UK cookie law: PECR and the Data (Use and Access) Act

What is UK cookie law?

The UK cookie rule is in regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR). It applies whenever you store information on a user's device or read it from there: cookies, but also tracking pixels, local storage, fingerprinting and similar techniques. The ICO calls them "storage and access technologies".

The basic rule: you give the user clear and comprehensive information and get their consent, unless an exception applies. Consent must meet the UK GDPR standard: freely given, specific, informed and by a clear positive action. If the cookies process personal data, as tracking cookies almost always do, the UK GDPR applies as well.

PECR was amended by the Data (Use and Access) Act 2025 (DUAA), which received Royal Assent on 19 June 2025. The cookie changes came into force on 5 February 2026.

Which cookies don't need consent?

Since 5 February 2026 the exceptions are set out in a new Schedule A1 to PECR:

Everything else needs consent, in particular advertising, cross-site tracking and social media tracking. The ICO is explicit that no advertising purpose meets the strictly necessary exception.

The analytics exception in practice

The ICO's final guidance on storage and access technologies, published on 29 April 2026, sets clear limits:

• It covers aggregate statistics about how your service is used, such as visit counts, page interactions, coarse location at city or region level, and A/B testing.
• It does not allow tracking or monitoring individual visitors, or anything related to online advertising.
• A third-party analytics provider must be your processor, not a joint controller, and may only use the data to improve your service.
• The exception only applies if that is the sole purpose. If one tool serves several purposes and one of them needs consent, you need consent.

So a privacy-friendly analytics setup may now run without consent in the UK, but a standard setup linked to advertising still needs it.

What valid consent looks like

According to the ICO:

• Rejecting must be as easy as accepting. A banner with "Accept all" but no "Reject all" is bad practice.
• No consent by default: silence, inactivity and "by continuing to use this site you agree" do not count. Toggles for non-essential categories start off.
• No non-essential cookies before a choice. If a visitor ignores the banner, the technologies that need consent stay off.
• Withdrawing must be as easy as giving consent, and you must then stop using the technologies.
• Don't nag. The ICO suggests six months as a suitable time before asking someone who declined again.
• Browser settings alone are not enough to show consent.

Cookie walls that deny access unless users accept tracking do not comply in most cases, according to the ICO. More in Cookie walls.

Enforcement and fines

Under the DUAA, the ICO can now fine organisations up to £17.5 million or 4% of global annual turnover for PECR breaches, the same level as the UK GDPR. Before, the maximum PECR fine was £500,000. These powers came into force on 5 February 2026; the ICO is developing separate guidance on the higher fines.

The ICO has made cookies a priority. In January 2025 it announced that it had assessed the top 200 UK websites and raised concerns with 134 of them, and set out to bring the top 1,000 into compliance. In April 2026 the ICO said 99% of the top 1,000 websites now met its standards for cookie banners.

What may change next

The DUAA lets the government add or change exceptions by regulations, after consulting the ICO. In May 2026 the ICO advised the government on possible exceptions for low-risk, non-behavioral advertising. That is advice, not law: for now, advertising cookies still need consent.

How to make your website compliant

1. Scan your website to find every cookie, pixel and script, including those from plugins and embedded content.
2. Sort them by purpose and check which really fit an exception. Be strict with analytics.
3. Show a banner with "Accept" and "Reject" equally visible, and block everything that needs consent until the visitor agrees.
4. Offer an easy way to object to analytics and functionality cookies you use without consent, for example via the cookie settings link.
5. Use Google Consent Mode v2 if you use Google Ads or Google Analytics: Google's EU user consent policy also covers UK users. See Google Consent Mode v2 explained.
6. Publish a cookie policy with every cookie, its purpose, provider and duration. See our cookie policy template.
7. Keep proof of consent.

Cookie Confirm handles these steps: the scanner finds your cookies every month, the banner blocks them until consent, geographic rules let you treat UK and EU visitors differently, the cookie policy is generated from the scan and every consent is logged for 12 months. The price is €7.95 per website per month, with a 7-day free trial.

Sources

• The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6
• Data (Use and Access) Act 2025, Schedule 12 (new Schedule A1 to PECR)
• Data (Use and Access) Act 2025, section 115
• The Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026, regulation 2
• ICO: Statement on the commencement of the DUAA (February 2026)
• ICO: Final storage and access technologies guidance published (April 2026)
• ICO: What are the exceptions?
• ICO: How do we manage consent in practice?
• ICO: How do the rules apply to online advertising?
• ICO: Action on cookie compliance across the UK's top 1,000 websites (January 2025)
• ICO: Advice to government on potential changes to online advertising rules (May 2026)
• ICO: Consent or pay guidance
• ICO: One year on, the Data (Use and Access) Act