Using analytics and advertising pixels lawfully

Analytics and advertising pixels are the technologies the regulator has focused on: they set cookies or read device information, they send the visitor's behaviour to the analytics or advertising platform, and they fire before the visitor has agreed unless the site is configured to stop them. The law requires consent for all but the strictly necessary, the platforms offer consent modes that work only when configured, the 2025 Act has created an exception for some analytics that most tools do not meet, and the advertising platforms treat the site owner as jointly responsible for what the pixel collects. This page explains what a business has to do, and the pack provides the cookie notice, the privacy notice and the consent guidance drafted for its site, for a fixed fee of £595, delivered in five working days.

Who this is for

Businesses in England and Wales running analytics, advertising pixels, conversion tracking, remarketing or tag managers on their website, and the marketing teams and agencies who installed them.

What matters in using pixels lawfully

Why a pixel is a cookie for legal purposes

Non-essential cookies and similar technologies need prior consent under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, and 'similar technologies' covers tracking pixels, scripts that read device identifiers or fingerprint the browser, local storage and the tags a tag manager loads, whether or not a cookie file is written, because the regulation is about storing information on or gaining access to information stored on the user's device; the only exemption is for technologies strictly necessary to provide a service the visitor requested (the cart, the login, security), and neither analytics nor advertising is strictly necessary, however useful the business finds them.

The consent the law requires and the consent mode the platforms offer

Consent means a clear affirmative action, informed and freely given, before the technology fires, with refusal no harder than acceptance and the ability to withdraw, and the analytics and advertising platforms offer consent modes that adjust what their tags do according to the visitor's choice (no cookies and modelled data where consent is refused, full tracking where it is given); consent mode works only when the site's banner signals the choice to the tag manager and the tags are configured to wait, and a tag manager that loads every tag on page load regardless of the banner is the commonest failure the audit finds; the guidance covers the configuration and the test.

Analytics, the 2025 Act's exception and which tools qualify

The Data (Use and Access) Act 2025 amends the Regulations to permit, once the provision is in force, cookies and similar technologies used solely for statistical purposes to improve the service without consent, provided the visitor is given clear information and a clear means to object and the data is not shared with or used by third parties for their own purposes; analytics run by the business itself, or by a provider that acts purely as its processor and does not use the data for its own ends, can meet the conditions, while hosted analytics that share data with the provider or combine it across sites usually cannot, and the business should check its tool's terms before relying on the exception; the privacy notice says which position the business takes.

Advertising pixels, custom audiences and joint control with the platform

An advertising pixel sends the visitor's page views, purchases and identifiers to the advertising platform, which uses them to measure conversions, build audiences and match the visitor to its own profile of them, and the courts have treated a site owner that installs a platform's social or advertising plug-in as a joint controller with the platform for the collection and transmission (Article 26 of the UK GDPR), which means the site owner needs a lawful basis for the collection (consent, in practice) and must tell visitors about it; uploading customer lists to build custom audiences is a disclosure of the customers' data to the platform that needs its own basis and its own mention in the notice, and the platforms' terms allocate the responsibilities in a way the business should have read.

Server-side tracking and the idea that it avoids consent

Server-side tagging moves the collection from the visitor's browser to the business's server, which improves performance and control, but the regulation applies to the information stored on and read from the visitor's device, so a first-party cookie or identifier set to feed the server-side tag still needs consent for non-essential purposes, and the data sent on to the analytics and advertising platforms still needs a lawful basis and disclosure; server-side tracking changes the architecture rather than the law, and a business told that it removes the need for a banner has been told wrong.

The notice, the banner and the records that make the tracking defensible

Under regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, marketing by email or text to an individual needs consent, or the soft opt-in, and the remarketing that pixels enable is advertising rather than electronic mail, so the cookie consent is the basis; the pack provides the cookie notice from an audit of the site (every tag, its purpose, its provider and duration), the privacy notice explaining the analytics, the pixels, the audiences, the transfers under Article 46 of the UK GDPR and the retention, and the consent guidance for the banner and the tag manager, with records of each visitor's choice kept as the evidence; the individual's rights (access, rectification, erasure, restriction, portability, objection), how to exercise them, the one-month time limit, and the right to complain to the Information Commissioner's Office are stated, and the business's registration with the Information Commissioner's Office, under the Data Protection (Charges and Information) Regulations 2018, belongs in the notice.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Does analytics really need consent?

Under the current rule, yes, unless strictly necessary, which analytics is not. The 2025 Act's exception for statistics-only tools with an opt-out applies once in force and only where the tool does not share data with its provider for the provider's own purposes, which most hosted tools do.

We moved to server-side tracking. Can we drop the banner?

It cannot. The device-side identifier that feeds the server still needs consent for non-essential purposes, and the data sent to the platforms still needs a basis and disclosure. The architecture changed; the law did not.

Our tag manager loads everything on page load. Is that a problem?

It is the commonest failure: the banner shows but the tags fire regardless. The guidance covers configuring the tags to wait for the banner's signal and the test that confirms they do.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Consent banners: what has to be in one
• Privacy notice for a marketing agency

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.