Website Tracking Compliance in the United Kingdom
What applies in this market
United Kingdom: UK GDPR and PECR.
Law explainers for this market
Summary
Website tracking is legal in the UK with consent. The UK GDPR and the Privacy and Electronic Communications Regulations (PECR) require consent before non-essential tags fire. Since February 2026, the Data (Use and Access) Act lets some analytics cookies used only for statistics run without prior consent, under a narrow exception, and raises the maximum cookie fine to £17.5 million.
For a UK site, the practical picture is close to the EU with one meaningful difference: a real but limited opening for privacy-focused analytics, layered on top of the same consent-first baseline.
The sections below cover the rules that govern UK website tracking, what compliance requires in practice, and where enforcement comes from. The last section shows how to verify your UK site.
The rules that govern UK website tracking
UK GDPR and PECR. PECR requires consent before a site stores or reads anything on a visitor’s device, and the UK GDPR governs the personal data that follows. The Data (Use and Access) Act adds an opt-out exception for aggregate analytics and raised PECR fines to UK GDPR levels. UK GDPR and PECR, in full.
The DUAA analytics exception. Analytics cookies used only for statistics to improve your site, with data shared only with someone helping make those improvements, a clear notice, and a simple, free way to object, can run on an opt-out basis. The ICO says the exception doesn’t cover tracking individual visitors, and the provider must act on your behalf. Check each tool, including Google Analytics, against both tests.
What UK tracking compliance requires in practice
Collect consent before non-essential and advertising tags fire, including Google Analytics. Make the choice real, with reject as easy as accept and no pre-ticked boxes, which the ICO expects. And if you rely on the analytics exception for a specific tool, confirm that the tool genuinely stays aggregate rather than assuming it qualifies.
Where the enforcement comes from
The ICO enforces the UK GDPR and PECR. With PECR penalties now reaching £17.5 million or 4 percent of global turnover, a cookie failure carries the same scale of exposure as a data protection breach. For specific ICO actions, see our Enforcement Watch tracker.
How to verify your UK site
The decisive questions are testable: does a non-essential or advertising tag fire before consent, and does a tag you treat as exempt actually stay aggregate. DataTrue loads your site in a real browser, with consent granted and declined, and records what each tag sends, so you can confirm Google Analytics and advertising tags wait for consent and see what any exception-reliant analytics tag actually transmits. Sensitive Data Detection inspects the payloads with fictitious personas.
See how consent verification works
Questions
Is website tracking legal in the UK?
Yes, with consent before non-essential tags fire, under the UK GDPR and PECR. As of February 2026, the Data (Use and Access) Act lets some analytics cookies used only for statistics run without prior consent, but the exception is narrow, so check each tool, including Google Analytics, against the ICO’s tests.
Is Google Analytics legal in the UK?
Check it against the ICO’s two tests. Tools whose provider uses the data for its own purposes, or that track individual visitors, fall outside the DUAA analytics exception and still need consent before they fire, the same as in the EU. See our UK GDPR and PECR page for the detail.
How much can you be fined for cookie violations in the UK?
Up to £17.5 million or 4 percent of worldwide annual turnover, since February 2026. The Data (Use and Access) Act raised PECR penalties to UK GDPR levels from a much lower cap.
Is the UK still the same as the EU on cookies?
Mostly, with one difference. The consent-first baseline is the same, but the UK now allows an opt-out for genuinely aggregate analytics that the EU does not. For advertising-linked tools the rules are unchanged.
Related guides
See what your tags do in every consent state
DataTrue loads your real pages as a visitor who accepts, rejects, or sends an opt-out signal, and reads what each tag sends. A tag that ignores the visitor’s choice shows up in a test.
- Every page, with coverage scans
- Scheduled runs, with alerts when a result changes
- Full journeys, like checkout and signup, in each consent state
- What each tag sent, field by field
- PII detection with test personas
- iOS and Android app testing
- Pre-publish testing for GTM and Adobe Tags
- REST API, plus Slack and Jira alerts
The full platform, every feature, free for 30 days.
