In shortUnder the Privacy and Electronic Communications Regulations as amended by the Data (Use and Access) Act 2025 (in force from 5 February 2026), a website may use storage or access technologies without consent where they are strictly necessary, or used solely to collect statistics to improve the site, provided users get clear information and a simple, free way to object.
Advertising, retargeting and tracking of individual visitors still need consent. This is general information for England, Wales and Scotland as at October 2026, not legal advice.
What changed in February 2026
The rules on storing information on, or reading information from, a visitor's device are in the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). Section 112 of the Data (Use and Access) Act 2025 rewrote regulation 6 of PECR so that it applies subject to a new Schedule A1, and the Act's Schedule 12 inserts that Schedule. Legislation.gov.uk records section 112 as in force on 5 February 2026.
Before this, ICO guidance on cookies stated that consent was needed for any cookie that was not strictly necessary, and its older page does not list analytics among the exemptions. Schedule A1 now contains an exception for statistical purposes. The ICO finalised its guidance on storage and access technologies on 29 April 2026.
What the statistical exception covers
Schedule A1 allows storage or access whose sole purpose is collecting information for statistical purposes about how a service is used, with a view to improving it. Two conditions in the Schedule are that the user is given clear and comprehensive information about the purpose and a simple means of objecting, free of charge.
The ICO's guidance adds detail. It says the data must be aggregated, can't be used for other purposes, and that a third-party analytics provider may be used only if it acts for the website operator and does not link the data with other information it holds. It treats page-view totals, scroll depth, device and browser types and A/B testing as likely to meet the exception.
What still needs consent
The ICO says the exception does not cover online advertising, and gives measuring whether a visitor clicked an advert, recordings of individual visitors' actions and profiling visitors by IP address or browsing history as examples that fall outside it. Where a tool goes beyond improving the site, consent is still needed, and the ICO's older cookie guidance describes valid consent as an unambiguous positive action, not continued use of the site.
That is why the question for a law firm is rarely 'do we have a cookie banner?' It is 'what does each tool on our site actually do with visitor data?' Marketing pixels, session-replay tools and embedded third-party widgets often do more than their installers realise.
Why this matters for a firm's website
Visitors to a solicitor's site may be describing sensitive circumstances, so how the site handles their data is part of the trust it conveys. A firm that can say plainly what its site measures, and why, is in a stronger position than one running a default template banner it has never reviewed.
Getting this right is a design and build decision, not a footer afterthought. It affects which analytics are installed, how the privacy and cookie information is written, and how enquiry forms and tracking are set up. It sits alongside the content obligations covered in our guide to SRA-compliant website content. Questions about a particular firm's obligations should go to its data protection adviser or solicitor.
Sources
Data (Use and Access) Act 2025, section 112 and Schedule 12: https://www.legislation.gov.uk/ukpga/2025/18/section/112 and https://www.legislation.gov.uk/ukpga/2025/18/schedule/12 (accessed October 2026).
Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, SI 2026/82: https://www.legislation.gov.uk/uksi/2026/82/contents/made.
ICO, Guidance on the use of storage and access technologies, last updated 29 April 2026: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/.
ICO, Cookies and similar technologies (PECR guide): https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/.