Analytics without consent? What the UK’s new cookie exemption allows charities

Since 5 February 2026, UK websites have been allowed to set some analytics cookies without asking first. If you’ve heard that charities no longer need a cookie banner, it isn’t quite that simple. The exemption is real but narrow, and the analytics setup most charity websites run today doesn’t fit inside it. Here’s what the law actually says, what it means for Google Analytics and Microsoft Clarity, and what to do.

What changed on 5 February 2026

The UK’s cookie rules sit in the Privacy and Electronic Communications Regulations, usually called PECR. They say you need consent before storing or reading information on someone’s device, unless an exception applies. Until this year the exceptions were narrow: things that were strictly necessary, such as a shopping basket or a login.

The Data (Use and Access) Act 2025 added new exceptions, which came into force on 5 February 2026. The most talked about is for analytics. Another covers settings that change how a website looks or works for each visitor, such as remembering a text size. The same Act raised the maximum fine for breaking these rules from £500,000 to £17.5 million or 4% of global turnover, whichever is higher.

The regulator published its final guidance on these rules on 29 April 2026. Since 30 September 2026 it has legally been the Information Commission, though its website still uses the ICO name.

What the analytics exception actually says

You can set analytics cookies without consent only if all of these are true:

1. The sole purpose is to collect information for statistical purposes about how your website or service is used, with a view to improving it.
2. The information is not shared with anyone else, except to help you improve the site or service.
3. Visitors are given clear and comprehensive information about what you are doing and why.
4. Visitors are given a simple means of objecting, free of charge, and they have not objected.

The regulator’s guidance narrows it further. In its words, the exception “is about how your service is used, not about who uses it. It is not for identifying, tracking or monitoring people or groups of people who use your service. It also doesn’t apply to things like online advertising.” You should work with aggregated statistics, and if you use a third-party tool, the provider “must be a processor, not a joint controller”, using the data only to improve your service.

What’s in and what’s out

Does Google Analytics 4 qualify?

This matters because almost every charity website that runs analytics uses Google’s tools: 96.4% of them, in our crawl. The regulator’s guidance doesn’t mention Google Analytics by name, so the answer depends on how it is set up.

• Data sharing with Google. When GA4’s “Google products and services” sharing setting is on, Google says it acts as an independent controller of that data. That conflicts with the requirement that your provider is only a processor.
• Google signals. This feature uses data from signed-in Google users and enables remarketing across devices. That is advertising and profiling, which always needs consent.
• Links to Google Ads. If GA4 feeds conversions to a Google Ads or Ad Grants account, that’s advertising measurement, which needs consent too.

So GA4 as most charities have it, with data sharing and Google signals switched on and often linked to an Ad Grant, does not fit the exception and still needs consent. A stripped-down GA4, with sharing and signals off and no Ads link, might arguably qualify, but neither the regulator nor Google has said so, and most legal commentators still advise asking first. Since June 2026, Google’s Consent Mode has become the main control for what GA4 collects, which makes a working consent tool more important, not less.

What about Microsoft Clarity and heatmaps?

Session recordings are clearly outside the exception: the regulator lists “logs or recordings of individual visitors to your website and the actions they took” as needing consent. Microsoft has enforced consent signals for UK visitors to Clarity since 31 October 2025 and says it doesn’t place cookies in the UK without valid consent. Heatmaps haven’t been ruled on, but Clarity builds them from individual sessions, so treat them as needing consent too.

What we found on charity websites

When we read the homepages of 55,300 UK charity websites, 42.3% loaded cookie-setting analytics, and 62.3% of those showed no consent tool at all: nothing asked before the cookies were set. Even among charities with an income over £2 million, the figure was 46.1%. Read the full research.

The new exception doesn’t fix that for most of them, because standard analytics setups still need consent. The first job for most charities is a consent tool that genuinely blocks non-essential cookies until people agree.

What to do

1. Find out what your site actually sets. List every tool that loads: analytics, heatmaps, Meta or LinkedIn pixels, embedded videos, chat widgets and donation platform scripts.
2. Put a consent tool in place that works. It should block non-essential scripts until people agree, make saying no as easy as saying yes, and let people change their mind later.
3. Choose your analytics approach. Either keep GA4 and ask for consent, or use a simpler analytics tool configured as your processor that only produces aggregate statistics, and rely on the exception with clear information and a way to object. Some charities do both.
4. If you rely on the exception, make objecting easy. The regulator suggests an analytics setting that is on by default and can be switched off at any time, and says you must not rely on browser settings alone.
5. Update your cookie policy. It must cover the technologies you use, what they’re for, any third parties by name (not just “partners”), and how long information is kept.
6. Remember the rest still needs consent. Advertising pixels, ad conversion tracking and session recordings were never exempt and still aren’t.

How we can help

Every charity website we build has consent set up properly from launch, with analytics that respects people’s choices and still tells you what you need to know. If you’re not sure what your current site is doing, ask us to take a look, or see how we approach charity web design.

Questions charities ask