# UK GDPR and PECR: cookie consent rules in the United Kingdom > In the United Kingdom, regulation 6 of PECR requires consent before any cookie or similar technology is stored on or read from a visitor's device, unless it is strictly necessary for a service the visitor asked for. Since 5 February 2026 the Data (Use and Access) Act 2025 adds narrow exceptions for first-party statistics and appearance preferences, provided visitors are told and can object, and it lets the ICO fine PECR breaches at UK GDPR levels. The ICO expects Reject to be as easy as Accept and has tested the 1,000 most visited UK websites against that standard. Source: https://cookiequiet.com/laws/uk-gdpr-pecr Published: 2026-10-20 Publisher: Cookiequiet ## Quick facts - **Applies to:** Anyone storing or accessing information on the device of a user in the UK (PECR), and any organization processing UK residents' personal data, wherever it is established (UK GDPR Article 3) - **Consent model:** Opt-in consent to the UK GDPR standard before non-essential cookies; opt-out (a simple means of objecting) for the new statistical and appearance exceptions - **Cookie rule:** PECR regulation 6, as amended by section 112 and Schedule 12 of the Data (Use and Access) Act 2025 from 5 February 2026 - **Maximum fine:** £17.5 million or 4% of worldwide annual turnover, whichever is higher, under the UK GDPR; PECR fines aligned with that scale since 5 February 2026 (previously £500,000) - **Authority:** Information Commissioner's Office (ICO) - **In force since:** PECR 11 December 2003 (consent rule since 26 May 2011); UK GDPR 1 January 2021; Data (Use and Access) Act Royal Assent 19 June 2025 ## What are the UK GDPR and PECR? Three texts govern cookies in the United Kingdom. The UK GDPR is the EU regulation as retained in UK law after Brexit, applicable since 1 January 2021 and supplemented by the Data Protection Act 2018; it sets the definition of consent, the principles and the fines. The Privacy and Electronic Communications (EC Directive) Regulations 2003, or PECR, transpose the [ePrivacy Directive](/laws/eprivacy-directive); their regulation 6 is the UK cookie rule. The Data (Use and Access) Act 2025 (DUAA), which received Royal Assent on 19 June 2025, amends both, and its cookie and enforcement provisions came into force on 5 February 2026. ## Who do they apply to? PECR regulation 6 applies to anyone who stores information on, or gains access to information stored in, the terminal equipment of a subscriber or user in the UK, regardless of where the website operator is based. The UK GDPR applies to organizations established in the UK and to organizations elsewhere that offer goods or services to people in the UK or monitor their behavior, which covers analytics and advertising tracking of UK visitors. There is no small business exemption for either. ## What do they require for cookies, trackers and consent? Regulation 6 has two conditions: the user must be given clear and comprehensive information about the purposes of the storage or access, and must have given consent. The ICO reads consent as the UK GDPR consent: freely given, specific, informed, unambiguous, by a clear affirmative action. Browser settings alone are not enough, and the ICO says you cannot rely solely on them to decide whether a user has objected. The rule covers far more than cookies. The ICO's guidance on the use of storage and access technologies, finalized in April 2026, applies it to tracking pixels, local storage, scripts, device fingerprinting and similar techniques. There are now five exceptions: 1. **Communication**: storage or access whose sole purpose is transmitting a communication, such as load-balancing session cookies. 2. **Strictly necessary**: essential for a service the user requested, judged from the user's perspective. Advertising never qualifies. 3. **Statistical purposes** (new, since 5 February 2026): collecting aggregate statistics about how the service is used, to improve it, provided you give clear information, offer a simple and free way to object, aggregate the data, share it only with a processor acting for you, and never use it for advertising, profiling or tracking individuals. 4. **Appearance and functionality** (new): adapting the service to the user's preferences, with the same information and objection conditions, and no content based on inferred interests. 