> UK cookie law explained: PECR regulation 6, UK GDPR consent, the new analytics exceptions from the Data (Use and Access) Act 2025, and ICO enforcement. > > Canonical: https://www.flowconsent.com/en/laws/uk-gdpr-pecr Cookie law # UK GDPR, PECR and cookies: what UK law requires from your website UK cookie law explained: PECR regulation 6, UK GDPR consent, the new analytics exceptions from the Data (Use and Access) Act 2025, and ICO enforcement. Updated October 9, 2026 · 9 min read [Scan my site for free](https://www.flowconsent.com/en/scan) · [Try FlowConsent for free](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=laws) ## Fact sheet - Full name UK General Data Protection Regulation, Data Protection Act 2018 and Privacy and Electronic Communications (EC Directive) Regulations 2003 - Jurisdiction United Kingdom - In force since 11 December 2003 (PECR); UK GDPR since 31 December 2020 - Authority Information Commissioner's Office (ICO) - Maximum fine £17.5 million or 4% of worldwide annual turnover, whichever is higher - Consent model Opt-in ## Key points - PECR regulation 6 forbids storing or reading information on a user's device without consent, unless an exception in Schedule A1 applies. - Consent must meet the UK GDPR standard: a clear positive action, given before non-exempt cookies are set, with rejecting as easy as accepting. - Since 5 February 2026, the Data (Use and Access) Act 2025 lets you use some analytics and appearance cookies without consent, if you inform users and let them object. - Advertising and cross-site tracking still need opt-in consent. - PECR fines are now aligned with the UK GDPR: up to £17.5 million or 4% of worldwide turnover. - The ICO has reviewed the UK's top 1,000 websites and issued 17 preliminary enforcement notices over cookie banners. Contents > **In short:** In the UK, you need opt-in consent before setting cookies or similar technologies on a visitor's device, except for strictly necessary uses and, since February 2026, some low-risk analytics and appearance uses that users can object to. The rules apply to any organisation running an online service used by people in the UK, including businesses based abroad that target or track UK visitors. The ICO can now fine breaches of the cookie rules up to £17.5 million or 4% of worldwide turnover, and it has been checking the UK's most visited websites one by one. ## UK GDPR and PECR: what is it? Three texts govern cookies in the UK, and they work together. - **PECR**, the Privacy and Electronic Communications (EC Directive) Regulations 2003, first came into force on **11 December 2003**. **Regulation 6** is the cookie rule. It covers any technology that stores information on, or reads information from, a user's device: cookies, but also tracking pixels, local storage and device fingerprinting. - The **UK GDPR** is the version of the EU GDPR retained in UK law after Brexit, with amendments that took effect on **31 December 2020**. It applies whenever cookies involve personal data, and it sets the standard of consent that PECR uses. - The **Data Protection Act 2018** completes the UK GDPR and sets out the penalty regime the ICO applies. The **Data (Use and Access) Act 2025** (DUAA), which became law on 19 June 2025, rewrote regulation 6 and created a new **Schedule A1** listing the exceptions to consent. According to the commencement regulations (SI 2026/82), section 112 of the Act and the new PECR enforcement regime came into force on **5 February 2026**. The ICO then published its final guidance on storage and access technologies on **29 April 2026**, replacing its older cookie guidance. On territorial scope, Article 3 of the UK GDPR covers organisations established in the UK, and also organisations outside the UK that offer goods or services to people in the UK or monitor their behaviour in the UK. ## Who does UK GDPR and PECR apply to? The ICO is clear: the storage and access rules apply to **any organisation running an online service**, including public authorities. Size does not matter. A one-person blog using an advertising pixel is covered in the same way as a national retailer. PECR applies whether or not the information stored or read is personal data. If it is personal data, and with identifiers, analytics and advertising it usually is, the UK GDPR applies on top. Organisations based outside the UK are also concerned when they target UK users. Under Article 3 of the UK GDPR, offering goods or services to people in the UK, or monitoring their behaviour, brings you within scope. The ICO adds that such organisations must generally appoint a **UK representative**, with exceptions for public authorities and occasional, low-risk processing. You are also responsible for **third-party technologies** on your site. The ICO expects you to say