UK cookie rules are set by PECR, updated by the Data (Use and Access) Act 2025. Some low-risk analytics can now be used without consent if strict conditions are met, but Google Analytics shares data with Google, so we ask first. See the ICO guidance.