Do Google Analytics cookies still need consent? Not automatically, any more. Since 5 February 2026, UK website cookie law has allowed some analytics to run without asking visitors first. But that exception comes with conditions, it depends on how your analytics provider handles the data, and it does not cover advertising at all. Many business websites run Google Analytics alongside an advertising tag or two, and those still need consent. So for most businesses the honest answer is still yes, you need a cookie banner.
And it needs to actually work. Plenty of websites have a banner that asks the question and then stops nothing.
What the Data (Use and Access) Act changed in UK website cookie law
The rules on cookies and similar tracking sit in the Privacy and Electronic Communications Regulations, usually shortened to PECR. They were amended by the Data (Use and Access) Act 2025, and the changes to cookies came into force on 5 February 2026. Two things moved, in opposite directions.
Some analytics no longer needs consent. You can now measure how people use your website without asking first, as long as all of the following are true:
- The only purpose is producing statistics about how your site is used, so you can improve it
- The information is not shared with anyone except to help you make those improvements
- You tell visitors clearly what you are doing
- Visitors have a simple, free way to object, and have not
Everything else still needs consent, and first. Advertising tags, conversion data shared with advertising platforms, recordings of individual visitors’ sessions and anything used to build a profile of a person all still need a genuine yes before they run. Plenty of small business websites have exactly these: a Google Ads conversion tag, a Meta pixel, a remarketing list. The new exception does not cover them.
The penalties went up. The maximum fine for breaking the cookie rules was raised to £17.5 million or 4% of worldwide turnover, whichever is higher, in line with UK GDPR. The Information Commissioner’s Office says it reserves fines for the most serious cases, and nobody should read that figure as the likely cost of a mistake. The realistic first step is a letter.
Letters are not hypothetical. The ICO checked the UK’s thousand busiest websites for advertising cookies set before a choice, cookies set without consent, and rejecting being harder than accepting. By December 2025, 564 of those sites had only come into line after the regulator wrote to them or opened an investigation. Those are the biggest, best-resourced websites in the country. A business with a site built five years ago and a banner added later is in the same position with less help.
Do Google Analytics cookies need consent?
It might not, but you cannot assume it. Google Analytics is an outside analytics provider, and the regulator’s guidance is specific about those. To rely on the exception, the provider must act only on your behalf, as a processor rather than a joint controller, and use the information only to help improve your service. A provider that also uses the data for its own purposes does not qualify.
The guidance does not name products, and it does not say whether Google Analytics passes that test. The answer depends on how your account is set up, for example what it shares with Google and whether it is linked to Google Ads, and on the terms you have accepted. That is a question to put to whoever manages your analytics, and to take advice on if the answer matters to your business.
One part is clear either way. If your analytics is feeding your advertising, that use needs consent, whatever tool is doing it.
Why your cookie banner may not be stopping anything
Whatever the answer on analytics, a banner only helps if it works. A banner on the screen is not the same thing as consent. If advertising code has already loaded by the time the visitor reads the question, the banner is asking permission for something that has already happened. The site is tracking people who never agreed, and the business that owns it very rarely finds out.
Nobody sets out to build it this way. It usually happens in layers, over a few years, with different people involved at each step.
- The tracking code came first. Someone added Google Analytics years ago, pasted into a box for “header scripts” or built into the site’s theme. The banner arrived later as a separate addition. The two were never connected, so the banner collects a click and the code it was meant to control carries on regardless.
- The banner is installed but switched off. This is common after a website rebuild or a move to a new platform. The consent feature exists and nobody turned it on, or it was turned off during testing and never turned back on.
- A new tag went straight onto the site. An advertising pixel, a chat widget or a heatmap tool added by a marketing agency, directly, without going through the banner.
- Reject is there, but hidden. Accept is a big button on the front. Reject lives two clicks deep inside “manage settings”.
What makes all of these hard to spot is that nothing breaks. The website works. The reports keep filling up. In fact a banner that is not stopping anything produces more data than one that is, so the one warning sign looks like good news.
How to check your website’s cookie compliance in two minutes
You do not need to be technical for this. It works in Chrome, Edge and most other browsers.
- Open a private or incognito window, so the browser has no record of any choice you made before, and go to your homepage.
- Do not click anything on the banner. First, look at it. Is there a banner at all? Is refusing as easy as accepting, with a button of the same size on the same screen?
- Right-click anywhere on the page and choose Inspect. In the panel that opens, find the Application tab (in some browsers it is called Storage), then Cookies, then your website’s address.
- Look at the names in the list. Names beginning _ga are Google Analytics. _gcl is Google Ads. _fbp is Meta, the owner of Facebook and Instagram.
- If advertising cookies like those are already there before you have made a choice, the banner is not doing its job.
- Close the window, open a fresh private window, click Reject, visit a couple of pages, and look again. Anything still being set after you refused is the problem to fix.
Analytics cookies on their own, before a choice, are not automatically wrong any more, for the reasons above. But if you find them, you now need to be able to say which exception you are relying on and why it applies.
What this check will not tell you
- It is not a legal opinion. It tells you what your site does, not whether that is acceptable for your business. If you are unsure, take advice.
- A clean list is a good sign, not proof. Some tracking works without cookies. For example, one of Google’s consent settings deliberately sends Google limited information about each visit before the visitor has chosen, without setting a cookie. The regulator’s guidance does not address that setting specifically, so ask whoever set up your tags which mode they chose.
- It will not decide whether your analytics qualifies for the exception. That depends on your provider’s role and terms, not on what the browser shows.
- It only proves today. The next time anyone adds a tool to the website, run it again.
If it fails
The fix is rarely difficult. It is mostly a matter of someone taking ownership of it.
- List every tracking tool on the site, and who added it
- For each one, decide whether it is genuinely exempt or has to wait for consent, and write that decision down
- Put everything in the second group under the banner’s control, so it only loads after a yes
- Make refusing as easy as accepting
- Make sure your cookie policy lists what is actually there
- Agree that nothing new goes onto the site without passing through the same check
If a website’s tracking has grown over the years and nobody is quite sure what is on it any more, that is a normal place to be. It is also exactly the kind of thing worth sorting before somebody else points it out. If you would like a hand working through yours, get in touch.
This post reflects the law and the ICO’s published guidance as at September 2026.