For the best part of a decade, the cookie banner has been one of the most disliked features of the modern web. Visitors click through it without reading. Businesses lose a large slice of their analytics data every time someone clicks “reject”. And very few small business owners could tell you with confidence whether their banner was actually compliant.
In 2026, the rules in the UK changed. The Data (Use and Access) Act 2025 amended the Privacy and Electronic Communications Regulations, and from 5 February 2026 several kinds of cookies and similar technologies no longer need prior consent. The Information Commissioner’s Office published its final guidance on these “storage and access technologies” at the end of April.
The change has attracted surprisingly little attention outside legal and privacy circles. For many small business websites, it is an opportunity to simplify the visitor experience and recover useful data. For others, it changes nothing at all. Knowing which group you are in is worth half an hour of your time.
This article is a practical overview, not legal advice. If your site processes sensitive data or you are unsure how the rules apply to you, take specialist advice.
Before the change, almost any cookie that was not strictly necessary for a service the visitor had requested needed opt-in consent. That included analytics cookies, which is why so many sites ask visitors to accept tracking before they have read a word.
The new rules introduce a small number of additional exceptions where consent is no longer required. The most relevant for small businesses are:
Alongside these sit the existing exemptions for things that are strictly necessary to deliver the service a visitor has asked for, such as a shopping basket or a login session.
This is where most of the commercial value lies, and where most of the misunderstanding will happen. The ICO’s interpretation of the statistical purposes exception is strict. Broadly, analytics can be used without consent only where:
The ICO’s own way of summarising it is helpful: the analytics should be about how your website is used, not who is using it.
Plenty. Anything involving advertising still needs opt-in consent. That includes:
It is also worth knowing that a typical, default Google Analytics set-up — with advertising features, data sharing and ad account links switched on — is unlikely to meet the conditions of the analytics exception. A carefully configured set-up, or a privacy-focused analytics tool designed for this purpose, is far more likely to.
And if you serve visitors in the EU, their rules have not changed. Analytics cookies there still generally need consent.
Better data. If a large proportion of your visitors currently reject analytics cookies, you are making decisions on a fraction of your real traffic. A compliant, exempt analytics set-up could give you a much fuller picture of which pages work and which do not.
A better first impression. If your site uses no advertising or tracking cookies at all, you may be able to remove the consent pop-up entirely and replace it with clear information in your privacy and cookie notice. Visitors land on your content, not on a legal question.
Fewer moving parts. Many small business sites run a consent tool they do not understand, configured years ago, blocking tags inconsistently. Simplifying reduces the chance of getting it wrong.
Higher stakes for getting it wrong. The same legislation significantly increased the maximum fines available under these rules, and the ICO has been clear that its enforcement focus is on advertising and tracking that ignores consent.
Most of the work here is technical housekeeping: auditing scripts, reconfiguring analytics, adjusting or removing a consent tool, and making sure the site behaves the way its policy says it does. It is exactly the kind of job that is easy to postpone and quick to fix with the right help.
Heer Digital can review your website’s cookies and tracking, recommend a set-up that fits how you actually market your business, and implement the changes on WordPress or Shopify. For WordPress sites on our Heer WP Maintain plan, we can keep that configuration in check as plugins and tools change over time.
The rules have moved in your favour. It would be a shame to keep paying the price of the old ones.
Contact Heer Digital to arrange a cookie and tracking review of your website.
