For fifteen years the UK cookie rule was simple, if annoying. Almost anything that touches a user's device needs consent first. Every banner, every "Accept all" button, every cookie policy nobody reads, all downstream of that one rule. That rule just changed. Not relaxed across the board. Narrowed, in specific, useful ways.
Most businesses haven't updated their banner to reflect it, either because they don't know, or because they're understandably nervous about touching something compliance-shaped without being sure.
Worth saying up front: this is a working summary, not legal advice. If a compliance decision has real money behind it, run it past someone qualified before you rely on it.
Four new exemptions, and they're narrow
The Data (Use and Access) Act 2025 introduced new exemptions to the old blanket consent rule for four specific, low-risk categories.
Analytics
Gathering information about how your site is used, purely to improve it.
User preferences
Remembering settings like language, layout or dark mode.
Core service delivery
Cookies strictly necessary for something the user actively asked for, including fraud prevention and login.
Emergency assistance
Geolocation used to provide emergency aid.
If a cookie falls cleanly into one of those categories, you may no longer need to ask permission before setting it.
Second, the part everyone skipsThe catch, and it's a real one
"Analytics" doesn't mean every analytics tool gets a free pass. The exemption is conditional. The data has to stay anonymised and can't be reused for anything beyond improving your own site. That's a meaningful bar. Standard, off-the-shelf Google Analytics is widely considered not to qualify, because Google can use that data for its own purposes beyond your site's improvement. Swapping your GA cookie out of the consent banner on the strength of this change alone is a mistake worth avoiding.
The "strictly necessary" bar has also tightened. The test is no longer "is this operationally useful to us." It's "did the user actively ask for the thing this cookie enables." That's a narrower reading than a lot of existing cookie policies assume.
It's the first genuine loosening of UK cookie rules in over a decade. A scalpel, not a switch.
And even for cookies that do qualify as exempt, you're generally still expected to give users a simple, free way to opt out. It isn't a free pass to go silent about it.
What still needs consent, no ambiguity
Any advertising cookie, retargeting, frequency capping, audience profiling, still needs it. Cross-site or cross-device tracking still needs it. Affiliate marketing pixels still need it. And anything serving more than one purpose at once should be treated as needing consent the moment it does double duty. If your ad platform's pixel is on the page, your banner still has to ask.
What to actually do this week
Audit what's firing
Most businesses don't actually know what cookies their site sets. A scanner tool will tell you in minutes.
Sort each one
Clearly exempt, clearly needs consent, or not sure. Treat the "not sure" pile as needing consent until you've checked.
Check your banner is honest
"Accept all" and "Reject all" should carry equal visual weight, and rejecting should actually block what it claims to block. Worth revisiting alongside a wider look at where your site is losing visitors to friction it doesn't need.
Don't strip your banner down
Not on the assumption the new exemptions cover more than they do. See the analytics catch above.
Watch the ICO's guidance directly
Rather than relying on any single summary, including this one. Commencement detail has landed in stages, and enforcement tends to focus on high-traffic sites first, but the rules apply regardless of size.
If you're weighing this up alongside everything else a site needs to actually do its job, it sits next to the other easy-to-miss items on what a small business website needs, and it's one more line in the running total of what a website really costs to keep right, not just to build.
A scalpel, not a switch.
The businesses that benefit from this are the ones that actually audit what they're setting and why, not the ones that quietly delete their banner and hope. If you're not sure which pile your site's cookies fall into, that's a half-day job, not a redesign.
