The cookie banner on your website is probably blocking the wrong thing

Somewhere on your site there is a box asking permission to set cookies. It was added a few years ago by whoever built the site, using whichever tool was the default that month, and nobody has looked at it since.

The law underneath it changed on 5 February 2026, and the ICO published its final guidance on 29 April. Most small business sites are now wrong in the same direction, which is the interesting part: it is not the direction anyone worries about.

What actually changed

The Data (Use and Access) Act 2025 added exceptions to the consent rule in PECR. Three are new. Two of them matter to an ordinary business site: collecting statistics about how the site is used so you can improve it, and remembering how someone wants the site to look: language, layout, accessibility settings. The third covers emergency assistance and will not come up.

Advertising was left exactly where it was. The Meta pixel, the Google Ads conversion tag, the LinkedIn insight tag, anything that collects information to hand to a third party for their advertising purposes. All of it still needs permission before it loads. Nothing in February made that easier.

So the change was narrow, and it was narrow in a specific place: it moved your own measurement out from behind the banner, and left the advertising exactly where it was.

The two things that are usually wrong

The first is that the banner is suppressing your analytics. If your traffic figures dropped off a cliff at some point after the banner went in and never recovered, that is not your marketing. Plenty of people close the box without answering it, and every one of them is invisible to you. You have been making decisions on a partial count and calling it data.

The second is worse and quieter. On most sites we look at, the advertising tags fire on page load regardless of what the banner says, because the banner is a script that draws a box and the tag manager underneath it was never wired to wait. Blocking on consent is something you configure deliberately. It is not what happens by default.

The banner ends up doing the opposite of its job — stopping the measurement you rely on, and waving through the thing the rules were written about.

That combination is common enough that we now check it as a matter of course on any site we take over.

Whether your analytics qualifies is the awkward question

The statistical exception is not a blanket pass. The conditions are specific: the sole purpose has to be collecting information about how the service is used in order to improve it, the picture has to be about how the site is used rather than who is using it, and a third-party analytics provider is only acceptable where it acts on your behalf and uses the data for nothing else.

That last condition is where Google Analytics gets uncomfortable. In its ordinary configuration Google does not only work on your behalf — the data feeds its own purposes as well as yours. If you cannot say honestly that your analytics provider processes that data solely for you, the exception does not obviously reach you, and the conservative reading is to leave analytics behind consent or move to something that plainly qualifies.

We are not going to tell you GA4 is fine. The two groups answering that question most confidently are selling consent tools and selling analytics products, and their answers are predictably opposite.

Exempt does not mean silent

Even where an exception applies, two obligations survive: you have to tell people clearly what is being stored and why, and you have to give them a simple, free way to object.

Twenty minutes with the browser open

You do not need a consultant for the diagnosis. You need a private window and the network tab.

01Open your site in a private window and load a page without touching the banner
02In the browser's developer tools, list every request going to a domain that is not yours
03Decide, for each one, whether it is measurement or advertising

Anything on that list that is advertising should not have loaded. That is the thing to fix first, and it is a tag manager job rather than a rewrite. Anything that is genuinely your own analytics can probably come out from behind the banner, provided it meets the conditions above.

If the list is empty, you may not need a banner at all.

The fines, honestly

The ceiling for this went from £500,000 to £17.5m or 4% of global turnover. Cookie rules are now punishable at the same level as the rest of data protection law.

Nobody is coming for a kitchen showroom in Cheshire. Enforcement follows complaints and scale, and the ICO has been fairly clear that its attention is on advertising. If you are waiting to be frightened into fixing this, keep waiting.

The reason to spend a morning on it is duller. Your traffic numbers are wrong, you have been reading them for two years, and the one thing on the page that genuinely does need permission is the one thing not asking for it. The change in the fine ceiling is only useful in that it moves the job off the list of things you will get to eventually.

5 Feb 2026: New PECR exceptions in force
29 Apr 2026: ICO final guidance published

What we would leave alone

If your site has no advertising tags, no embedded video, and nothing beyond your hosting logs, you probably do not need a consent banner, and installing one because every other site has one makes the site worse for no benefit. We have told clients that and meant it.

And if the banner you have is ugly but correct, leave it. Correct and ugly beats pretty and wrong, and there is nearly always something further up the list.

We build, host and run the marketing for the sites we are describing here, which is why this one is written from having made the call rather than from reading the guidance. If you want someone to open the network tab with you, get in touch — or read what we do on websites and search and digital marketing.