Final guidance dated 29 April 2026; assess the conditions of each exception.
What happened
The ICO finalised its storage and access technologies guidance on 29 April 2026. It covers cookies and similar technologies under PECR, alongside the relevant UK GDPR requirements. The guidance reflects changes including exceptions for certain statistical and appearance-related uses. Those exceptions have conditions; they are not a blanket permission for every analytics or advertising setup.
Source: ICO — original source ↗
What it means for your website
A sensible review starts with what a tool does. A shopping basket, a saved consent choice and a marketing identifier do different jobs. Classify the purpose before deciding whether to block or allow it. Do not rely only on the word analytics in a plugin name. Check which features are enabled, who receives information and whether it is used for advertising. If the position remains unclear, record a warning and investigate rather than marking it as either definitely unlawful or definitely exempt. This is why a public scanner needs an honest review category.
Three useful next steps
- Inventory storage and the scripts that create it.
- Document purpose and any claimed exception.
- Retest the configuration after changing consent controls.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
ICO — original sourceOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.