts. (Google: cookie usage)
Cookies and how long they last. Google lists the _ga and _ga_<container-id> cookies, each with a default expiry of two years. (Google: cookie usage)

How those settings line up with the ICO's conditions is a judgement for you or your adviser to make. As one example, the ICO asks for a processor, and Google describes itself as an independent controller under one of its sharing settings. That is worth raising with your adviser before you drop consent.

If you keep a cookie banner for Google Analytics

Many sites will keep consent in place, either for Google Analytics or for other tags such as adverts and social pixels. Google offers consent mode for this. In its basic version, Google says its tags don't load until the visitor interacts with your consent banner. If the visitor declines, no data is sent to Google. (Google: about consent mode)

A consent banner means some visitors won't be counted. That is expected, and it is one reason why figures from different tools rarely match.

If you use a cookie-free analytics tool

Taking cookies away doesn't settle the question by itself. The rule also covers reading information from a device. A cookie-free tool used only for aggregate statistics can rely on the same exception, but the same conditions still apply. You still need clear information in your privacy notice and a simple way for visitors to object.

On objecting, the ICO says something easy to miss. You must not rely only on browser settings as the sign that someone doesn't object, because not every visitor has set them, and not every browser has them. Signals such as Do Not Track or Global Privacy Control can help, but they shouldn't be your only route. (ICO)

QuietStats is one example of a cookie-free tool. It stores nothing on the visitor's device and doesn't store IP addresses. It does read the screen size, which could count as reading from the device, so it relies on this same exception. Our compliance page sets out what that means for you and gives privacy notice wording you can adapt.

A practical way to check your site

List everything. Write down every script, cookie and embed on your site and what each is for. Analytics is often not the only thing setting cookies.
Check your Google Analytics account. Google says data sharing settings are under Admin, then Account details. Note which settings are on and whether the property is linked to Google Ads.
Update your privacy notice. Say which analytics tool you use, what it collects, why, who the provider is, and how to object.
Add a way to object. Make it simple and free, and make sure it works on your site, not only through a browser setting.
Keep consent where it's needed. Adverts, social media pixels and some embedded content still need it.
Write down what you decided and when. If the guidance changes, you'll know what to revisit.

Limits to keep in mind

This guide is general information, not legal advice. It covers the UK consent rule in PECR only. If your analytics processes personal data, UK GDPR applies as well, and the ICO says so in its guidance. Rules for visitors in other countries may differ, and this guide does not cover them. If you are unsure, take advice on your own setup.

Questions

Do I still need a cookie banner for Google Analytics in the UK?

Not automatically. Since 5 February 2026, analytics can run without consent if its only purpose is statistics to improve your site, the data is not shared except to help with that, and visitors get clear information and a simple, free way to object. If your Google Analytics setup is used for advertising, or shares data for other purposes, you still need consent.

What did the Data (Use and Access) Act change about cookies?

It rewrote PECR's rule on storing or reading information on a visitor's device and added a set of exceptions, including one for statistical purposes. legislation.gov.uk lists the change as in force from 5 February 2026.

Can I use Google Analytics without cookie consent?

Only if your use meets every condition of the statistical purposes exception. The ICO says a third-party analytics provider must act on your behalf and only use the information to help you improve your site. It also says advertising uses always need consent.

Do cookie-free analytics tools need a cookie banner?

Removing cookies does not settle it on its own, because the rule also covers reading information from a device. A cookie-free tool used only for aggregate statistics can rely on the same exception, but you still need to tell visitors about it and give them a simple way to object.

Does the exception cover Google Ads conversion tracking?

No. The ICO lists measuring adverts, and connecting a visitor ID to purchases shared with advertising partners, as activities that need consent.

Sources and further reading

Compliance: PECR, UK GDPR, sub-processors & retention · quietstats Do UK websites need consent for analytics? Cookieless analytics and UK rules: the important distinction Google Analytics alternative for small websites · quietstats Website analytics without cookies: how it works · quietstats Do Not Track and Global Privacy Control in website analytics Zero cookies, privacy built in · quietstats cookie-free analytics

Put your traffic in context

Explore the product, its measurement method and pricing before choosing a tool.

Open the demo See pricing