What changed
The ICO’s finalised storage and access technologies guidance gives organisations a clearer basis for reviewing how analytics, tracking and consent settings work in practice.
Although the guidance covers a wide range of technologies, it is especially relevant for organisations using website analytics, tracking pixels, tags, scripts, advertising tools, consent banners or similar systems that store or access information on a user’s device.
Why does analytics need reviewing?
Analytics tools often involve storing information on, or accessing information from, a person’s device. That means they may fall within PECR even where the organisation sees them as “just measurement” or “basic website improvement”.
Why this matters
Many organisations assume analytics is low risk because it does not feel like advertising or direct marketing. In practice, the key question is not just what the organisation calls the tool, but what the technology actually does and whether consent or another route is required.
Consent settings also need to match reality. If a banner says only essential cookies are active, but analytics tags or tracking pixels are firing before consent, the website may not reflect the choices being presented to users. For wider updates across privacy, marketing and data protection, see our Regulatory Updates page.
What organisations should do
Organisations should review analytics and tracking tools as part of a wider website compliance check.
- Check what analytics tools, pixels, tags and scripts are active on the website.
- Review whether those technologies store information on, or access information from, a user’s device.
- Confirm whether analytics tools fire before or after consent is given.
- Check whether the cookie banner accurately reflects the technologies being used.
- Review whether cookie notices and privacy information explain analytics and tracking clearly enough.
Practical takeaway
Organisations should not assume analytics is automatically compliant because it feels routine. The practical task is to check what tools are active, when they fire, what they do, and whether the consent experience matches the reality of the website.
Grounded in
ICO final guidance on storage and access technologies, including the application of PECR to cookies, tracking pixels, scripts, tags, web storage and similar technologies used for analytics, measurement and online tracking.
Sources
- Information Commissioner’s Office: final storage and access technologies guidance published , 29 April 2026.
- Information Commissioner’s Office: guidance on the use of storage and access technologies .