Privacy · 6 min
The cookie banner that fires too late
· Written by SiteMivo. Drafted with research assistance and checked against the sources below.
PECR regulation 6 is the UK rule for storing or reading information on someone’s device. The Data (Use and Access) Act 2025 inserted Schedule A1. The cookie changes commenced on 5 February 2026. Strictly necessary cookies were already exempt: a basket, a login, a load balancer, the cookie that stores the consent choice. The new paragraphs add a statistics exception and an appearance exception. Both are conditional. The ICO’s storage-and-access guidance says you still have to tell people what you are doing and give them a simple means of objecting. A banner that only says ‘we use cookies’ does not meet that.
The statistics exception is not ‘install Google Analytics and delete the banner’. It is for statistical information used to improve the service, with limits on sharing that data for other purposes. Advertising, retargeting and cross-site pixels sit outside it. If a tag is in the HTML and the banner is a sticker on top, you have already stored the information. Open a private window, watch the network panel, and see what leaves before anyone clicks.
The ICO has been specific about the banner when consent is still required. Reject has to be as easy as accept. A grey ‘manage preferences’ next to a coloured ‘accept all’ is the pattern their reviews of large sites have objected to. Pre-ticked boxes fail. A wall that blocks the page until someone accepts fails, because consent was not freely given. The Planet49 judgment is the case UK guidance still points at for pre-ticked boxes.
The fine ceiling moved with the same Act. PECR penalties used to stop at £500,000. Breaches of the cookie rule can now be fined at the higher UK GDPR maximum: £17.5 million or 4% of worldwide turnover, whichever is higher. That is a ceiling, not a forecast for a twelve-page brochure. It is still the wrong risk to take for a tag nobody is reading.
On a SiteMivo site the default is no banner, because the default is no non-essential storage. If you need a tag that falls outside the exception, it waits for a choice, reject is a real button, and the policy lists what is set and for how long. We will not add a pixel to ‘see how it goes’.