PECR

If you run a website that people in the UK use, you have probably heard that "UK cookie law" changed. It did, but not in the way many headlines suggested. Consent is still the default. A few low-risk uses of cookies no longer need it, as long as strict conditions are met. And the maximum fine is far higher than it was.

This guide explains the position as at 18 October 2026. It is written for website owners, founders, marketers and developers, not lawyers. It is general information, not legal advice.

What is UK cookie law?

There is no single Act called the "UK cookie law". The rule sits in regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR). It says you must not store information on a visitor's device, or read information already stored there, unless an exception applies or the visitor has given consent. The Data (Use and Access) Act 2025 (DUAA) rewrote that rule, and the new version has applied since 5 February 2026.

Three points are easy to miss.

• It is not just cookies. The ICO's guidance covers cookies, tracking pixels, local storage, link decoration, device fingerprinting and scripts or tags. The Act treats a "website" as including mobile apps and other platforms.
• Instigating counts. Regulation 6 expressly includes instigating storage or access. If you add a third-party tag that sets a cookie, that is your responsibility even though you did not write the code.
• Emitted signals count. Collecting or monitoring information that a device sends out automatically, such as Wi-Fi probe requests, is treated as access.

Who has to comply? The ICO says a UK-based organisation must comply even if its service is hosted overseas. PECR has no specific rule for organisations based outside the UK whose services are reachable in the UK. But if you process UK visitors' personal data, for example by tracking their behaviour, the UK GDPR may apply to you anyway.

PECR and UK GDPR: two layers

Two laws apply, and they ask different questions.

PECR regulation 6 asks: may you touch this device at all? It applies whether or not the information is personal data. An anonymous counter is still covered.

UK GDPR asks: what may you do with personal data once you have it? Cookie identifiers, IP addresses and device IDs can be personal data. When they are, you also need a lawful basis, proper transparency and the other UK GDPR protections.

The two meet on consent. For PECR, the UK GDPR definition applies: consent must be freely given, specific, informed and unambiguous, shown by a clear positive action.

A common mistake is to treat "legitimate interests" as a way round PECR consent. It is not. If regulation 6 requires consent for a tag, a UK GDPR lawful basis does not remove that requirement. The ICO even lists consent screens with separate "legitimate interests" toggles as bad practice. Both layers must be satisfied.

The consent rule

Unless an exception applies, you need consent before the technology runs. The ICO's guidance expects the following.

• Clear information. Tell users what the technologies are and what they do.
• Named third parties. Give the identity of third parties who will receive data. In a layered banner, put them on the first layer or on a second layer clearly signposted from the first.
• A positive action. Continuing to browse is not consent. Neither is a pre-ticked box, nor a clause buried in your terms and conditions.
• Refusing as easy as accepting. The ICO's good-practice example shows equally prominent "accept all" and "reject all" buttons. Its bad-practice example offers "accept all" and "more options" but no way to reject all.
• Granular choices. Consent must be specific to each purpose, not bundled into a single yes.
• A mechanism that works. Tags must only fire when consent is given or an exception applies.
• Withdrawal as easy as giving consent. If someone withdraws, you must stop using the technologies, stop the related processing and tell any third parties. The ICO treats withdrawal as an erasure request for data gathered under that consent.
• Records. You must be able to demonstrate that consent was given.

There is no fixed lifespan for consent. As a general guideline the ICO suggests about six months before asking someone who refused to choose again. You must ask again sooner if your purposes change, for example by adding a new tag or sharing data with a new party.

Schedule A1 to PECR does recognise browser settings as one way to signify consent. But the ICO says you must not rely solely on browser settings. You cannot assume a visitor has configured their browser, or that it has such features.

The five exceptions

The ICO identifies five exceptions to the consent rule. Each applies only if its conditions are met, and the ICO calls them narrow. If your use goes beyond an exception, you need consent. The references below are to Schedule A1 to PECR.

1. Communication (para 3). Storage or access for the sole purpose of transmitting a communication over a network. Load balancing is the ICO's example. This is not new.