whether third parties store or access information on the user's device, and to name the third parties whose technologies you ask users to accept. ## What UK GDPR and PECR require for cookies and consent ### The rule: no storage or access without consent Regulation 6 says a person must not store information, or gain access to information stored, in the terminal equipment of a user, unless an exception in Schedule A1 applies. The main exception is consent: the user must receive **clear and comprehensive information** about the purpose and **give consent**. PECR defines consent by reference to the UK GDPR. In the ICO's words, consent needs a clear and positive action: pre-ticked boxes and simply continuing to browse do not count, and silence or inactivity is not consent. You **must not** use non-exempt technologies before the user has agreed. ### The exceptions in Schedule A1 You do not need consent in five situations, each with a narrow scope: - **Communication**: storage or access whose sole purpose is to transmit a communication over a network. - **Strictly necessary**: needed to provide the service the user asked for, such as security, fraud prevention, authentication, a shopping basket or recording the user's choices. The ICO is explicit that advertising cookies, cross-site tracking and profile-based personalisation are never strictly necessary. - **Statistical purposes** (new): collecting information about how your service is used, in order to improve it. Data must be aggregated, it must not be used to track or profile individuals, and a third-party analytics provider must act as your processor. The ICO lists ad click measurement and linking visitors to purchases as outside the exception. - **Appearance** (new): adapting how your site looks or works to the user's preferences or device, for example remembering a language choice or detecting dark mode. - **Emergency assistance**: locating a device when the user asks for emergency help. For the statistical and appearance exceptions, Schedule A1 sets two conditions: you give clear and comprehensive information about the purpose, and you offer a **simple means of objecting, free of charge**, which the user has not used. The ICO says browser settings alone are not enough: you need a mechanism within your service, such as a toggle that is on by default. ### Information, duration and withdrawal Your cookie information must explain which technologies you use, why, which third parties are involved and **how long** the storage or access lasts. Neither PECR nor the UK GDPR fixes a maximum duration for consent; the ICO says it depends on the scope of the consent, users' expectations and any change in your use. Withdrawing consent must be **as easy as giving it**. ### Proof The UK GDPR requires you to be able to demonstrate consent. The ICO notes that organisations typically do this through a preference record or a consent management platform. Keep a log of what was shown, what was chosen and when. ## A UK GDPR and PECR-compliant cookie banner The ICO's checks on the UK's top websites focused on three points: no non-essential advertising cookies before consent, **rejecting as easy as accepting**, and no non-essential cookies placed without consent. A compliant banner therefore: - Appears before any non-exempt technology runs, and blocks those scripts until the user chooses. - Offers **"Reject all"** with the same prominence and on the same level as **"Accept all"**. - Gives **granular choices** by purpose: the ICO says you must not bundle consent requests. - Names the third parties concerned and links to your full cookie information. - If you rely on the statistical or appearance exceptions, explains them and offers a simple way to object, for example an "on" toggle the user can switch off. - Stays accessible after the first visit, so users can change or withdraw their choice at any time. Practices to avoid include pre-ticked boxes, treating scrolling as consent, hiding the reject option behind a second layer, and repeatedly asking people who refused. On that last point, the ICO considers **six months** a suitable time before asking again. On cookie walls, the ICO says a "take it or leave it" approach does not meet the requirement for freely given consent; consent or pay models are covered by separate ICO guidance. For design patterns, see our [cookie banner guide](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) and our article on [cookie dark patterns](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited): although written with EU regulators in mind, the same principles of equal choice apply in the UK. ## Penalties and enforcement The **Information Commissioner's Office (ICO)** enforces both PECR and the UK GDPR. Until the DUAA, PECR fines were capped far lower than UK GDPR fines. Since 5 February 2026, Schedule 13 of the Act applies the Data Protection Act 2018 penalty regime to PECR, and a breach of regulation 6 can lead to the **higher maximum amount**: **£17.5 million or 4% of total annual worldwide turnover**, whichever is higher. The commencement regulations specify that these new sanctions only apply to breaches on or after that date. The ICO's recent cookie work has relied on warnings and enforcement notices rather than fines, and it is well documented: - **Top 100 websites (November 2023 to January 2024).