Before removing your cookie banner, check what your website actually does. A change in the rules is a reason to review your setup, not a reason to assume every analytics or marketing tool can run without consent.
Your decision depends on the purposes of the technologies you use and whether the relevant conditions are met. Start with a tool inventory, then connect each purpose to the appropriate visitor control.
Why review your setup this September?
The ICO finalised its updated storage and access technologies guidance on 29 April 2026, following consultations and changes associated with the Data (Use and Access) Act. This is a September review of that guidance, not an announcement of a new September law. Read the ICO’s guidance and update history.
For a website owner, the useful task is to compare the current setup with the decisions recorded when the banner was installed. A new advertising pixel, booking widget or analytics integration may have changed the picture. Put the marketing team, developer and whoever maintains your privacy information around the same inventory.
The analytics exception is conditional
The ICO describes a statistical purposes exception for collecting aggregate information solely to improve a website or service. It is not a blanket permission for all analytics. The conditions include clear information and a simple, free way to object. Individual tracking, profiling and online advertising fall outside this exception. A third-party provider must only help with the permitted improvement purpose; individual-level information must not be retained longer than necessary for aggregation. UK GDPR obligations still apply where personal data is involved. Check the ICO’s full conditions.
Do not decide that GA4, or any other named product, qualifies simply because its menu says “analytics”. Ask which features are enabled, what information is retained, who receives it and what each recipient does with it. A public scan cannot settle those questions.
Five checks before changing your banner
- List the technologies. Start with your homepage, then add forms, video embeds, booking pages and checkout. Record the tool, supplier, page and person responsible. Include tools installed outside your tag manager.
- Write down each purpose. Separate website improvement, advertising, personalisation and functions requested by the visitor. Ask your developer or adviser to document the basis for the chosen treatment.
- Match the controls to the decision. Check that the interface explains what each choice does. If relying on an exception with an objection requirement, make that route clear and test it.
- Compare behaviour with the wording. Test a fresh visit, rejection, acceptance and a later change of mind. Keep technical observations separate from assumptions about what a tool should do.
- Update the supporting information. Compare the live inventory with your cookie policy. Test links and controls on a phone, then assign an owner and date for any follow-up.
What is installed, where and for which purpose?
What happens when a visitor makes a choice?
Do the controls and policy match the setup?
A worked example: from signal to question
Illustrative example · not a live scan
A fictional business website
Imagine a homepage result showing a banner, a cookie-policy link and a Google Tag Manager signal. Those observations give the reviewer a starting point.
- Record: the scan date, tested URL and visible signals.
- Do not conclude: that the policy is accurate, all tags are controlled or an analytics exception applies.
- Next action: ask for the tag inventory, test the visitor choices and compare the policy with the actual purposes.
CookieBanner Check can help WordPress owners collect initial public homepage signals. Pair it with the free UK cookie checklist. For a repeatable browser test, follow what happens after Reject All; for interpreting results, read what a cookie scanner can and cannot tell you.
What to keep from the review
Keep a short decision record: the inventory, selected treatment for each purpose, evidence captured, unresolved questions, changes made and retest date. A clear record is more useful to your next developer than a screenshot saying everything passed.
For background, see the cookie-banner basics guide and Google Analytics and UK cookie consent.
Unsure what your website needs?
Send your public URL and the question you want answered. An initial check can help identify the appropriate review scope.
Request a free initial check
Leave a Reply