2. Strictly necessary (para 4). Storage or access strictly necessary to provide a service the user has requested. The DUAA added non-exhaustive examples: protecting information, keeping the device secure, preventing or detecting fraud or technical faults, authenticating the user, and remembering selections the user makes. The ICO says to judge this from the user's point of view, not yours. A basket cookie or a login session qualifies. An advertising cookie does not, even if it pays for the site.

A point that matters if you use a consent tool: the ICO says a persistent cookie that remembers someone's consent choices can be exempt, provided users are informed and the cookie is used solely for that purpose.

3. Statistical purposes (para 5). New. You can use analytics technologies without consent only if all of these are true:

• you provide the service, and the sole purpose is collecting statistics about how the service or website is used, to improve it;
• anything collected is not shared except to help you make those improvements;
• you give clear and comprehensive information; and
• you offer a simple, free way to object, and the user has not objected.

The ICO's examples that can qualify include total page visits, scroll depth, device and browser types, referrers, A/B testing and coarse location. It says you need consent for logs or recordings of individual visitors, advert performance measurement, conversion tracking, and profiling visitors or groups of visitors. If you use a third-party analytics provider, it must act as your processor, not a joint controller. The exception does not cover collecting information that a device emits automatically, such as Wi-Fi probe requests (para 5(2)).

The ICO's suggested way to give people an objection route is to leave the analytics toggle on by default in your consent mechanism, with the ability to switch it off at any time. If someone objects, you must stop for that person.

4. Appearance (para 6). New. Storage or access whose sole purpose is to adapt how your service looks or works to the user's preference, or otherwise enhance its appearance or functionality. The ICO's examples include remembering a language choice, responsive layouts, detecting a dark-mode setting and serving fonts. The same information and objection conditions apply. It does not cover choosing content or adverts based on someone's browsing history.

5. Emergency assistance (para 7). New. Establishing a device's position to provide emergency help, once the user has sent a request or otherwise indicated they need it. The ICO's examples are vehicle eCall systems and personal safety alarms. It is rarely relevant to websites.

The key phrase is "sole purpose". If one purpose meets an exception and another does not, the ICO says you need consent for the storage or access. A script that counts visits and also builds advertising audiences has two purposes, so it needs consent. The ICO's practical tip: using a separate technology for each purpose makes compliance easier.

What the Data (Use and Access) Act 2025 changed

The changes took effect on 5 February 2026 (Commencement No. 6 Regulations, SI 2026/82).

Topic	Before	Now
Core rule	Consent unless an exception applied	Same default, now in regulation 6(1) and Schedule A1
Scope	Storing or accessing	Also instigating, and collecting information devices emit
Analytics	Consent unless strictly necessary	New statistical purposes exception, if every condition is met
Appearance	Consent	New exception, with information and objection
Emergency help	None	New exception
Strictly necessary	No statutory examples	Non-exhaustive examples added
Maximum penalty	£500,000	Up to £17.5 million or 4% of worldwide turnover, for conduct from 5 February 2026
Government power	None	Regulation 6A lets the government add or change exceptions by regulations
Regulator	Information Commissioner's Office	Information Commission from 30 September 2026 (still known as the ICO)

What about advertising?

Nothing has changed. The ICO says online advertising purposes, including frequency capping and ad measurement, have never been exempt from PECR's consent requirement.

In April 2026 the ICO finalised its guidance, and on 18 May 2026 it published advice to government. That advice sets out how regulation 6 could be amended so that certain low-risk advertising, such as contextual advertising based on the page being viewed, could run without consent. It is advice only. Any change needs regulations made under regulation 6A, after consulting the ICO and with a draft approved by both Houses of Parliament. At the time of writing we have found no such regulations. If you use behavioural advertising, retargeting or social tracking pixels, you need valid prior consent today.

Penalties and enforcement

For acts or omissions on or after 5 February 2026, a breach of regulation 6 can attract a penalty of up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. The route is technical but worth knowing: the DUAA rewrote PECR's enforcement schedule, applying Data Protection Act 2018 section 157 to PECR, and puts regulation 6 in the higher band.

