In February, the rules governing that cookie banner on your website quietly changed. If you run the web presence for an association, society or university, the odds are your banner hasn’t. Most haven’t. The Data (Use and Access) Act 2025 rewrote parts of PECR — the regulations that created the cookie banner in the first place — and the changes pull in two directions at once. Fewer cookies now need consent. And the fines for getting it wrong went up by a factor of thirty-five.
That combination deserves an hour of your attention, so here is what actually changed and what to do about it.
What changed on 5 February
Until this year, UK law recognised only two situations where you could set a cookie without asking: cookies needed to transmit a communication, and cookies strictly necessary for a service the visitor asked for. Everything else — including the humble analytics cookie — required opt-in consent. Hence the banner.
From 5 February 2026, three new exceptions apply. Cookies that solely collect statistical information about how your service is used, in order to improve it. Cookies that adapt the appearance of the site to the visitor’s preferences — a saved language choice, say, or a text-size setting. And cookies used to locate someone who has asked for emergency assistance, which is unlikely to trouble your conference microsite but is in there nonetheless.
There are conditions. For the statistics and appearance exceptions you still need to tell people clearly what you’re doing, and you must give them a simple, free way to object. The ICO’s updated guidance — finalised at the end of April — is comfortable with a toggle that defaults to on, provided visitors can switch it off at any time. That is a meaningful shift from the old world, where the toggle had to start in the off position.
The other change is less friendly. PECR breaches used to carry a maximum penalty of £500,000. They are now aligned with UK GDPR: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. Cookie compliance has moved from the “tidy up eventually” pile to the pile with actual consequences.
Why this matters more for membership organisations than most
Analytics is where this bites. Membership and academic websites live on usage statistics — which CPD pages members actually read, where conference registrations stall, what prospective students search for. And for years, the honest answer has been that consent banners quietly starved those numbers. When a sizeable share of visitors dismiss or refuse the banner, your analytics describe a sample you can’t quite characterise.
The statistical exception offers a way back to trustworthy data — with a catch worth reading twice. The exemption covers cookies that solely collect information about the use of your service, for your purposes. Whether your particular analytics tool qualifies depends on what it does with the data. A privacy-focused, first-party analytics setup sits comfortably inside the exception. A free tool that shares usage data with its provider for the provider’s own purposes is a much harder case to make. This is the question to put to your analytics vendor, in writing, before you touch the banner.
What still needs consent
Plenty. Advertising and marketing cookies are untouched by the reforms. So are the third-party cookies that arrive with embedded content — the YouTube session recording on your events page, the social feed in your footer, the map on your venue page. Personalisation that goes beyond appearance, remarketing pixels, A/B testing platforms that profile visitors: all still firmly in consent territory.
One more wrinkle for organisations with international audiences, which is most societies and virtually every congress organiser: these are UK rules. The EU’s ePrivacy regime has not changed, so visitors from Dublin, Rotterdam or Singapore may still need the fuller consent experience. Your consent platform can serve different rules by region; this is the moment to check it actually does.
A sensible way to spend that hour
The work here is modest, and most of it is housekeeping you probably owe the site anyway.
- Re-run your cookie audit. Most websites are carrying cookies nobody remembers setting, and you can’t classify what you haven’t catalogued.
- Ask your analytics provider whether their cookies meet the “solely for statistical purposes” test. Get the answer in writing.
- Reconfigure your consent platform: statistics and appearance cookies can move out of the consent flow, with a clear notice and a working opt-out toggle.
- Check your geo-targeting, so EU and other international visitors still get the consent model their law requires.
- Update your cookie policy to match reality. It is the first thing a regulator reads and the last thing most organisations touch.
Done properly, the prize is a smaller, quieter banner, fuller analytics you can actually plan with, and a compliance position that stands up to the new penalty regime. We’ve spent years helping organisations design around the data their banners threw away; it makes a pleasant change for the law to hand some of it back.
If your cookie banner predates 2026, it’s now describing rules that no longer exist. Worth a look before the ICO takes one.