** The ICO warned 53 of the UK's top 100 websites that their banners were not compliant. By 31 January 2024, 38 had changed their banners and 4 had committed to do so within a month. ([ICO announcement](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/01/ico-warns-organisations-to-proactively-make-advertising-cookies-compliant/)) - **Top 200 websites (January 2025).** The ICO assessed the UK's top 200 websites, contacted 134 organisations about its concerns, and announced it would extend the review to the top 1,000. ([ICO announcement](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/01/ico-takes-action-to-tackle-cookie-compliance-across-the-uk-s-top-1-000-websites/)) - **Top 1,000 websites (December 2025).** On 4 December 2025, the ICO reported that 979 of the top 1,000 websites met its checks: 415 without intervention and 564 after ICO engagement. It issued **17 preliminary enforcement notices** to sites that had not fixed their banners. ([ICO announcement](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/12/ico-action-secures-increased-cookie-compliance/)) In April 2026, the ICO said 99% of the top 1,000 websites now meet its cookie banner standards, and that there is still more to do across online tracking. With fines now aligned on the UK GDPR, the cost of being in the remaining 1% has gone up. ## Compliance checklist 1. **Scan your site** and list every cookie, pixel, local storage item and fingerprinting script, including third-party ones. 2. **Classify each technology** under Schedule A1: strictly necessary, statistical, appearance, or consent required. 3. **Check your analytics setup** before relying on the statistical exception: aggregated data, processor contract, no advertising or individual tracking. 4. **Block non-exempt scripts** until the user has given consent. 5. **Show "Reject all" and "Accept all" with equal prominence**, plus granular choices by purpose. 6. **Offer a simple, free way to object** to exempt analytics and appearance cookies. 7. **Update your cookie information**: purposes, third parties and durations. 8. **Make withdrawal easy**, with a persistent link or button to reopen the preferences. 9. **Keep proof of consent** and wait at least six months before asking again after a refusal. 10. **If you are outside the UK** and target UK users, check whether you need a UK representative. ## How FlowConsent helps you comply with UK GDPR and PECR FlowConsent covers the practical side of PECR without a long project. Run the [free scanner](https://www.flowconsent.com/en/scan) to see which cookies and trackers your site loads, and let the automatic scan keep that list current as your tags change. The banner installs in about ten minutes, blocks scripts until the visitor consents, offers balanced accept and reject buttons, and has Google Consent Mode v2 built in, so your Google tags respect each choice. Every decision is recorded, and you can export proof of consent if the ICO asks how your mechanism works; our documentation explains the [proof of consent report](https://www.flowconsent.com/en/doc/proof-report). FlowConsent is hosted in Europe and free up to 25,000 sessions per month, with a Pro plan at €14.99 per month for up to 100,000 sessions. [Create your free account](https://app.flowconsent.com/auth/register) to get started. ## Further reading The articles below go deeper into topics this page only touches on. Start with [the 7 requirements for valid consent](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements), which match the UK GDPR standard, then see how [cookieless analytics](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide) can reduce what you need to ask for, along with practical guides to auditing trackers, banner examples and Google Consent Mode v2. Further reading ## Go further on UK GDPR / PECR. Practical guides from our blog to put these rules into practice on your site. [Blog](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) ### [GDPR-compliant cookie banner: the complete guide](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) [Read the article ](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide)· [Blog](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements) ### [GDPR consent validity: the 7 requirements