Docs

UK PECR Statistical Purposes Exemption Tracking

The UK's new PECR exemption lets consent-free analytics run under an opt-out — what to track to prove you qualify and stay inside its limits.

Analytics

Since 5 February 2026, UK law has included a statutory “statistical purposes” exception to PECR, letting analytics cookies and similar technologies run without prior consent — provided users get a clear, accessible opt-out and the data is used only in aggregate for measuring site or app performance. For product and marketing teams who’ve spent years building consent-gated analytics that undercounts real usage, it’s a meaningful change. But the exemption is narrow by design: it covers first-party, aggregate, statistical measurement, and nothing else. It does not cover behavioural profiling, ad targeting, cross-site tracking, or fingerprinting-adjacent techniques, even when they ride along in the same tag manager container as a legitimate analytics pixel.

The gap most teams will hit isn’t malicious scope creep, it’s bundling. A single analytics script frequently does more than count visits — it may also feed a personalisation engine, an ad platform, or a cross-device identity graph, and none of that secondary use is covered by the statistical-purposes exemption. Claiming the exemption for a tag that’s doing more than statistics is the kind of finding that shows up in an ICO enquiry, not a self-audit, which is exactly why the tracking here matters: you need to be able to demonstrate, per script, exactly what it does and that it stays inside the exemption’s boundary. The EU’s parallel Digital Omnibus proposal covers similar ground for aggregated first-party measurement, but as of mid-2026 it remains a proposal, not law — so UK and EU traffic still need to be handled differently.

Data Points to Track

  • Opt-out visibility and interaction rate on the statistical-purposes notice — confirming the opt-out is presented with genuine prominence, not buried, and logging how often it’s actually used
  • Purpose scope per tracking tag — an audit mapping every analytics script to what it actually does downstream (pure measurement versus profiling, targeting, or identity resolution), since exemption eligibility is per-purpose, not per-tag-manager-container
  • Aggregation level of stored analytics data — verification that no individually identifiable records are retained beyond what aggregate statistical reporting requires
  • Opt-out enforcement at the event level — a session-level check confirming that users who opt out generate zero analytics events, not just that a cookie was suppressed while a server-side call still fired
  • UK versus non-UK traffic split — since the exemption is UK-specific, visitors outside the UK still need standard consent, and misclassifying region is the most common way this exemption gets over-applied

Setup Steps

  1. Classify every script running under your analytics tag by actual purpose, not by vendor name, distinguishing pure statistical measurement from anything that also profiles, targets, or resolves identity across sessions.
  2. Add explicit UK-region detection ahead of the consent/exemption logic, so only genuinely UK traffic is served the no-consent statistical path while other regions still see a standard consent request.
  3. Build an opt-out visibility check into your QA process — render the actual notice as a user would see it and confirm the opt-out is not visually subordinate to any accept option.
  4. Implement and test opt-out enforcement end to end, confirming that opting out stops analytics events client-side and server-side, not only that a consent flag gets set.
  5. Document your aggregation methodology and purpose mapping, and revisit both whenever ICO guidance updates or the EU Digital Omnibus proposal moves — the exemption’s practical boundaries are still being clarified.

Actionable Insights

Purpose-scope mapping is the single most valuable check here, because it’s the one most likely to reveal that a script you’ve been treating as “just analytics” is quietly feeding something the exemption doesn’t cover — the fix is usually splitting that script’s payload rather than abandoning the exemption altogether. A rising opt-out interaction rate combined with stable event enforcement tells you the notice is both visible and technically honoured, which is the exact evidence an ICO enquiry would ask for first. Region misclassification is worth checking early and often — it’s the quiet failure mode that turns a compliant UK-only exemption into unlawful tracking of EU or international visitors.

Expert help

Need help tracking this in your app?

Our team sets up analytics pipelines for mobile and web teams every day. Talk to us and get your first events flowing in under an hour.

Talk to an expert