A small shift in UK cookie law - what it means for analytics on charity websites

The legal change: statistical cookies

The Data (Use and Access) Act 2025 introduces a new exemption in the UK’s Privacy and Electronic Communications Regulations (PECR).

This exemption allows organisations to store or access information on a user’s device without prior consent if it is used solely for statistical purposes to improve a website or service.

In other words, some forms of website measurement may now be allowed without asking users to opt in first. However, there are important limits.

The exemption only applies where the data collected is used to produce aggregated statistics, such as:

• total page visits
• counts of interactions with parts of a page
• aggregated browser or device statistics
• aggregated referrer information
• high-level geographic statistics
• page performance metrics

Crucially, the data must not be used to analyse or track individual users, even if those users cannot be directly identified.

Organisations must also:

• clearly explain what the measurement is for, and
• provide users with a simple way to opt out.

So while this is sometimes described as a “soft opt-in”, it is not a free pass to run all analytics without consent.

What this means for Google Analytics

For most organisations using Google Analytics, the change is unlikely to remove the need for consent.

That’s because Google Analytics stores event-level interaction data, which can later be analysed at the level of individual users or sessions.

Even when users are anonymous, the system still retains individual interaction data for analysis. The minimum retention period for this data in Google Analytics is two months.

The new exemption only applies where individual interaction data is used temporarily to produce aggregated statistics and then deleted.

Because Google Analytics retains event-level data and allows analysis of individual journeys over time, most implementations do not meet this requirement.

In practice, most charity websites using Google Analytics should assume that current consent requirements remain unchanged.

What about other analytics tools?

The legislation does not refer to specific technologies. Instead, it focuses on how the data is processed.

This means some analytics tools could potentially operate under the statistical exemption if they:

• only produce aggregated usage metrics
• do not retain identifiable or user-level behaviour
• are not used for profiling, advertising, or cross-service tracking

Some analytics platforms that describe themselves as “privacy-focused” are designed around this principle.

For example, tools like Plausible Analytics limit how long individual interaction information is retained and focus primarily on aggregated reporting. In some cases, data relating to a user interaction may only be retained for a short period (for example, up to 24 hours) before being aggregated.

Tools designed in this way may be more likely to meet the requirements of the statistical exemption, although each implementation would still need to be assessed carefully.

It’s also worth noting that even “cookieless analytics” tools fall under the same legislation if they store or access information on a user’s device. The key question is not whether cookies are used, but whether the data processing meets the definition of statistical purposes.

What might change in cookie banners

Even when consent is not required, organisations must still inform users about statistical measurement and provide an easy way to opt out.

For many websites, this may lead to a new category appearing in cookie banners, separating statistical measurement from other forms of analytics.

For example:

• Necessary cookies – essential for the site to function
• Statistical cookies – aggregated measurement used to improve the site
• Analytics cookies – individual-level tracking requiring consent
• Marketing cookies – advertising and cross-site tracking

Even where the law allows statistical measurement without prior consent, some organisations may choose to continue asking users to opt in anyway.

This may be for reputational reasons, or simply because the organisation wants to maintain a consistent approach to transparency and user choice.

What charities should do now

While this change doesn’t immediately transform how most analytics setups work, it does open the door to new conversations about measurement.

If you’re responsible for digital, data, or marketing in a charity, this may be a good moment to:

Review your analytics approach

Consider whether your organisation really needs detailed individual-level tracking, or whether aggregated insights would answer most of your questions.

Explore alternative analytics tools

Some analytics platforms are designed specifically to minimise personal data and focus on aggregated measurement. These tools may be better suited to the new exemption.

Speak to your legal or data protection team

The statistical exemption relies heavily on how data is processed and retained, so interpretation will often sit with your organisation’s legal or data protection specialists.

Review your consent banner

If your organisation wants to make use of the exemption, you may need to update your cookie categories and messaging to clearly explain statistical measurement and offer an opt-out.

A small step towards more useful analytics

For charities trying to improve digital services, measurement has become increasingly difficult in recent years. Lower consent rates mean less reliable data, which can make it harder to understand how supporters and service users interact with your website.

This change in legislation is a small but potentially helpful step toward enabling organisations to measure and improve services while still protecting user privacy.

However, the key takeaway is that most current analytics setups won’t automatically qualify for the exemption. Any changes will need careful consideration of how data is collected, processed, and retained.

For many organisations, the biggest opportunity may be to rethink your approach to analytics altogether and focus on useful aggregated insights, rather than detailed individual tracking.