explained](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements) [Read the article ](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements)· [Blog](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) ### [Cookie dark patterns: what the CNIL prohibits in consent banners](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) [Read the article ](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited)· [Blog](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide) ### [Cookieless analytics and tracking: a complete guide to measuring without consent](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide) [Read the article ](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide)· [Blog](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide) ### [Website cookie audit: the complete guide to scanning your trackers](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide) [Read the article ](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide)· [Blog](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices) ### [GDPR cookie banner examples: best practices and templates](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices) [Read the article ](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices)· [Blog](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) ### [Google Consent Mode v2: the complete guide to understanding and implementing it](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) [Read the article](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) Questions ## UK GDPR / PECR and cookies: your questions Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Do I still need a cookie banner in the UK after the Data (Use and Access) Act 2025? In most cases, yes. The Act added exceptions for statistical (analytics) and appearance purposes, in force since 5 February 2026, but advertising, retargeting and cross-site tracking still require prior consent. Even exempt analytics and appearance cookies require clear and comprehensive information and a simple, free way to object. A site that only uses strictly necessary cookies needs no consent request, although the ICO still expects you to explain what you use. ### Can I use Google Analytics without consent in the UK? Only if your setup fits the statistical purposes exception in Schedule A1 of PECR. The ICO says the sole purpose must be collecting statistics about how your service is used to improve it, the provider must act as your processor, and you cannot use the data to track or profile individuals, or for advertising. Measuring ad clicks or linking visitors to purchases falls outside the exception. You must also inform users and offer a simple way to object. ### Is a cookie wall allowed under UK law? The ICO's guidance says a take it or leave it approach does not meet the requirement for consent to be freely given, and you must not make consent a condition of the service unless it is necessary. Consent or pay models are treated separately: the ICO describes them as complex and has published specific guidance on them, so review that guidance before putting any payment option in front of your banner. ### How long does cookie consent last in the UK? Neither PECR nor the UK GDPR sets a fixed duration. The ICO says it depends on the scope of the original consent, what users would expect, and whether your use of cookies has changed. If someone refuses consent, the ICO considers six months a suitable period before asking again, and warns that repeatedly asking people who said no is unfair. Withdrawing consent must be as easy as giving it. ### What is the difference between UK GDPR and PECR for cookies? PECR regulation 6 is the specific rule for cookies and similar technologies: it decides whether you need consent to store or read information on a device, whether or not that information is personal data. The UK GDPR applies when the cookies process personal data, and it defines the consent standard that PECR uses. In practice you comply with both: PECR for the banner, the UK GDPR for transparency, rights and what you do with the data afterwards. ### Do the UK rules apply to a website based outside the UK? They can. Under Article 3 of the UK GDPR, the law applies to organisations outside the UK that offer goods or services to people in the UK or monitor their behaviour there, which includes tracking through cookies. The ICO also says organisations outside the UK in that situation must generally appoint a UK representative, with limited exceptions. If your site targets UK visitors, plan for UK-compliant consent. ## Official sources The texts and guidance this page is based on. - [legislation.gov.uk: PECR 2003, regulation 6 (as substituted by the Data (Use and Access) Act 2025) ](https://www.legislation.gov.uk/uksi/2003/2426/regulation/6)www\.legislation.gov.uk - [legislation.gov.uk: PECR 2003, Schedule A1 (exceptions) ](https://www.legislation.gov.uk/uksi/2003/2426/schedule/A1)www\.legislation.gov.uk - [legislation.gov.uk: PECR 2003, regulation 2 (definition of consent) ](https://www.legislation.gov.uk/uksi/2003/2426/regulation/2)www\.legislation.gov.uk - [legislation.gov.uk: Data (Use and Access) Act 2025, section 112 ](https://www.legislation.gov.uk/ukpga/2025/18/section/112)www\.legislation.gov.uk - [legislation.gov.uk: Data (Use and Access) Act 2025, Schedule 13 (PECR enforcement) ](https://www.legislation.gov.uk/ukpga/2025/18/schedule/13)www\.legislation.gov.uk - [legislation.gov.uk: Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026 ](https://www.legislation.gov.uk/uksi/2026/82/made)www\.legislation.gov.uk - [legislation.gov.uk: Data Protection Act 2018, section 157 (maximum penalties) ](https://www.legislation.gov.uk/ukpga/2018/12/section/157)www\.legislation.gov.uk - [legislation.gov.uk: UK GDPR, Article 3 (territorial scope) ](https://www.legislation.gov.uk/eur/2016/679/article/3)www\.legislation.gov.uk - [ICO: guidance on the use of storage and access technologies ](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/)ico.org.uk - [ICO: what are the PECR rules? ](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-pecr-rules/)ico.org.uk - [ICO: what are the exceptions? ](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/)ico.org.uk - [ICO: how do we manage consent in practice? ](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-we-manage-consent-in-practice/)ico.org.uk - [ICO: how do the rules apply to online advertising? ](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/how-do-the-rules-apply-to-online-advertising/)ico.org.uk - [ICO: final storage and access technologies guidance published (April 2026) ](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/04/final-storage-and-access-technologies-guidance-published/)ico.org.uk - [ICO: ICO action secures increased cookie compliance (December 2025) ](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/12/ico-action-secures-increased-cookie-compliance/)ico.org.uk - [ICO: ICO takes action to tackle cookie compliance across the UK's top 1,000 websites (January 2025) ](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/01/ico-takes-action-to-tackle-cookie-compliance-across-the-uk-s-top-1-000-websites/)ico.org.uk - [ICO: ICO warns organisations to proactively make advertising cookies compliant (January 2024) ](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/01/ico-warns-organisations-to-proactively-make-advertising-cookies-compliant/)ico.org.uk - [ICO: data protection and the EU, overview (UK representatives) ](https://ico.org.uk/for-organisations/data-protection-and-the-eu/overview-data-protection-and-the-eu/)ico.org.uk Other laws ## Other cookie and privacy laws. [GDPR · Opt-in](https://www.flowconsent.com/en/laws/gdpr) ### [GDPR and cookies: what the law requires from your website](https://www.flowconsent.com/en/laws/gdpr) [Read the guide ](https://www.flowconsent.com/en/laws/gdpr)· [ePrivacy Directive · Opt-in](https://www.flowconsent.com/en/laws/eprivacy-directive) ### [ePrivacy Directive and cookies: the rule behind every consent banner](https://www.flowconsent.com/en/laws/eprivacy-directive) [Read the guide ](https://www.flowconsent.com/en/laws/eprivacy-directive)· [CCPA / CPRA · Opt-out](https://www.flowconsent.com/en/laws/ccpa-cpra) ### [CCPA and CPRA cookies: what California law requires from your website](https://www.flowconsent.com/en/laws/ccpa-cpra) [Read the guide ](https://www.flowconsent.com/en/laws/ccpa-cpra)· [TDDDG · Opt-in](https://www.flowconsent.com/en/laws/tdddg) ### [TDDDG and cookies: what Germany's section 25 requires from your website](https://www.flowconsent.com/en/laws/tdddg) [Read the guide ](https://www.flowconsent.com/en/laws/tdddg)· [nFADP · Opt-out](https://www.flowconsent.com/en/laws/nfadp-switzerland) ### [Swiss nFADP and cookies: what the revised Data Protection Act requires from your website](https://www.flowconsent.com/en/laws/nfadp-switzerland) [Read the guide ](https://www.flowconsent.com/en/laws/nfadp-switzerland)· [LGPD · Mixed](https://www.flowconsent.com/en/laws/lgpd-brazil) ### [LGPD and cookies: what Brazil's data protection law requires from your website](https://www.flowconsent.com/en/laws/lgpd-brazil) [Read the guide ](https://www.flowconsent.com/en/laws/lgpd-brazil)· [LOPDGDD · Opt-in](https://www.flowconsent.com/en/laws/lopdgdd-spain) ### [LOPDGDD and cookies: what Spanish law requires from your website](https://www.flowconsent.com/en/laws/lopdgdd-spain) [Read the guide](https://www.flowconsent.com/en/laws/lopdgdd-spain) [See all laws](https://www.flowconsent.com/en/laws) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)