GA4 and the cookie banner: what UK law requires of a small shop

This guide is for anyone running a small UK shop who wants Google Analytics 4 (GA4) and Google Ads conversion tracking and keeps reading about cookie fines. By the end you will know what UK cookie law requires in November 2026, when the new analytics exception applies, what makes a cookie banner lawful, and how to set the tags up. Disclosure: we build Orbit Commerce, a hosted ecommerce platform with a consent banner and tag settings built in, so weigh the Orbit section accordingly. Every rule below was read at its linked source on 9 November 2026. It is general information, not legal advice.

What does UK cookie law actually say in November 2026?

Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR), rewritten on 5 February 2026, says: “Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user” (regulation 6). It covers any information, not only personal data, and any technology: cookies, pixels, local storage, fingerprinting, scripts and tags (ICO guidance). Where the information is personal data, as cookie IDs and IP addresses are, the UK GDPR applies too, and where PECR needs consent you cannot fall back on legitimate interests (ICO). The exceptions sit in Schedule A1 (Schedule A1), here with the ICO’s examples (ICO, the exceptions):

Strictly necessary is judged from the shopper’s point of view and “doesn’t apply to things that may be ‘useful’ or ‘convenient’” (ICO, September 2025); the ICO adds that “there are no advertising purposes that meet the strictly necessary exception”. Anything outside these exceptions needs consent.

What changed on 5 February 2026?

The Data (Use and Access) Act 2025 made two changes (the Act): section 112 rewrote regulation 6 and added Schedule A1, and section 115 moved PECR enforcement onto the Data Protection Act 2018 powers used for the UK GDPR. Both took effect on 5 February 2026, and earlier conduct is judged by the old rules (SI 2026/82). The Secretary of State can now add or vary exceptions by regulations approved by both Houses (regulation 6A), and the ICO has been working with government on whether some low-risk advertising could run without consent (ICO, December 2025), work it called ongoing in April 2026 (ICO, April 2026). On 9 November 2026 Schedule A1 still shows the same seven paragraphs and no outstanding changes, so advertising tags still need consent. This is the part most likely to move; check the ICO’s pages first.

Does the new analytics exception cover Google Analytics?

Paragraph 5 of Schedule A1 allows collecting information “for statistical purposes about how the service is used with a view to making improvements to the service” without consent. The conditions are that this is the sole purpose, the data is shared with nobody except to help improve the service, visitors get clear information and “a simple means of objecting, free of charge”, and have not objected. The ICO adds that a third-party provider “must be a processor, not a joint controller”, and that ad measurement, linking visitor IDs to purchases shared with ad partners, and profiling fall outside it.

The ICO names no product, so this is our reading, not a ruling. Google says it “operates as a data processor for Google Analytics” (Google), but three settings decide whether it stays one. One data sharing setting lets Google use your data to improve its own products, including Google Ads tools; only with every setting off is your data “only used to provide and maintain the Analytics service” (Google, data sharing).

Second, Google signals adds remarketing audiences from signed-in Google users. Third, linking GA4 to Google Ads for conversions or audiences makes it advertising measurement, which the ICO says needs consent whatever the technology (ICO, online advertising). A shop running GA4 with sharing off, no signals and no Ads link has a reasonable case; one that advertises on Google is outside the exception once it links the accounts. Even inside it you still owe visitors the information and a way to object. Asking for consent even where the exception might apply is the cautious route, and it is Orbit’s: GA4 waits until the shopper allows Analytics.

What makes consent real, and what does the ICO check?

The ICO’s consent page is specific (ICO, consent in practice). Consent needs “a positive action”: “silence or inactivity doesn’t qualify”, and “you cannot assume that people who don’t engage with your consent mechanism have agreed”. Consent toggles start off; the first layer shows “equally prominent options to ‘accept all’ or ‘reject all’”; nothing needing consent is set before the choice; the information behind the banner names each technology, its purpose, its duration and any third party (ICO, how to comply). Withdrawing is as easy as agreeing, and you “must be able to demonstrate that someone has provided consent”, as Article 7 of the UK GDPR requires (Article 7).

Those are the tests the ICO ran on the UK’s 1,000 most visited websites through 2025: advertising cookies before a choice, rejecting harder than accepting, cookies after a refusal. By 4 December 2025, 979 of the 1,000 passed, 564 of them after ICO engagement, with 17 preliminary enforcement notices along the way; by April 2026 the figure was 99%.

How big are the fines now?

Until 5 February 2026 the ceiling for a PECR fine was £500,000 (ICO guide to PECR, which still shows that figure and flags itself as under review). Since then Schedule 1 to PECR has applied the Data Protection Act 2018 penalty rules to regulation 6 at the “higher maximum amount” (PECR Schedule 1): £17,500,000 or 4% of total annual worldwide turnover, whichever is higher (DPA 2018, section 157), as the ICO confirmed on the day (ICO, 5 February 2026). In June 2026 the ICO said it was “currently developing separate guidance to cover these higher fines” and would use them “where necessary for the most serious cases” (ICO, June 2026). Its small-business page says its “focus is on supporting and enabling you to comply, and not on fines” (ICO, fines). The rules still “apply to any organisation running an online service” (ICO, the rules).

Do you need Google Consent Mode v2?

Consent Mode is how Google’s tags hear your banner: it “lets you communicate your users’ cookie or app identifier consent status to Google” and “doesn’t provide a consent banner or widget” (Google). The banner passes four signals: analytics_storage, ad_storage and the two added in November 2023 that make it v2, ad_user_data and ad_personalization (Google developers). Google’s own policy requires consent for people in the EEA, the UK and Switzerland (Google consent policy). The ad_user_data signal “is required for regions that require end-user consent: the European Economic Area (EEA), the United Kingdom, and Switzerland” (Google Ads). Google adds that “personalized advertising and remarketing will require affirmative end-user consent signals” (Google Analytics).