Two clarifications keep this in proportion.

• It is a ceiling, not a typical outcome. The ICO has said the 4% figure only exceeds £17.5 million where an undertaking's worldwide turnover is above £437.5 million.
• Conduct before 5 February 2026 stays under the old regime, with its £500,000 cap. SI 2026/82 allows the ICO to use its new investigatory powers from 5 February 2026 regardless of when the conduct occurred, but the sanction follows the date of the conduct.

The ICO's powers now include information notices, assessment notices, interview notices and enforcement notices.

What enforcement has looked like. The ICO's cookie work has mainly been a review of the UK's top 1,000 websites. It reported that 979 passed its checks by December 2025, after letters, investigations and 17 preliminary enforcement notices, and that 99% passed by April 2026. It has promised continued testing. A reprimand, not a fine, was issued in September 2024 to Bonne Terre Ltd (Sky Betting and Gaming), after a third-party advertising pixel set around 40 marketing cookies before visitors had made a choice in the site's consent tool. That action was under the UK GDPR, not a PECR penalty.

A practical compliance checklist

Step	What the law or the ICO requires	Good practice
1. Scan for cookies, pixels, local storage, scripts and app SDKs	You need to know what runs on devices	Rescan after every site or tag change
2. Classify each by purpose	An exception applies only if every condition is met	Record your reasoning for each tag
3. Block non-exempt tags until consent	No non-exempt use before a positive choice	Test in a fresh browser profile
4. Build the banner	Clear information, named third parties, refusing as easy as accepting, granular choices	Equal-prominence reject on the first layer
5. Use the analytics or appearance exceptions	Information plus a simple, free objection; stop if the user objects	Put the objection control in the banner or settings, not a policy
6. Handle withdrawal	Same ease as giving consent; stop, tell third parties, treat as erasure request	Show a persistent link to reopen preferences
7. Keep records	Be able to demonstrate consent	Store timestamp, choices and banner version
8. Review vendors	You are responsible for what you instigate	Check vendor behaviour and contracts
9. Keep notices current	UK GDPR transparency where personal data is involved	Maintain an up-to-date cookie list

Where a consent platform fits

A consent management platform (CMP) can do the repetitive work: scanning for trackers, blocking them until a choice is made, presenting a clear banner and keeping a consent log. The ICO notes that records of consent can be kept in digital form through a CMP.

A CMP does not decide your purposes. Whether an analytics tool qualifies for the statistical exception, or which lawful basis applies to later processing, depends on how you use the data. The ICO also says that if you use a CMP provider you must consider each party's role under the UK GDPR, for example whether the provider acts as your processor. And if the tool's preference cookie has a default lifespan (often 90 days), assess whether it is right for you and document your decision.

Quick FAQ

Do I still need a cookie banner in the UK? If you use anything beyond strictly necessary technologies and the narrow new exceptions, yes. Advertising and cross-site tracking always need consent.

Can I run analytics without a banner now? Possibly, if you meet every condition of the statistical purposes exception, including sole-purpose use, no onward sharing beyond improving your service, clear information and a working objection. Many common set-ups, such as analytics tools that also feed advertising audiences, will not qualify.

Is "legitimate interests" a valid basis for cookies? Not for the storage or access itself. PECR requires consent or an exception. Legitimate interests may be relevant to later processing of personal data under the UK GDPR, which is a separate question.

Bottom line

UK cookie law is not simply a question of whether a website displays a banner. PECR regulates the storage of and access to information on a user's device, while the UK GDPR governs the processing of personal data where applicable.

A cookie consent management platform like GrantCookie can help to operationalise this process by identifying technologies, presenting visitor choices and maintaining consent records. The underlying legal assessment, however, must still reflect the actual requirements of PECR and the UK GDPR.

The goal is not simply to display a cookie banner. It is to make sure the website's behaviour matches the choices presented to its visitors and the legal basis on which each technology operates.