Cookie Consent and GDPR in 2026: What Your Website Needs to Get Right

Data and privacy rules are changing again, but the good news is that many of the latest updates are designed to simplify existing rules rather than add more complexity.

The Data (Use and Access) Act 2025 updates parts of the UK’s existing data protection and cookie rules, with changes that could affect everything from cookie consent to how charities communicate with supporters.

The ICO has published clear and comprehensive guidance on the changes, which should be your first port of call when reviewing how they apply to your organisation.

We’ve pulled out some of the key updates affecting websites and digital services, along with the practical things you may need to check or change.

For most organisations, the cookie banner is not going anywhere. Consent will still generally be needed for advertising, behavioural tracking and other non-essential cookies.

One of the main changes is greater flexibility around some lower-risk uses of cookies, including certain types of website measurement used to improve an online service. This could mean more flexibility around how basic analytics are handled, but it is not a blanket exemption for all tracking.

Where to start

A good place to start is to review your existing cookie policy or consent management platform, which should show the cookies and tracking tools currently in use. Tools such as Google Tag Assistant can also help you identify Google tags running on your website, while Google Tag Manager can show which tags have been added through your account. If you are still unsure what is running behind the scenes, ask your web team to carry out a full cookie and tracking audit.

Further reading

• ICO: Cookies and similar technologies
  For practical guidance on when consent is needed and how cookies and similar technologies should be handled.
• GOV.UK: Data (Use and Access) Act factsheet on the PEC Regulations
  For the clearest official summary of the new cookie exceptions.

The core principles of GDPR are not changing, but the new rules introduce some practical updates to how organisations can handle personal data. This includes changes to how certain data access requests can be managed and greater flexibility around documenting and relying on legitimate interests in some situations.

For most organisations, this is less about completely changing how personal data is handled and more about making sure existing processes, privacy information and internal records are still up to date.

Where to start

Start by reviewing the main places where people share personal information through your website, such as contact forms, donation journeys, account areas and newsletter sign-ups. Check that the privacy information shown at each stage still accurately explains how that data is being used and where it is being stored.

It is also worth reviewing your privacy policy and speaking to the teams responsible for your CRM, email platform or other connected systems, so you can make sure what users are being told matches what is actually happening behind the scenes.

Further reading 

• ICO: The right of access
  For practical guidance on how to recognise and respond to requests from people who want to access the personal data you hold about them.
• GOV.UK: Data (Use and Access) Act factsheet on UK GDPR and the Data Protection Act 
  For a helpful broad summary of the changes affecting personal data.

For charities, one of the biggest changes is the introduction of the charitable purpose soft opt-in. In some cases, charities may no longer need supporters to actively tick a box to say they want to hear from them. This could apply to someone who has donated, signed up for an event or shown an interest in a campaign. Instead, they can be given a clear opportunity to opt out when their details are collected and in every message that follows.

Charities should review donation pages, event registrations and sign-up forms to make sure the right opt-out is offered, recorded and respected.

Where to start

Review the forms and journeys where you collect supporter details and check whether they meet the ICO’s conditions for the charitable soft opt-in. If they do, you may be able to replace an active marketing opt-in with a clear opportunity to opt out.

Pay particular attention to where and when the data was collected. The charity must collect the details directly, and the soft opt-in only applies to information collected on or after 5 February 2026.

Further reading

• ICO: Charitable purposes soft opt-in guidance
  For a practical overview of how to plan responsible marketing, explain how personal data will be used and respect people’s preferences.
• GOV.UK: Data (Use and Access) Act factsheet on the PEC Regulations
  For the clearest official summary of the new soft opt-in for UK charities.

As well as simplifying some of the rules, the latest updates also introduce clearer expectations for how organisations should respond when someone raises a complaint about the way their personal data has been handled. This could include concerns about information collected through a website form, a data request that has not been answered, or personal details being used in a way they did not expect. Organisations should have a clear process for receiving, investigating and responding to complaints, with someone responsible for managing them and a record of the action taken.

Where to start

Check that your website and privacy policy clearly explain how someone can raise a data protection complaint and that the relevant contact details are up to date.

You should also make sure there is a clear internal process for who receives complaints, who is responsible for responding and how each complaint is recorded.

Further reading

• Data (Use and Access) Act 2025: full legislation  
  For new complaints requirements and exact legal wording.
• GOV.UK: Data (Use and Access) Act factsheet on UK GDPR and the Data Protection Act
  For a broader official overview of the data protection changes.

The updates also change some of the rules around automated decision-making, where technology uses personal data to make or strongly influence a decision without meaningful human involvement. On a website, this might include assessing someone’s eligibility, setting a price, approving an application or deciding which service they can access. Organisations using tools like these should make sure people are clearly told when automation is involved, understand how it may affect them and can challenge an important decision or ask for human review.

Where to start

Start by identifying any forms, application journeys or online tools that make significant decisions based on information a user submits. Check with the teams or suppliers responsible for those systems to understand whether decisions are fully automated and what data is being used.

Where significant decisions are made automatically, make sure users are clearly informed and have a straightforward way to challenge the decision and request a human review.

Further reading

• ICO: Automated decision-making, including profiling 
  For the most useful practical guide to the updated rules.
• GOV.UK: Data (Use and Access) Act factsheet on UK GDPR and the Data Protection Act 
  For a shorter official overview of how the updates affect automated decision-making.

Data and privacy guidance will continue to evolve, and we know it can be difficult to keep up with what those changes mean in practice. At Ten4, we keep a close eye on the guidance that affects the websites and digital services we design and build, helping our clients understand what may need reviewing and making sure their websites continue to work clearly, responsibly and effectively.

Have a question about how any of these updates could affect your website? Get in touch. We’ll take a look at your current setup and help you understand the practical next steps.