Privacy in digital marketing

This guide is for information only and isn't legal advice. If you need advice on how privacy law affects your business, speak to a legal professional.

Advertising online almost always means tracking: knowing which ads bring in enquiries, and telling the ad platforms so they can find more. Tracking relies on cookies and similar technology, and privacy law says how you may use them. Here are the basics to have in place before your first campaign.

Which rules apply

There's no single privacy law online. In the UK, the two that matter most for advertisers are UK GDPR and the Privacy and Electronic Communications Regulations (PECR), often called the cookie law. The EU has its own versions, the GDPR and the ePrivacy rules.

• UK GDPR sets out what organisations must do to collect, store and use personal data, including telling people what you collect and why.
• PECR says you mustn't store or read information on a visitor's device, through cookies or similar tracking, unless the visitor consents or an exception applies.

UK GDPR can apply to a business outside the UK too, if it offers goods or services to people in the UK or monitors their behaviour there. Other privacy laws may apply to you as well, so it's worth checking your own responsibilities. This guide covers the basics only, and describes the UK rules.

What the Data (Use and Access) Act changed

The Data (Use and Access) Act 2025 changed PECR's cookie rules. The changes came into force on 5 February 2026, and the ICO finalised its guidance on them in April 2026.

• Statistics-only analytics no longer needs consent, when the conditions are met. You can count how people use your website without asking first, if the only purpose is to improve your site, you give visitors clear and comprehensive information about it, and they have a simple, free way to object. The ICO adds that the data mustn't be shared, except with a provider that only uses it to help you improve your site.
• Remembering a visitor's settings, such as how your site looks or works for them, is covered on the same terms. Security and fraud prevention are now named as strictly necessary, so they don't need consent either.
• Advertising cookies, conversion tags and pixels still need consent. The ICO says that for online advertising you can't rely on any of the exceptions. That includes conversion tracking shared with advertising partners: the tags and pixels that tell an ad platform who enquired or bought.
• Fines are higher. The ICO can now fine up to £17.5 million or 4% of global turnover for breaking PECR, the same maximum as UK GDPR.

Analytics that's linked to your advertising, or that your provider uses for its own purposes, falls outside the statistics exception. The ICO's guidance doesn't say whether any particular Google Analytics setup qualifies, so don't assume yours does: check it against the conditions in the ICO's guidance on the exceptions, which has the detail and examples.

Privacy and cookie policies

Your website needs a privacy policy that explains what data you collect about your customers and how you use it. You also need to explain your use of cookies and similar technology, usually in a cookie policy, which can sit inside the privacy policy.

The ICO offers a privacy notice generator, and some consent management platforms provide policies too.

How consent decides what runs

Consent is usually asked for in a banner, where visitors can accept, reject or customise which kinds of cookie they allow. Tags that need consent wait for it. Advertising tags, including the ones that record your ad enquiries, run only once a visitor has said yes. Statistics-only analytics and remembered settings can run from the start, and stop if the visitor objects.

A visitor arrives

javaroasters.co.uk

↓→

Your banner asks first

javaroasters.co.uk

We use cookies to run this site and count visits. With your permission, we also use them to advertise.

Reject Accept all Customise

Their choice decides which tags may run

Kind of tag	Before a choice	Rejected	Accepted
Essential What the site needs to work, including security	Runs	Runs	Runs
Settings Remembering a visitor's choices, such as their language	Runs	Held	Runs
Statistics only Counting visits to improve your site, kept to you	Runs	Held	Runs
Other analytics Linked to advertising, or used by the provider for its own ends	Held	Held	Runs
Advertising or marketing Including your ad conversion tags and pixels	Held	Held	Runs

Cookie banners

Most website builders have a cookie banner built in, or offer one as a plugin. If you're a developer and want a free, open-source option, we recommend CookieConsent.

A banner on its own is usually enough for a simple website, as long as:

• you don't have more complex needs, such as user accounts
• you don't place third-party ads on your website
• you don't need to keep logs as proof of consent

Your banner should split consent into categories, like the ones in the table above. Essential cookies don't need consent. Statistics-only analytics can be switched on by default, as long as visitors can turn it off; the ICO suggests a toggle in your banner. The rest need a yes.

Consent management platforms

A consent management platform, or CMP, is the fuller option. It includes a cookie banner, plus the records and tools behind it.

A CMP also connects to your marketing and analytics tools. If you're unsure whether a banner is enough, a CMP is worth considering. There are many to choose from; pick one in Google's Certified CMP Partner Program.

How Digital Gurus helps

Before your campaign launches, we check that your cookie banner asks for consent. If you need a simple banner, we can add one to your website through Google Tag Manager, set up for you with CookieConsent. If you need a consent management platform, we can usually install that through Tag Manager as well. Either way, we connect your tracking to it so tags wait for consent.

We can't write your privacy or cookie policies. For help with a banner or CMP, email [email protected].

Sources

Checked on 2 October 2026. The law and the ICO's guidance can change, so follow the links for the current text.

• legislation.gov.uk: UK GDPR, Article 3 (territorial scope)
• ICO: The right to be informed
• legislation.gov.uk: PECR, regulation 6 (storing or accessing information on a device)
• legislation.gov.uk: Data (Use and Access) Act 2025, section 112 (the new cookie rule)
• legislation.gov.uk: Data (Use and Access) Act 2025, Schedule 12 (the new cookie exceptions)
• legislation.gov.uk: Data (Use and Access) Act 2025, Schedule 13 (PECR enforcement and fines)
• legislation.gov.uk: Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026 (S.I. 2026/82)
• ICO: Statement on the commencement of the Data (Use and Access) Act, 5 February 2026
• ICO: Guidance on the use of storage and access technologies, about this guidance
• ICO: Guidance on the use of storage and access technologies, what are the exceptions?