UK GDPR and PECR: cookie rules in the United Kingdom

In the United Kingdom, cookies are governed by two laws working together. The Privacy and Electronic Communications Regulations (PECR) require consent before storing or accessing information on a device unless an exemption applies, and UK GDPR defines what valid consent looks like. The Information Commissioner’s Office (ICO) enforces both, and recent reforms add new exemptions worth tracking closely.

How do UK GDPR and PECR fit together?

PECR sets the cookie rule and UK GDPR sets the consent standard. When a cookie or similar technology also involves personal data, UK GDPR’s wider principles, such as transparency and data minimization, apply as well.

PECR is the UK’s implementation of the EU ePrivacy Directive. Its cookie rule, regulation 6, says you must give clear and comprehensive information and obtain consent before storing or accessing information on a user’s device, unless an exemption applies. Like Article 5(3) in the EU, it covers cookies and similar technologies such as local storage, tracking pixels and device fingerprinting.

UK GDPR is the version of the EU GDPR kept in UK law after Brexit, and it sits alongside the Data Protection Act 2018. It defines consent as freely given, specific, informed and unambiguous, signaled by a clear affirmative action. For the EU version of this relationship, see ePrivacy Directive vs. GDPR.

Which cookies need consent in the UK?

Under the long-standing rules, anything that is not strictly necessary needs prior opt-in consent. That includes analytics, advertising, social media and most personalization cookies.

The traditional exemptions are narrow:

• Communication exemption: storage or access used solely to carry out the transmission of a communication over a network.
• Strictly necessary exemption: storage or access strictly necessary to provide a service the user has explicitly requested, such as a shopping basket, login session or security cookie.

The ICO has long treated analytics as not strictly necessary, however valuable a business finds it. For the boundary cases, see what counts as a strictly necessary cookie.

What changed with the Data (Use and Access) Act 2025?

The Data (Use and Access) Act 2025 amends both PECR and UK GDPR, and its cookie changes are the most significant in years. Its provisions are being brought into force in stages, though, so check the ICO’s current guidance before you change your banner.

As passed, the Act creates new exceptions to the consent requirement for certain lower-risk purposes, such as some analytics used to improve a website or service and features that remember how a user wants a site to look or work. Where these exceptions apply, you generally still need to tell people clearly what you are doing and give them a simple, free way to object. The Act is also intended to bring PECR penalties into line with UK GDPR levels.

Three practical cautions apply while the details settle:

1. Advertising still needs consent. The new exceptions are aimed at lower-risk purposes, not targeted advertising or cross-site tracking.
2. Third-party tools need scrutiny. An exception tied to improving your own service may not cover a vendor that also uses the data for its own purposes.
3. EU visitors are unaffected. If you also serve people in the EU, EU rules still generally require consent for analytics, so you may need region-specific behavior.

Before relying on any new exception, run a cookie audit so you know exactly which cookies would fall under it.

What does the ICO expect from cookie banners?

The ICO expects a real choice: rejecting must be as easy as accepting, non-essential cookies must not load before consent, and the information must be clear. It has publicly pressed major websites to fix banners that fell short of that standard.

A UK-ready banner should:

1. Offer “Reject all” with the same prominence and number of clicks as “Accept all”.
2. Avoid pre-ticked boxes, toggles switched on by default and consent bundled into terms of service.
3. Never treat scrolling or continued browsing as consent.
4. Block non-essential cookies until the user opts in.
5. Make it easy to change or withdraw consent later.
6. Explain purposes and third parties in plain language, with detail in a cookie policy.

Design tricks that steer people toward accepting are a recurring enforcement focus. Our guide to cookie banner dark patterns lists the patterns to avoid.

How do UK rules compare with EU rules?

UK and EU cookie rules remain closely aligned, but they are starting to diverge. Use this table as a quick orientation, not a legal map.

	EU	UK
Cookie rule	ePrivacy Directive Art. 5(3), via national laws	PECR regulation 6
Consent standard	GDPR	UK GDPR
Regulator	National data protection authorities	ICO
Analytics cookies	Consent generally required, with narrow national exemptions	New exceptions for some analytics, subject to commencement and ICO guidance
Advertising cookies	Consent required	Consent required
Maximum GDPR fine	€20M or 4% of worldwide annual turnover	£17.5M or 4% of worldwide annual turnover

Bottom line

For UK visitors, build for opt-in consent on anything non-essential, make rejecting as easy as accepting and follow the Data (Use and Access) Act 2025 as its cookie changes take effect. Check the ICO’s latest guidance before relaxing any consent requirement, and remember that EU visitors still need EU-grade consent. Tools like Cookiesh can automate cookie scanning and keep tamper-evident consent logs, so you can show the ICO what your site does and what visitors chose.

This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.