5. **Emergency assistance** (new): locating a device to help someone who asked for help. If a user objects under the statistical or appearance exceptions you must stop, and if you use the technology for any purpose beyond the exception, you need consent. Advertising cookies, cross-site tracking, social media pixels and profiling still need prior consent. The ICO also expects the choice to be fair: in its view a banner with a large Accept button and a buried Reject link does not give a real choice. ## What must a compliant banner do? - Show the banner before any non-essential technology runs, and hold the tags until the visitor chooses. - Offer Accept and Reject with equal prominence on the first screen, which is the standard the ICO applied when it tested the top 1,000 UK websites. - Explain the purposes in plain terms and name the third parties. - Give a per-purpose choice with nothing pre-ticked, and keep a visible way to change the choice later. - For statistics or appearance cookies used without consent, say so and provide the simple, free means of objecting the Act requires. - Keep a record of consent to meet the UK GDPR's accountability duty. ## Enforcement and fines The ICO has run a visible program against non-compliant banners rather than a series of large fines. In November 2023 it wrote to the most visited UK websites warning that advertising cookies set before a choice, or a Reject option harder to find than Accept, would lead to enforcement. In December 2025 it reported the results for the top 1,000 sites: 979 passed its checks, 415 without intervention and 564 after the ICO's engagement, with 17 preliminary enforcement notices issued and action continuing against the 21 sites still failing. The ICO says it will keep testing the top 1,000 sites periodically. Fines are where the 2026 reform bites. Before 5 February 2026 the maximum PECR fine was £500,000. Schedule 13 of the DUAA applies the Data Protection Act 2018 penalty regime to PECR, so breaches of regulation 6 can now be fined on the UK GDPR scale: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. Enforcement notices and the ICO's audit and information powers apply as well. ## How Cookiequiet handles UK law Cookiequiet treats the UK as a consent country: the banner appears for UK visitors when geo-targeting is on, nothing non-essential runs until they choose, and Accept all and Reject all have the same weight. The categories map onto the ICO's purposes, the preferences center stays reachable from every page, and the consent log records each choice with the banner version, which is the evidence the ICO asks for in an audit. [Google Consent Mode v2](/guides/google-consent-mode-v2) is set to denied by default for UK visitors, so Google Ads and Analytics tags respect the choice. If you rely on the new statistical exception for a first-party analytics tool, keep the simple means of objecting in the preferences center; the [cookie audit checklist](/guides/cookie-audit-checklist) walks through what to document. Policies generated by Cookiequiet are templates written for the UK GDPR and PECR, not legal advice. ## Questions ### Do I still need a cookie banner in the UK after the Data (Use and Access) Act? Yes, for anything beyond the exceptions. The Act exempts first-party statistics and appearance preferences, with information and a right to object, but advertising cookies, cross-site tracking, social media pixels and profiling still need prior consent under regulation 6 of PECR. ### Can Google Analytics run without consent under the UK statistical exception? Only if the use fits the exception: aggregate statistics about your own service, a processor acting for you that does not link the data to other information, no advertising or profiling, clear information and a simple free way to object. A Google Analytics setup linked to Google Ads or used for audiences does not fit, so it still needs consent. Check the ICO guidance for your configuration. ### What is the maximum fine for cookie breaches in the UK? Since 5 February 2026, PECR breaches can be fined on the UK GDPR scale, up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. Before that date the PECR maximum was £500,000. ### Does the ICO require a Reject all button? The ICO's position is that rejecting non-essential cookies must be as easy as accepting them, and it tested the top 1,000 UK websites against that standard in 2024 and 2025. A banner with Accept on the first screen and Reject hidden behind a settings link fails that test. ## Sources - [Privacy and Electronic Communications (EC Directive) Regulations 2003, regulation 6 (legislation.gov.uk)](https://www.legislation.gov.uk/uksi/2003/2426/regulation/6) - [Data (Use and Access) Act 2025, section 112: storing information in the terminal equipment of a subscriber or user](https://www.legislation.gov.uk/ukpga/2025/18/section/112) - [Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026 (SI 2026/82), in force 5 February 2026](https://www.legislation.gov.uk/uksi/2026/82/made) - [Data Protection Act 2018, section 157: maximum amount of penalty](https://www.legislation.gov.uk/ukpga/2018/12/section/157) - [ICO, Guidance on the use of storage and access technologies: what are the exceptions?](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/) - [ICO, ICO action secures increased cookie compliance (December 2025)](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/12/ico-action-secures-increased-cookie-compliance)