Outlook
Part of What is actually known about measurement going into 2027, and what still is not
Which measures fit the ICO statistical exception in England, and which need consent
Sort England analytics measures against the ICO statistical purposes exception: aggregate counts that fit, tracking and conversion sharing that need consent.
The statistical purposes exception lets an England website count how it is used without consent, but only for narrow, aggregate counting. Anything that follows an individual falls outside it. The ICO's finalised storage and access guidance updates its earlier cookies guidance, so each measure needs a fresh sort.
What to take away
- The exception is narrowthe sole purpose must be collecting statistical information about use of the service.
- Visitors must get clear information and a simple, free way to object.
- Aggregate page counts, load speed, bounce rate and A/B tests are likely to fit. Tracking individuals and sharing conversions do not.
- Consent remains necessary when the conditions are not met, and a product's privacy label does not decide the question.
- Reopen the review when a destination, identifier, enrichment step or use changes.
Check the three conditions first
A measure fits the exception only if three conditions hold. The sole purpose of the storage or access is to collect statistical information about use of the service. Visitors get clear information about it. They also get a simple means of objecting, free of charge.
Statistical purposes exception test
Sole purpose statistical information?
exception may apply
consent required
The ICO's exceptions guidance says the exception applies when the sole purpose of the storage or access is to collect information for statistical purposes about the use of your service. Consent remains necessary when the conditions are not met.
The result must be aggregate statistical information that cannot be used to identify people. That holds whether the operator does the work or an analytics provider does it. The information can go to a third party only if the third party uses it to improve the website or service, so check each analytics supplier's terms before relying on the exception.
Sort each measure
The ICO gives a non-exhaustive table of examples. Use it as a starting point for the measures in your own plan, not as a complete list.
| Measure | Fits the exception? | Why |
|---|---|---|
| Total visits to a page, page by page | Likely | Aggregate traffic analysis to understand user journeys |
| Page loading speed, bounce rate, exit pages | Likely | Aggregate information that helps detect browsing issues |
| A/B test splitting users into two groups | Likely | Compares interactions with two versions of a page |
| Logs or recordings of individual visitors' actions | Consent needed | Monitors individuals, unless kept for security |
| Whether a visitor viewed or clicked an advert | Consent needed | Measures the advert, not the use of your service |
| Visitor ID linked to site activity, such as conversions shared with advertising partners | Consent needed | Connects an individual to activity |
| Tracking or profiling visitors or categories of visitors | Consent needed | Follows individuals or groups |
| Monitoring browsing across different services and applications | Consent needed | Goes beyond your own service |
Advertising measures sit mostly in the second group. The advertising measurement checks show what fires before a person chooses, which is the moment the consent question bites.
Sort one measure in five steps
Run every measure in the plan through the same short test.
- Name the measure and write down its sole purpose.
- Check that the output is aggregate and cannot identify people.
- Confirm the visitor gets clear information about the purpose.
- Confirm a simple, free way to object exists.
- If any answer fails, obtain consent or drop the measure.
A product's privacy label does not decide the exception. Keep an inventory of each device operation and its purpose, so the answer to step 1 can be checked rather than remembered.
Keep individual-level data short-lived
Aggregation does not remove the duty to limit individual-level data. You must only store individual-level information for as long as you need it, regardless of how often you aggregate. Appropriate technical and organisational measures must keep aggregated datasets from allowing people to be identified.
Where analytics involves personal data, the UK GDPR requirement for data protection by design and by default also applies. The rules and compliance guide sets out the wider decisions a team makes before launch.
PECR does not define what a simple means of objecting looks like. You could provide it through your existing consent mechanism. If you offer no route, what you are doing is not in line with the exception.
Reopen the sort when something changes
Reopen the PECR review when a destination, identifier, enrichment step or use changes. A new field added to a tag can turn an aggregate count into a record of one person's visit.
Supplier notices count as triggers too. Google said that from 15 June 2026 its Analytics and Ads controls changed how specified data is governed, with further dates to follow for some controls. That is evidence about Google products, not permission under UK law. Version the setting map and reconcile a known test journey after every product notice or account change.
For the wider picture of what is and is not known about 2027, the outlook on known measurement evidence covers more than this one exception.
Before you act
- List every measure and write its sole purpose in one line.
- Mark each as aggregate or individual-level.
- Confirm clear information and a free objection route exist.
- Obtain consent for anything that tracks, profiles or links individuals.
- Record the date, owner and trigger for the next review.
Common questions
Can an A/B test run under the statistical exception?
The ICO lists A/B testing, where users are separated into two groups to compare two versions of a page, as likely to meet the exception. The sole purpose, clear information and objection conditions still apply.
Do conversions shared with advertising partners need consent?
Yes, according to the ICO's examples. Connecting a visitor ID to site activity, such as purchases shared with advertising partners, is on the list of activities that need consent.
Does a product's privacy label settle the question?
No. A product's privacy label does not decide the exception. The sole purpose, the information given to visitors and the objection route decide it, and the review reopens when a destination, identifier, enrichment step or use changes.
