PECR and the Cookie Rule: Analytics Without a Banner

Every cookie banner in Europe traces back to one rule. In the UK it lives in PECR, the Privacy and Electronic Communications Regulations, which implement the EU ePrivacy Directive. The rule is short: storing information on someone's device, or accessing information already there, requires clearly informed consent, unless it is strictly necessary for a service the person asked for.

Analytics teams meet this rule the moment they add a measurement script. This guide explains what it demands and how to measure without triggering it. It is general information, not legal advice.

What the rule actually says

Regulation 6 of PECR is technology-neutral. It covers cookies, localStorage, and any script that reads information from the device, fingerprinting included. Two things follow that surprise people:

• It does not matter whether the data is personal. The GDPR regulates personal data; PECR regulates the act of storing and reading on a device. A cookie holding a random ID still needs consent.
• First-party cookies are not exempt. The exemption is about necessity, not about who sets the cookie.

The strictly-necessary exemption is narrow: shopping baskets, login sessions, security tokens, consent choices themselves. The ICO's guidance says plainly that analytics cookies are not strictly necessary, however useful they are to the site owner. The visitor asked to read the page, not to be measured.

Consent, meanwhile, must meet the GDPR standard: a real choice, informed, and as easy to decline as to accept. "By continuing to browse you agree" stopped being acceptable years ago.

The cost of the banner

Complying via a banner works, but the measurement price is heavy. Between visitors who click reject and visitors who never interact with the banner at all, cookie-based analytics commonly loses 30 to 60 percent of sessions in the UK and EU. Campaign numbers, conversion rates, and content decisions all inherit that gap. The banner also adds friction on exactly the first pageview where bounce is decided.

Measuring without triggering the rule

PECR's rule has a clean escape: do not store, and do not access. An analytics approach that writes nothing to the device and reads nothing from it beyond the standard HTTP request the browser sends anyway sits outside Regulation 6 entirely. There is nothing to consent to, so there is no banner.

That is the design behind cookieless analytics and behind Analyse. Visits, sources, and funnels are counted server-side from short-lived, non-reversible tokens, nothing persists on the device, and no fingerprint is built. The same design keeps you clear of the GDPR's consent requirements, covered in the GDPR guide, because no personal data is kept either.

One caution: "cookieless" only escapes PECR if it is honest. A tool that skips cookies but actively fingerprints devices is accessing information on the device and is back inside the rule, with regulators increasingly explicit on that point.

A practical checklist

1. Open your site's developer tools and list every cookie and localStorage entry your pages set. Attribute each one to a tool.
2. Sort them into strictly necessary and everything else. Analytics, A/B testing, and marketing tags land in the second pile.
3. Either gate that second pile behind a compliant consent banner, or replace the tools with ones that do not store or access at all.
4. If you go cookieless for analytics, remove the analytics entry from your banner or drop the banner entirely if nothing else needs it. The GA4 comparison shows what changes in practice.
5. Keep records. A short note of what each remaining cookie does is most of a PECR cookie audit.