The Data (Use and Access) Act 2025 (DUAA) has quietly changed the rules on cookies, tracking and direct marketing — and raised the stakes for getting them wrong.
What changed on 5 February 2026
- Some cookies no longer need consent. Statistical (analytics) cookies, appearance/preference cookies and emergency-assistance cookies are now exempt — but statistical and appearance cookies must still offer users a simple, free way to opt out.
- Fines went up dramatically. Maximum penalties under PECR (which covers cookies, email and SMS marketing) rose from £500,000 to £17.5 million or 4% of global annual turnover, in line with UK GDPR.
What changed on 19 June 2026
People can now complain directly to your organisation about how you handle their data. You must acknowledge complaints within 30 days and resolve them without undue delay — so you need a clear route for complaints and someone responsible for them.
What hasn't changed
Advertising and marketing cookies (Meta Pixel, Google Ads remarketing, LinkedIn Insight Tag and similar) still need prior, informed consent. A banner that loads them before someone clicks “Accept” is still a breach.
Your checklist
- Audit every cookie and tag on your site — including ones added by plugins or agencies.
- Split them into exempt (strictly necessary, statistical, appearance) and consent-required (advertising, most third-party).
- Make sure consent-required tags only fire after opt-in.
- Offer an easy opt-out for analytics.
- Update your cookie and privacy policy, and publish how to make a data complaint.
- Check your email marketing lists and consent records too — the higher fines apply there as well.
Frequently asked questions
Do I still need a cookie banner?
Almost certainly, if you use any advertising or third-party marketing tags. The exemption covers analytics-type cookies only, and they still need an opt-out.
Is Google Analytics now exempt?
Statistical cookies used to improve your own site can be exempt, but configuration matters — for example, if analytics data is shared for advertising, consent is still needed. Get advice on your specific setup.
Who enforces this?
The Information Commissioner's Office (ICO).
How we can help
Every New Vision website build includes a cookie and tracking review. Our free website audit will flag the obvious risks on your current site.
Sources
- Clifford Chance — Key aspects of the Data (Use and Access) Act take effect
- CookieYes — UK ICO cookie guidance
- Information Commissioner's Office
This article is general information, not legal advice.
