Cookie Banners Are Not Disappearing: The One UK Exemption That Is Real
October 29, 2026
Cookie banners are not disappearing. The headlines this autumn have conflated two separate stories: a European proposal that has not become law, and a narrower UK change that has. Only one of them is real, and it applies to far fewer sites than the coverage suggests.
The European Commission proposed the Digital Omnibus on 19 November 2025, and it is this proposal, not anything already in force, that sits behind most of the “cookie banners are ending” coverage. It remains a proposal. The Council of the European Union has already dropped Article 88b, the mechanism that would have let a browser signal stand in for one-off consent, from its own negotiating text. Article 88a, the broader whitelist provision, has not been reported dropped. Nobody credible currently expects the Omnibus to be in force before 2027, assuming it survives in anything close to its original form.
Under the ePrivacy Directive as it stands today, every non-essential cookie in the EU still needs opt-in consent before it is set. Nothing about that has changed, and nothing is scheduled to change imminently.
The UK's Data (Use and Access) Act amended the cookie rule in the Privacy and Electronic Communications Regulations (PECR), and that amendment has been in force since 5 February 2026. It adds three new exemptions to the two that already existed:
None of the three touches advertising, retargeting or cross-site tracking. Anything doing that still needs full, opt-in consent under PECR, exactly as before. The consent standard itself has not moved either: PECR borrows it wholesale from the UK GDPR, specific, informed, freely given, and as easy to refuse as to accept.
The exemptions are conditions, not permissions, and all of them have to be met together. A site can only drop its cookie banner if its audience is UK-only, it carries no advertising or tracking pixel of any kind, and its analytics are reconfigured to meet all four conditions PECR sets for the first-party analytics exemption specifically.
That third condition catches more sites than it looks like it should. A default Google Analytics 4 setup fails it, because Google Signals shares data onward by default, and sharing data onward is exactly what the exemption does not allow. Reconfiguring GA4 to qualify means switching Google Signals off deliberately, not assuming the default is already compliant.
Put together, this rules out most of what we build. Anything carrying a LinkedIn Insight Tag, a Meta Pixel, or a Google Ads conversion tag, which describes most commercial sites, keeps the banner regardless of what it does with analytics.
For most organisations the practical answer is the one the headlines undersold: the banner stays. The useful work is not waiting for an exemption that, for most sites, will never arrive. It is checking now whether your own analytics setup would meet it if it ever mattered, because most will not without a deliberate change.
