UK Data Use and Access Act: Analytics Without Consent

On 5 February 2026, the UK's Data (Use and Access) Act 2025 brought into force amendments to PECR — the Privacy and Electronic Communications Regulations — that created a new consent exemption for analytics cookies. For SaaS companies with UK users, it changes the compliance calculation for product instrumentation in a material way: analytics cookies used strictly to gather statistical data about product use no longer require user opt-in. The data gap that consent banners create — EU sites see 40-50% consent acceptance rates, meaning up to half of users are invisible to analytics before they opt in — can be closed for UK users operating under a compliant implementation.

The consent penalty and why it matters for SaaS measurement

The consent-required analytics model carries a measurement cost that most SaaS teams have accepted as the price of GDPR compliance. When users must opt in before analytics cookies are placed, a significant portion of traffic is never tracked — and the non-consenting portion is not random. First-time visitors, mobile users, and users arriving from privacy-conscious acquisition channels (organic search, technical communities, developer forums) decline consent at higher rates than returning users and users from advertising channels. The result is a systematic skew in acquisition data: the users whose journey matters most — new arrivals — are the ones most likely to be invisible to your analytics.

The scale of this skew is documented. According to data from Plausible Analytics, an independent study found GA4 captured only 55.6% of actual traffic on a consent-required implementation, with consent declines as the primary driver. For SaaS products tracking funnel conversion from acquisition to activation, the missing 44% is not an abstract data quality issue — it is a structural distortion of every conversion rate, attribution model, and channel ROI figure derived from that data. The DUAA analytics exemption removes this problem for UK users at the legislative level.

What the DUAA analytics exemption actually says

The Data (Use and Access) Act 2025 amends PECR to create new exemptions from consent requirements where the use of storage technologies poses a low risk to user privacy. Analytics cookies fall within the low-risk category when they are used solely to collect statistical data about website or product use. The key conditions are that the cookies collect aggregate data, are not used for advertising, profiling, or cross-site tracking, and that users are given clear information about their use alongside a prominent opt-out mechanism.

The ICO confirmed in updated guidance following Royal Assent on 19 June 2025 that analytics and website optimisation cookies used strictly to collect statistical data are the primary intended use case for the exemption. According to Clifford Chance's analysis of the DUAA provisions entering force, the exemption applies when analytics data collection is proportionate to the privacy intrusion — in practice, session-scoped identifiers that do not persist across sessions or connect to advertising systems are the safest implementation path.

Which use cases qualify — and which do not

For SaaS product teams, the practical boundary between exempt and non-exempt analytics falls across several dimensions. Use cases that clearly qualify: aggregate funnel tracking (signup → activation → paid conversion counts at the cohort level), session-level event recording that does not cross-reference individual identity across sessions, error monitoring that captures stack traces and session context without building a persistent behavioral profile, A/B test assignment and result recording where assignment is session-scoped, and pageview and navigation analytics that measure product usage patterns at the aggregate level.

Use cases that do not qualify: ad retargeting pixels or any analytics data flowing to advertising networks, cross-device tracking that builds a user identity graph across multiple sessions, individual-level behavioral profiles maintained over time regardless of whether they are used for advertising, and any data collection that feeds a third-party profiling service. The governing principle is functional: if your analytics data is used to understand aggregate product usage, it is exempt. If it is used to understand or target a specific identifiable user, it is not. Product analytics tools that maintain per-user event history need careful configuration to ensure the data is used analytically (which cohorts convert?) rather than individually (target this specific user).

The UK/EU split: DUAA versus the EU Digital Omnibus

A common misconception following the DUAA's enactment is that UK and EU cookie rules are now equivalent. They are not, and SaaS companies serving users in both markets cannot apply a single compliance framework across jurisdictions. The UK DUAA is in force. The EU Digital Omnibus — a package of proposed amendments to the ePrivacy Directive that would create similar analytics cookie exemptions across EU member states — was still a proposal as of mid-2026, and had not completed the EU legislative process.

The scope also differs. The EU Digital Omnibus proposal is estimated to exempt roughly 60% of cookie categories; the DUAA's analytics exemption is narrower and more precisely scoped to the statistical collection use case. A SaaS product with UK and EU users needs to apply DUAA logic for UK sessions and full ePrivacy/GDPR consent requirements for EU sessions — the EU Digital Omnibus analysis covers the EU regulatory trajectory. Geo-fenced consent logic is the correct implementation pattern until EU legislation produces its own analytics exemption.

Does GA4 qualify for the DUAA analytics exemption?

The question most Google Analytics users will ask is whether their existing GA4 implementation qualifies, making consent banners unnecessary for UK visitors. The honest answer is: it depends on configuration, and the ICO has not issued definitive product-level guidance on GA4 specifically. GA4 in its default configuration routes data to Google's advertising infrastructure, enables Google Signals (which cross-references activity with signed-in Google accounts across devices), and allows personalised advertising based on collected data. None of these uses are compatible with an exemption that requires data to be used solely for statistical purposes.

A GA4 implementation with Google Signals explicitly disabled, all advertising personalisation options turned off, data sharing with Google products disabled, and no audience exports to Google Ads may be closer to qualifying — but that is not legal certainty. The practical implication is that SaaS companies using GA4 in a standard configuration should maintain consent management for UK users or audit their configuration against the exemption criteria with legal counsel. The server-side tracking configuration guide covers how to constrain what data GA4 receives — that same configuration discipline determines exemption eligibility.

How to implement DUAA-compliant analytics for SaaS

The implementation path for a DUAA-compliant analytics setup has four components. First, audit what your current analytics stack actually collects and where it goes. Many SaaS products route analytics data to multiple destinations — product analytics, advertising platforms, CRM enrichment — and the exemption applies only to the statistical collection use, not to advertising or CRM flows that share the same tag or SDK. Separate these data flows before assuming exemption coverage.

Second, configure your analytics tool to collect session-scoped data without persistent cross-session identifiers where possible. Privacy-first analytics tools designed around cookieless or short-lived identifier architectures — the category that cookieless analytics covers — are structurally better suited to the DUAA exemption than tools built on persistent user identity. Third, update your privacy policy and cookie notice to clearly describe the analytics cookies in use and their statistical purpose — the transparency obligation remains even where consent is no longer required. Fourth, add an opt-out mechanism to your privacy settings: a user preference that stops analytics collection when a user objects. This is lighter than a full consent management platform but is not optional under the DUAA.

What this means for UK SaaS teams choosing analytics tools

The DUAA analytics exemption creates a meaningful selection signal when choosing between analytics tools. Tools designed from the ground up around aggregate, session-scoped data collection — rather than being consent-first retrofits of advertising infrastructure — are structurally simpler to qualify. The audit trail is shorter, the data flows are cleaner, and ICO questions about advertising use are straightforward to answer because those use cases do not exist in the product's data model.

For UK SaaS teams currently running dual-track analytics — a privacy-first tool for measurement and a consent-gated tool for attribution — the DUAA exemption opens the possibility of consolidating onto a single stack that is both fully compliant and fully measuring. The analytics privacy liability analysis covers the broader enforcement risk landscape that makes this consolidation worth the investment. The core data quality argument is direct: a SaaS product that can instrument its full UK user base without a consent gate is working from a complete picture of funnel performance. One that cannot is optimizing against a data set that is structurally missing up to 44% of its users.