Compliance · Updated September 8, 2026

PECR and UK analytics

PECR governs cookies and similar technologies in the UK. The current rules include a conditional exception for statistical purposes, so the answer depends on how analytics is used.

Device access goes beyond cookies

Scripts and tags can fall within Regulation 6 when they read or store information on a visitor’s device. Using cookie-free analytics is not enough, by itself, to decide whether the rules apply. ICO guidance on storage and access technologies.

The statistical purposes exception

The ICO explains that consent is not required for qualifying storage or access used solely to produce statistics about use of a service or website, with a view to improving it. Visitors must receive clear information and a simple, free way to object. Sharing is restricted to helping improve that service or website.

This is not a blanket analytics exemption. Individual tracking, advertising uses, and decisions about particular people do not fit the exception merely because a tool also produces aggregate reports. ICO guidance on exceptions.

Using Fathom on a UK website

Fathom provides website statistics without tracking cookies. To decide whether your use qualifies for an exception, review what you collect, how you use the results, and your visitor controls. The existence of the exception does not certify every Fathom configuration.

If you intend to rely on the statistical purposes exception:

  • Keep analytics focused on understanding and improving your own website.
  • Explain the purpose and provide a working way to object.
  • Review custom events, integrations, and any sharing of results.
  • Check that your implementation honours visitors’ choices.

If an exception does not apply, obtain the required consent before the relevant storage or access. Personal-data processing also needs a separate UK GDPR assessment.

Information for your assessment

Our data journey, DPA, and privacy notice guidance provide the starting material. Contact us if you need details about a particular configuration or visitor control.

These guides explain privacy requirements and how they relate to Fathom. They are general information, not legal advice. Your obligations depend on your website, its visitors, and how you use analytics. Contact us for information about your setup.