Published August 2026·last updated 25 August 2026·crawl of 23 August 2026
Analytics cookies need the visitor's consent before they are set - that is the ICO's published position under PECR. We read the homepage of every readable charity website and measured the distance between that rule and practice.
39.7% of readable homepages load cookie-setting analytics, and the tool is overwhelmingly Google's: 96.1% of analytics-running sites load GA or Google Tag Manager. Consent tooling is much rarer - 21.4% of homepages show any recognisable consent tool.
Cookieless tools that need no consent (Plausible, Fathom, Cloudflare and friends) barely register: 1,772 homepages, and that count is a floor - see the method section.
Of the 29,595 homepages that load cookie-setting analytics, 18,906 (63.9%) show no consent tool: nothing in the page asks the visitor before the cookies are set. Counted over every readable homepage instead, the same sites are 25.4% of the sector. Both figures describe one gap over two denominators, and each has its own named query.
What we measure is narrower than a legal judgment: the presence of a recognisable consent tool in the homepage HTML. A site with no tool has no mechanism to collect consent before its analytics run; a site with one may still be misconfigured, which our measurement cannot see - so the gap is conservative in that direction. Both detectors carry measured error rates (see method).
15,982 homepages show a consent tool. The largest single “vendor” is not a vendor at all but the WordPress plugin directory's generic cookie-notice plugins - consent, where it exists, mostly arrived with the website's platform rather than through procurement.
Note: a further 5,129 homepages show a consent tool with no analytics we detect. That is not overkill - a banner can govern cookies other than analytics; embedded maps and video players set them too.
Analytics adoption climbs steeply with income (30.5% of micro-charity homepages to 80.8% of £2m+ ones); consent tooling climbs more slowly. So the biggest charities have the smallest gap among their analytics users - 47.1% against 72.2% for the smallest - and still the largest share of homepages tracking without asking, because so many more of them track at all.
3,001 homepages could not be joined to an income band and are excluded from the chart; the data table carries them.
6.6% of readable homepages (4,907) load the Meta pixel, which shares visitor data with Meta for advertising - a sharper transfer than first-party analytics, because the data leaves the charity's own toolchain entirely. 63.1% of pixel sites show no consent tool.
The registers tag each charity's beneficiaries, so we asked whether charities working with children and young people behave differently. They do not: 24.8% of their readable homepages load cookie analytics with no consent tool (9,427 of 38,073), against 25.8% for the rest of the sector.
To be precise about what this measures: these are figures
about charities' websites and the people who visit them, who are mostly
adults - not a measurement of tracking children. Population:
children (sectors.yml 2026-08-19.1), a
register-grade beneficiary tag; shared platform domains are excluded from
both sides of the cut.
07 · The Google Fonts long tail
42.9% of readable homepages (31,964) load fonts from Google's servers, which shares the visitor's IP address with Google on every visit. A German court held in 2022 that doing so needs consent under the GDPR; the UK position is less litigated. We note it here as a long tail rather than a headline - and because self-hosting fonts is one of the cheapest fixes on this page.
63.9% of the UK charity websites that load cookie-setting analytics show no consent tool at all - 18,906 of 29,595 sites (August 2026).
25.4% of the 74,548 UK charity homepages that answered our crawl load cookie analytics with no consent tool - the sector’s PECR consent gap.
Even among charities with £2m+ income, 47% of analytics-running websites show no consent tool; among the smallest charities it is 72%.
4,907 UK charity websites load the Meta pixel; 63% of them show no consent tool.
Charities for children and young people show the same consent gap as everyone else: 24.8% against 25.8% for the rest of the sector.
Method, reproducibility and licence
What we measured. The homepage HTML of every readable
site, parsed, never executed. “Loads cookie analytics” requires
load evidence in the source - script URLs, a config init, the classic
installs; a Consent Mode stub or a dns-prefetch hint does not
count. “Shows a consent tool” means a fingerprint of a known
consent tool or cookie-notice plugin. Each figure names the query behind it;
re-running it against the same snapshot reproduces the number.
What we did not measure. Whether a consent tool actually blocks scripts until consent is given: a present-but-misconfigured banner counts as consent present, so the gap figures are conservative in that direction. Pages beyond the homepage, server-side tagging and the cookies themselves are out of scope. Cookieless analytics (Plausible, Fathom, Cloudflare and friends) need no consent and are excluded from every gap figure.
Error rates, measured. Against a blind hand-labelled sample: cookie-analytics detection precision 93%, recall 83% (n=98); consent-tool detection precision 79%, recall 83% (n=101). The errors pull in both directions: a missed consent tool or a phantom analytics hit inflates the gap, a phantom consent tool or a missed analytics install shrinks it. We publish the point estimates with these rates rather than pretending precision we do not have. The cookieless count is a floor: the gold sample held two cookieless installs and the detector missed both.
Denominator. Readable homepages only: sites we never read (declined by robots.txt, dead, parked, or serving a bot challenge) are excluded from numerator and denominator alike, so our own politeness is never scored against a charity.
Not a legal judgment. This page reports measurements in aggregate. Whether any individual site complies with PECR depends on facts we do not hold, and no charity, domain or URL appears on this page - the generator refuses to write a file that contains one.
Quote any figure freely with credit. For a formal reference:
Nebula Design (2026). Cookies, consent and the UK's charity websites. Analytics and consent tooling across 74,548 charity homepages. Nebula Design Research, August 2026. Version 1.0, crawl of 23 August 2026. https://nebula.design/research/uk-charity-cookie-consent-2026/
The aggregate table behind every figure is data.csv - every number on this page can be recomputed from it. All aggregate figures are released under CC BY 4.0; register data is used under the Open Government Licence v3.0 (Crown Copyright). This page carries no information about any individual charity.
