MediumChecked on every planUK
Analytics runs before consent (UK)
Can a UK website run analytics before cookie consent?
Sometimes. Since 5 February 2026, UK law lets statistics cookies run before a choice if visitors are clearly told what they are for, can object simply and for free, and the data is shared only with whoever helps improve the site. Advertising and cross-site tracking still need consent first, and the EU has no matching exemption.
Why it matters
UK law now lets statistics cookies run without prior consent if visitors are clearly told what they’re for, can object simply and for free, and the statistics are shared only with whoever helps improve the site. Miss one condition and consent is needed again. A tool that uses the data for its own purposes may not qualify, and the ICO hasn’t published detailed guidance yet. The EU has no matching exemption.
How to fix it
- Tell visitors, in your banner or cookie policy, that analytics runs before a choice and what it’s for.
- Give a simple, free way to object, such as a Reject button that stops analytics, and check that it does.
- Turn off any setting that lets the analytics vendor use the data for its own purposes, such as advertising or product benchmarking.
- If you also sell to EU visitors, hold analytics until consent: the EU has no matching exemption.
Steps for OneTrust
- Mark each tracking tag with its OneTrust category (snippet below).
- Using Google tags? Turn on Google Consent Mode in your template.
- Load the OneTrust script first in your page head.
Steps for Cookiebot
- In Cookiebot Manager, open Settings, then Your scripts.
- Switch to Automatic blocking and copy the new script.
- Paste it as the very first script on every page.
- Using Google tags? Turn on Consent Mode in the Cookiebot tag, with defaults set to denied.
Steps for Usercentrics
- Open Configuration, then CMP Settings, and turn on Google Consent Mode.
- Add the default-denied script below, high in your page head.
- Add other tags as services in Usercentrics, or through its GTM template, so they wait.
Steps for Didomi
- Open Consent notices, edit your notice, then step 2 Customization.
- Open Integrations, then the Consent Modes tab.
- Turn on Google Consent Mode V2 and tick the Google vendors you use.
- Leave the “Set the default status” options off, so everything starts denied.
Steps for CookieYes
- Open Advanced Settings and turn on “Support GCM”.
- Keep “Allow Google tags to fire before consent” off.
- Put the CookieYes script first in your page head, before other tags.
- Press “Check GCM status” to test.