In short: In the UK, you need opt-in consent before setting cookies or similar technologies on a visitor's device, except for strictly necessary uses and, since February 2026, some low-risk analytics and appearance uses that users can object to. The rules apply to any organisation running an online service used by people in the UK, including businesses based abroad that target or track UK visitors. The ICO can now fine breaches of the cookie rules up to £17.5 million or 4% of worldwide turnover, and it has been checking the UK's most visited websites one by one.
UK GDPR and PECR: what is it?
Three texts govern cookies in the UK, and they work together.
- PECR, the Privacy and Electronic Communications (EC Directive) Regulations 2003, first came into force on 11 December 2003. Regulation 6 is the cookie rule. It covers any technology that stores information on, or reads information from, a user's device: cookies, but also tracking pixels, local storage and device fingerprinting.
- The UK GDPR is the version of the EU GDPR retained in UK law after Brexit, with amendments that took effect on 31 December 2020. It applies whenever cookies involve personal data, and it sets the standard of consent that PECR uses.
- The Data Protection Act 2018 completes the UK GDPR and sets out the penalty regime the ICO applies.
The Data (Use and Access) Act 2025 (DUAA), which became law on 19 June 2025, rewrote regulation 6 and created a new Schedule A1 listing the exceptions to consent. According to the commencement regulations (SI 2026/82), section 112 of the Act and the new PECR enforcement regime came into force on 5 February 2026. The ICO then published its final guidance on storage and access technologies on 29 April 2026, replacing its older cookie guidance.
On territorial scope, Article 3 of the UK GDPR covers organisations established in the UK, and also organisations outside the UK that offer goods or services to people in the UK or monitor their behaviour in the UK.
Who does UK GDPR and PECR apply to?
The ICO is clear: the storage and access rules apply to any organisation running an online service, including public authorities. Size does not matter. A one-person blog using an advertising pixel is covered in the same way as a national retailer.
PECR applies whether or not the information stored or read is personal data. If it is personal data, and with identifiers, analytics and advertising it usually is, the UK GDPR applies on top.
Organisations based outside the UK are also concerned when they target UK users. Under Article 3 of the UK GDPR, offering goods or services to people in the UK, or monitoring their behaviour, brings you within scope. The ICO adds that such organisations must generally appoint a UK representative, with exceptions for public authorities and occasional, low-risk processing.
You are also responsible for third-party technologies on your site. The ICO expects you to say whether third parties store or access information on the user's device, and to name the third parties whose technologies you ask users to accept.
What UK GDPR and PECR require for cookies and consent
The rule: no storage or access without consent
Regulation 6 says a person must not store information, or gain access to information stored, in the terminal equipment of a user, unless an exception in Schedule A1 applies. The main exception is consent: the user must receive clear and comprehensive information about the purpose and give consent.
PECR defines consent by reference to the UK GDPR. In the ICO's words, consent needs a clear and positive action: pre-ticked boxes and simply continuing to browse do not count, and silence or inactivity is not consent. You must not use non-exempt technologies before the user has agreed.
The exceptions in Schedule A1
You do not need consent in five situations, each with a narrow scope:
- Communication: storage or access whose sole purpose is to transmit a communication over a network.
- Strictly necessary: needed to provide the service the user asked for, such as security, fraud prevention, authentication, a shopping basket or recording the user's choices. The ICO is explicit that advertising cookies, cross-site tracking and profile-based personalisation are never strictly necessary.
- Statistical purposes (new): collecting information about how your service is used, in order to improve it. Data must be aggregated, it must not be used to track or profile individuals, and a third-party analytics provider must act as your processor. The ICO lists ad click measurement and linking visitors to purchases as outside the exception.
- Appearance (new): adapting how your site looks or works to the user's preferences or device, for example remembering a language choice or detecting dark mode.
- Emergency assistance: locating a device when the user asks for emergency help.
For the statistical and appearance exceptions, Schedule A1 sets two conditions: you give clear and comprehensive information about the purpose, and you offer a simple means of objecting, free of charge, which the user has not used. The ICO says browser settings alone are not enough: you need a mechanism within your service, such as a toggle that is on by default.
Information, duration and withdrawal
Your cookie information must explain which technologies you use, why, which third parties are involved and how long the storage or access lasts. Neither PECR nor the UK GDPR fixes a maximum duration for consent; the ICO says it depends on the scope of the consent, users' expectations and any change in your use. Withdrawing consent must be as easy as giving it.