Basic consent mode blocks Google’s tags until consent, so for someone who declines “no data is transferred to Google at all, not even the consent status”. Advanced loads the tags first and sends “cookieless pings” when consent is refused, which Google uses to model the gaps (Google Analytics, consent mode). Orbit sets the four signals from the shopper’s choice, updates them if it changes, and holds each tag until its category is allowed. That is the basic pattern: when a shopper presses Reject all, Google’s tags do not load.

How do you set up GA4 and Google Ads conversions on a shop?

1. Connect GA4. Copy the Measurement ID (G-) from Admin, Data Streams; on Orbit, open Settings, Customer Tracking, press Connect on the Google Analytics card, paste and save (tracking and pixels).
2. Check what arrives. Orbit sends page_view, view_item, add_to_cart, begin_checkout, purchase and search, without a tag manager to set up; Google marks purchase as a key event by default (Google) and its transaction_id “helps you avoid getting duplicate events for a purchase” (GA4 events). Then choose your data sharing and Google signals settings deliberately and note the choice on your cookie page.
3. Add Google Ads by importing the GA4 purchase key event, or by creating a conversion action and pasting its conversion ID (AW-) and labels into Orbit, which then sends each purchase with the order value and the order’s ID so Google counts it once. Google says setting each action as primary (biddable) or secondary (observation only) “is critical” (Google Ads).
4. Test and publish. In a private window, Reject all and confirm nothing fires, then Accept all and confirm the event arrives. Write the cookie page, link it from the banner, and change the banner version whenever a tag changes.

Can server-side or “cookieless” tracking avoid the banner? Not by itself: the ICO says regulation 6 applies “in both a ‘client-side’ and ‘server-side’ context where information is stored or accessed on a device”, and the question is always whether the purpose fits an exception. Measuring ads and profiling people always need consent.

What should a small shop do this week?

1. List every tag and script on your site, including those a theme or plugin adds.
2. Put each in a category; if one does two jobs, the stricter wins.
3. Turn the banner on, with Accept all and Reject all side by side and only strictly necessary on by default.
4. Write a cookie page: each technology, its purpose, its lifetime and the third party behind it, linked from the banner. Our own cookie policy and privacy policy show the shape.
5. Rewrite the banner text to describe what you actually run, keep the record of choices, and change the banner version whenever anything changes.

Where Orbit fits

Orbit Commerce includes the banner and the tag settings on every plan, from Solo at £25 a month, ex VAT (pricing). A new shop starts with the banner on, Reject all and Accept all side by side and a Manage preferences panel; Strictly necessary is always on and the other three categories start off, with the layout, colours and wording yours to change. GA4 waits for Analytics; Google Ads, Meta, TikTok, Snapchat, Pinterest and every custom script wait for Marketing.

Google’s tags get the four Consent Mode v2 signals and an update if the shopper changes their mind, and each choice is logged against the banner version the shopper answered (tracking and pixels). The banner’s policy link is yours to set: build your cookie page in the page builder and paste its address in. Nebula, the dashboard assistant, can connect the tags for you, and the optional Google Shopping Feed app from the plugin store can create your two Google Ads conversion actions and write the IDs in. Our guides to Google Shopping in the UK and Performance Max cover the ad side.

You also get a figure that needs no tag. Orbit credits each paid order to the channel the shopper first arrived from, in pounds, without GA4 or an ad pixel; orders always count whatever a shopper chooses on the banner, because they come from your order records (insights and analytics). More of what the shop does without a tag is in SEO that ships by default.

Read next: popups and banners that do not cost you customers and two-factor sign-in and passkeys.

Questions people ask about GA4 and cookie banners

Do I need a cookie banner to use Google Analytics 4 in the UK?

Almost always, yes. GA4 stores and reads information on the shopper’s device, so it needs consent unless you meet every condition of the statistical purposes exception; linking GA4 to Google Ads or switching on Google signals takes you outside it, and even inside it shoppers must be told and able to object.

Are analytics cookies strictly necessary?

No. The ICO says strictly necessary means the service the shopper asked for could not be provided without the storage, judged from the shopper’s point of view, not things that are merely useful or convenient. Advertising is never strictly necessary and needs consent.

How much can the ICO fine a small shop for cookies?

Since 5 February 2026 the ceiling for a regulation 6 breach has been £17.5 million or 4% of worldwide annual turnover, whichever is higher, up from £500,000. The ICO says it reserves penalties for the most serious infringements and that its focus with small organisations is on helping them comply, not on fines.

Do I need Google Consent Mode v2 for a UK shop?

If you use any Google tag, yes in practice. Google requires the ad_user_data signal for the EEA, the UK and Switzerland, and personalised advertising and remarketing only run for shoppers whose signals say yes. Consent Mode is how your banner tells Google’s tags what the shopper chose, so you still need the banner.

Can a shopper who rejects cookies still buy from my shop?

Yes. The basket, the checkout, the sign-in and the cookie that remembers their choice are strictly necessary, so they run whatever the shopper pressed. On Orbit, decline Analytics and GA4 does not load; decline Marketing and the ad tags do not either. The order still counts in your reports.

Connect your tags on the 14-day free trial, no card required, press Reject all on your own phone and watch the tags stay silent, then publish your cookie page and pick a plan.