Consentfolio The ICO's 2026 Cookie Guidance, Explained
The ICO finalised its guidance on storage and access technologies on 29 April 2026, after consultations in December 2024 and July 2025. It sets out how PECR works following the DUAA 2025: what a compliant banner looks like, what the new exceptions require, and how to handle a technology used for more than one purpose. The headline rule is unchanged: a visitor must be able to reject non-essential cookies as easily as accept them.
The guidance is the practical companion to the law. PECR sets the rule; the ICO guidance tells you how the regulator expects you to meet it.
What the ICO expects from a banner
The guidance restates and clarifies the core requirements.
- Equal prominence. "Accept all" and "reject all" with the same visual weight, the reject option as easy to find and use as accept.
- Prior blocking. Non-exempt cookies and tags must not fire before the visitor consents.
- No pre-ticked boxes. Sliders defaulting to on do not count as consent.
- No consent by continued browsing. Scrolling or clicking through is not agreement.
- No dark patterns. Hidden reject buttons and nudging wording invalidate consent.
The two new sub-chapters
The finalised guidance added two sections that answer questions raised in consultation.
| New section | What it clarifies |
|---|---|
| A simple means of objecting | For the statistical and appearance exceptions, visitors need a straightforward, free way to opt out. The guidance explains what "simple" means in practice |
| Using one technology for multiple purposes | How to handle a single cookie or tag that serves both an exempt and a consent-requiring purpose. The consent-requiring purpose governs |
The second point catches a common trap. If one tag does something exempt and something that needs consent, you cannot lean on the exemption. You need consent for the whole tag.
What did not change
The equal-prominence rule, prior blocking, and the ban on dark patterns all stand. The DUAA relaxed three narrow categories, covered in the DUAA 2025 and cookies, but the everyday obligations for advertising and tracking cookies are the same. The ICO also continues to treat "consent or pay" models as unsettled, so approach that route with caution.
Sources
- ICO guidance on storage and access technologies
- ICO: about this guidance
- Data (Use and Access) Act 2025 (legislation.gov.uk)
Frequently asked questions
When was the ICO's cookie guidance finalised? On 29 April 2026, following consultations in December 2024 and July 2025. The underlying PECR changes took effect on 5 February 2026.
Does the guidance change the reject button rule? No. Equal prominence stands: reject must be as easy as accept. The guidance reinforces it. See cookie banner design.
What if one cookie serves two purposes? If a cookie serves both an exempt and a consent-requiring purpose, the consent-requiring purpose governs, so you need consent for it.
Written by Tudor Rusmanica, founder of Consentfolio. Tudor has spent over a decade in agency SEO, working where search performance meets data protection: the analytics, tagging and consent setups that keep measurement useful and lawful. Connect on LinkedIn.
Published 13 July 2026. Reviewed against the ICO's 29 April 2026 guidance. This guide is general information, not legal advice.