UK Cookie Rules May Be Relaxed: Do You Still Need a Banner?

You may have seen the suggestion that cookie banners are about to disappear. Don't act on it. Remove a working banner from a UK website this month and you would be betting your compliance on a press release.

What actually happened is this. On 12 October 2026 the Data and Marketing Association wrote to the UK Government asking it to exempt a long list of routine, low-risk uses of cookies from the consent rules. It is a request, and the Government has said only that it is considering the idea. No date, no draft law, no change.

The story still matters, though, because it tells you which way the rules are heading and what is worth having ready. Here is what was asked for, what has genuinely already changed, and the short list of jobs worth doing this week.

What was asked for, and when

UK cookie consent comes from the Privacy and Electronic Communications Regulations (PECR), a set of rules that dates from 2003. The Data (Use and Access) Act 2025 gave the Government power to widen the list of things that don't need consent, and on 12 October 2026 the DMA asked it to use that power.

The list it proposed covers the boring, everyday functions that keep a site working and safe: service delivery, security, fraud and bot detection, measurement, and accessibility and language preferences. It also asked for relevant advertising and measurement within a company's own relationship with its own customers, but only on strict conditions.

Just as important is what the letter did not ask for. Consent would stay for sensitive data, for profiling children, and for tracking people across unrelated websites. In other words, the intrusive parts of the cookie economy are not on the table.

The Government has confirmed it is looking at how to use the powers. There is no indication of when that might happen, or whether any change would look like what was asked for.

What the regulator has already suggested

The Information Commissioner's Office is not waiting for the DMA. Its current cookie guidance was finalised on 29 April 2026 after two rounds of consultation, and the regulator has already recommended a narrow exemption for certain low-risk advertising, on the basis that it would ease the "consent fatigue" people feel when every page asks them the same question.

Advice is not permission. For that suggestion to change anything on your website, the Government has to legislate, and it hasn't. The ICO has also said its updated advice for small organisations is still being written, with a final version due in autumn 2026. That is one to read when it lands, not to act on now.

What has changed, and what has not

It would be wrong to say nothing has moved. The Data (Use and Access) Act's changes to the cookie rules came into force on 5 February 2026, and they did two useful things. They created exceptions, so statistics gathered to improve your own site, remembered display choices such as text size, and security cookies no longer need consent as long as you tell people what they do and give them a simple way to object. And they raised the maximum penalty for breaking the rules from £500,000 to £17.5 million or 4% of global turnover, whichever is higher. Our earlier piece, UK Cookie Law Changed in 2026, covers that in full.

What has not changed is everything the DMA is now asking for. Extra exemptions for measurement, advertising and fraud detection are additions on top, and they don't exist yet. Until that day, the current rules apply exactly as written.

The regulator is getting stricter, not looser

There is a second reason not to loosen up early: the ICO's own results point the other way. On 14 August 2026 it reported that 992 of the UK's top 1,000 websites passed its cookie compliance checks, with more than half improving their behaviour after engagement and 17 preliminary enforcement notices issued where sites didn't. Nearly all of those notified complied.

Read that as a picture of settled expectations. The big sites have been through the ICO's questions and adjusted. Nobody has been told to stand down while reform is discussed, and enforcement didn't pause for the debate.

What to do this week

None of this needs a lawyer. It needs about an hour and a browser.

1. Find out what your site actually stores. Open it in a private window, don't accept anything, and see what loads. Most businesses find scripts they forgot about, from tools they tried once and left in place.

2. Check that rejecting is as easy as accepting. If "Accept all" is a bright button and "Reject" lives behind a settings menu, that is the single most common failing, and it is exactly what the ICO tested for.

3. Keep a record of the choices visitors make. If you are ever asked to show that people genuinely agreed, a dated log of what they picked is the answer.

4. Refresh consent every so often. An "accepted" tick from three years ago, made by someone whose browser has since been replaced, is weak evidence of a real choice.

5. Put a diary date in. Revisit the setup when an exemption is laid before Parliament, or when the ICO publishes its small-organisation advice, whichever comes first. A quarterly housekeeping routine, like our monthly website maintenance checklist, is a natural home for it.

Why tidying up pays off anyway

Every script you remove makes the site a little faster and a little safer, and every script you keep properly behind consent keeps you on the right side of the rules as they stand. The businesses that will cope best with whatever the Government eventually decides are the ones who already know what their site runs, because adapting a list you have is easy and auditing a mystery is not.

That audit is exactly what our AI Website Audit does. It reads your site the way a regulator's scanner would, lists every cookie and script it finds, flags the ones loading before consent, and hands it all back in plain English with a priority order.

This article is general information about UK cookie rules as they stand on 23 October 2026, not legal advice. For advice on your own situation, speak to a qualified data protection adviser or check the ICO's guidance at ico.org.uk.