By Marc Alexander

For the full picture of what UK GDPR and PECR ask of GA4, read GA4 and UK GDPR.

What changed.

New exceptions to consent. Alongside strictly necessary storage, PECR now has exceptions for statistics (analytics used to improve a site), appearance (remembering how a visitor wants the site to look or work) and emergency assistance.

Bigger fines. PECR fines now match UK GDPR: up to 17.5 million pounds or 4% of global annual turnover, whichever is higher. They apply to breaches from 5 February 2026.

Wider scope. The ICO's guidance covers every storage and access technology, not just cookies: pixels, scripts, local storage and fingerprinting.

The analytics exception is narrow.

Analytics can run without consent only if every one of these is true:

  • it's used only to improve the site, and the data is aggregate
  • any provider acts only as a processor, on the site's behalf
  • it's never used for advertising, or to identify, track or monitor people
  • visitors are told clearly what it's for
  • there's a simple, free way to object, and browser settings alone don't count

GA4 linked to Google Ads, Google Signals switched on, or data shared with ad platforms usually take a setup outside it. So does session recording, which follows individual visitors.

Marc's advice: ask first.

The site has to meet every condition and be able to prove it, and many GA4 setups are linked to Google Ads. Marc's advice is to treat analytics like advertising and ask for consent before it runs. It's the position that holds up when someone checks.

What the banner has to do.

The ICO's final guidance is specific about banners:

  • refusing must be as easy as accepting, with Reject on the first layer
  • switches start off, and scrolling or carrying on doesn't count as consent
  • visitors can change their mind as easily as they agreed
  • about six months is the ICO's suggested time before asking again

What to do now.

  • Check what fires before a choice. The free tracking checker shows which tags run on a first visit.
  • Check the banner against the list above, on a phone as well as a laptop.
  • Check GA4's advertising links and Google Signals, and switch off what you don't use.
  • Keep session recording behind consent. The session recording article explains why.

A GA4 mini audit checks all of this for your site, and Consent Mode v2 setup puts it right. This article explains how tracking works, not legal advice.