Proof
The UK GDPR requires you to be able to demonstrate consent. The ICO notes that organisations typically do this through a preference record or a consent management platform. Keep a log of what was shown, what was chosen and when.
A UK GDPR and PECR-compliant cookie banner
The ICO's checks on the UK's top websites focused on three points: no non-essential advertising cookies before consent, rejecting as easy as accepting, and no non-essential cookies placed without consent. A compliant banner therefore:
- Appears before any non-exempt technology runs, and blocks those scripts until the user chooses.
- Offers "Reject all" with the same prominence and on the same level as "Accept all".
- Gives granular choices by purpose: the ICO says you must not bundle consent requests.
- Names the third parties concerned and links to your full cookie information.
- If you rely on the statistical or appearance exceptions, explains them and offers a simple way to object, for example an "on" toggle the user can switch off.
- Stays accessible after the first visit, so users can change or withdraw their choice at any time.
Practices to avoid include pre-ticked boxes, treating scrolling as consent, hiding the reject option behind a second layer, and repeatedly asking people who refused. On that last point, the ICO considers six months a suitable time before asking again. On cookie walls, the ICO says a "take it or leave it" approach does not meet the requirement for freely given consent; consent or pay models are covered by separate ICO guidance.
For design patterns, see our cookie banner guide and our article on cookie dark patterns: although written with EU regulators in mind, the same principles of equal choice apply in the UK.
Penalties and enforcement
The Information Commissioner's Office (ICO) enforces both PECR and the UK GDPR. Until the DUAA, PECR fines were capped far lower than UK GDPR fines. Since 5 February 2026, Schedule 13 of the Act applies the Data Protection Act 2018 penalty regime to PECR, and a breach of regulation 6 can lead to the higher maximum amount: £17.5 million or 4% of total annual worldwide turnover, whichever is higher. The commencement regulations specify that these new sanctions only apply to breaches on or after that date.
The ICO's recent cookie work has relied on warnings and enforcement notices rather than fines, and it is well documented:
- Top 100 websites (November 2023 to January 2024). The ICO warned 53 of the UK's top 100 websites that their banners were not compliant. By 31 January 2024, 38 had changed their banners and 4 had committed to do so within a month. (ICO announcement)
- Top 200 websites (January 2025). The ICO assessed the UK's top 200 websites, contacted 134 organisations about its concerns, and announced it would extend the review to the top 1,000. (ICO announcement)
- Top 1,000 websites (December 2025). On 4 December 2025, the ICO reported that 979 of the top 1,000 websites met its checks: 415 without intervention and 564 after ICO engagement. It issued 17 preliminary enforcement notices to sites that had not fixed their banners. (ICO announcement)
In April 2026, the ICO said 99% of the top 1,000 websites now meet its cookie banner standards, and that there is still more to do across online tracking. With fines now aligned on the UK GDPR, the cost of being in the remaining 1% has gone up.
Compliance checklist
- Scan your site and list every cookie, pixel, local storage item and fingerprinting script, including third-party ones.
- Classify each technology under Schedule A1: strictly necessary, statistical, appearance, or consent required.
- Check your analytics setup before relying on the statistical exception: aggregated data, processor contract, no advertising or individual tracking.
- Block non-exempt scripts until the user has given consent.
- Show "Reject all" and "Accept all" with equal prominence, plus granular choices by purpose.
- Offer a simple, free way to object to exempt analytics and appearance cookies.
- Update your cookie information: purposes, third parties and durations.
- Make withdrawal easy, with a persistent link or button to reopen the preferences.
- Keep proof of consent and wait at least six months before asking again after a refusal.
- If you are outside the UK and target UK users, check whether you need a UK representative.
How FlowConsent helps you comply with UK GDPR and PECR
FlowConsent covers the practical side of PECR without a long project. Run the free scanner to see which cookies and trackers your site loads, and let the automatic scan keep that list current as your tags change.
The banner installs in about ten minutes, blocks scripts until the visitor consents, offers balanced accept and reject buttons, and has Google Consent Mode v2 built in, so your Google tags respect each choice. Every decision is recorded, and you can export proof of consent if the ICO asks how your mechanism works; our documentation explains the proof of consent report. FlowConsent is hosted in Europe and free up to 25,000 sessions per month, with a Pro plan at €14.99 per month for up to 100,000 sessions. Create your free account to get started.
Further reading
The articles below go deeper into topics this page only touches on. Start with the 7 requirements for valid consent, which match the UK GDPR standard, then see how cookieless analytics can reduce what you need to ask for, along with practical guides to auditing trackers, banner examples and Google Consent Mode v2.