A current guide to UK cookie consent law — the relationship between PECR and UK GDPR, which cookies still need consent, the new exemption categories from February 2026, and what a compliant cookie banner must do.
The Data (Use and Access) Act 2025 amended PECR and UK GDPR. The ICO published its final storage and access technologies guidance on 29 April 2026, and the maximum PECR penalty is now £17.5 million or 4% of worldwide annual turnover, whichever is higher. Website operators should review both their technology and the choices offered to users against these rules.
This guide covers the law as it stands today: how PECR and UK GDPR fit together for cookies, which cookies still need consent, the new exemption categories, what makes a banner compliant, and the new "instigator" concept that extends liability to organisations beyond the website operator itself.
PECR and UK GDPR: how cookie law actually works
A persistent source of confusion is that UK cookie law sits in two separate regimes. UK GDPR is the broader data protection regulation. The Privacy and Electronic Communications Regulations 2003 (PECR) is the specific law governing cookies and similar technologies, electronic marketing, and certain telecoms-related data protections.
The split matters because each regime does different work:
- PECR is the law that requires consent before cookies or similar storage technologies are placed on a user's device. The requirement applies regardless of whether the cookie contains personal data. It is set out in regulation 6 of PECR.
- UK GDPR provides the standard for what counts as valid consent. If PECR requires consent, UK GDPR's definition of consent (Article 4(11)) and its conditions (Article 7) apply.
In practical terms, that means a cookie banner has to do two things at once: meet the PECR requirement that consent has been obtained before non-exempt cookies are set, and meet the UK GDPR standard for what counts as consent — freely given, specific, informed, unambiguous, and given by clear affirmative action.
The DUAA expanded the PECR exceptions and increased the maximum penalties. Consent for a non-exempt purpose must still meet the UK GDPR standard; the changes do not make passive acceptance or pre-ticked boxes valid.
For the consent standard itself, see our lawful basis and consent guide.
Which cookies need consent today
The default position under PECR regulation 6 is that consent is required before cookies or similar technologies are placed on a user's device. The exception covers technologies that are either "strictly necessary for the provision of a service explicitly requested by the user" or, under the new framework, fall within one of the specific exemption categories the DUAA added.
In practice, cookies typically fall into one of four working categories:
Strictly necessary cookies
These are essential for the website to function — session cookies that maintain a logged-in state, basket cookies that remember items being purchased, security cookies that prevent fraud, load-balancing cookies that route traffic. These require no consent and never have under PECR. The "strictly necessary" test is genuinely strict — necessary for the service the user explicitly requested, not just useful for the operator.
Functionality cookies
Some preferences can qualify for the appearance exception or, depending on the purpose, the strictly necessary exception. The appearance exception requires clear information and a simple, free way to object. Personalising content or advertising from a behavioural profile does not qualify.
Analytics cookies
Cookies used to measure how users interact with a site. The DUAA introduced a limited exemption for cookies used for statistical purposes, but the exemption is narrower than many operators assume — it does not cover analytics tools that also feed advertising or are shared with third parties for their own purposes.
Marketing and advertising cookies
These continue to require consent. Targeted advertising, retargeting, behavioural profiling, third-party advertising network cookies, and cross-site tracking pixels all sit firmly within the consent requirement and will not benefit from the new exemptions.
The fourth category — marketing and advertising — has been the focus of recent ICO compliance work. The regulator announced active monitoring of the top UK websites for cookie compliance in 2023, and that work has continued.
The new exemption categories under the DUAA
From 5 February 2026, the DUAA broadened the categories of cookies and similar technologies that do not require consent under PECR. The ICO's Storage and Access Technologies guidance, finalised on 29 April 2026, sets out how the new categories are intended to operate.
There are five exceptions in total, including the two existing exceptions and three added by the DUAA:
- Communication — storage or access whose sole purpose is transmitting a communication over an electronic communications network.
- Strictly necessary — technologies essential to provide the online service the user requests, such as a shopping basket or appropriate security functions meeting the exception's conditions.
- Statistical purposes — aggregate information about use of the service to improve it. Provide clear information and a simple, free objection route. A provider may assist only for that service-improvement purpose.
- Appearance — adapting the service's appearance or functionality to user preferences, with clear information and a simple, free objection route. Behavioural content targeting is outside this exception.
- Emergency assistance — identifying a device's location solely to provide emergency assistance after a request or another indication that help is needed.
Each exception has specific conditions. A mixed-purpose technology needs consent if any purpose is not exempt. Statistics and appearance require clear information and a free, simple objection mechanism. Security and software updates are not separate additional exception categories.
Assess the actual configuration and purposes, rather than the product name. Advertising, cross-site profiling and recording identifiable individual journeys do not qualify for the statistical exception. Third-party assistance is allowed only within the permitted service-improvement purpose and relevant data protection safeguards.
What a compliant cookie banner must do
The ICO's expectations for cookie banners are now well-established and reflected in published guidance and enforcement decisions. A compliant banner has to deliver several things at once.
Equal prominence for accept and reject
Users must find it as easy to reject non-essential cookies as to accept them. A banner with a large "Accept all" button and a small "Manage settings" link that requires further clicks to reject fails this test. Either both options appear at the first layer, or a single click rejects all non-essential cookies.
No pre-ticked boxes
Consent must be a clear affirmative action. Boxes that are pre-ticked when the banner first appears do not produce valid consent — a position confirmed by the CJEU in Planet49 and retained under UK law.
No cookie walls
A take-it-or-leave-it cookie wall will generally not provide freely given consent where the processing is unnecessary for the requested service. A consent-or-pay model requires its own documented assessment of genuine choice, an appropriate fee, equivalence and privacy by design; a payment option does not automatically establish compliance.
Granular controls
Where multiple categories of non-essential cookies are deployed, users should be able to consent to some and reject others. A single "accept all" button without granular options does not satisfy the specificity requirement of UK GDPR consent.
Clear information
The banner must explain — at the first layer — what cookies are being set, by whom, and for what purposes. A vague "we use cookies to improve your experience" with no further information does not meet the informed standard.
No setting of non-exempt cookies before consent
Do not activate storage or access for a non-exempt purpose before obtaining consent. Analytics can qualify for a narrow exception, so the legal test concerns the actual purpose and conditions rather than the label analytics alone.
Easy withdrawal
Users must be able to change or withdraw their consent at any time. This typically means a persistent link or icon — sometimes a floating button — that opens the cookie preferences from any page.
The guidance distinguishes legal requirements from recommended ways of meeting them. Test both the interface and the underlying tags: a banner's appearance alone does not demonstrate that the technology respects the user's choice.
Storage and access technologies beyond cookies
PECR has long covered storage and access technologies beyond HTTP cookies. The updated guidance explains how these rules apply to current technologies, including local storage, pixels and fingerprinting.
Within scope:
- HTTP cookies — first-party and third-party.
- Local and session storage — modern browser storage mechanisms used by JavaScript applications.
- Tracking pixels and web beacons — small images or scripts that allow data to be read from a user's device or browser.
- Fingerprinting — techniques that combine browser, device, and network characteristics to identify a user without setting a cookie.
- Cache-based tracking — using browser caching mechanisms to store identifying information.
- SDK-based tracking on mobile apps — software development kits that read or write data on a user's device.
The same consent rules apply across these technologies. An operator that has replaced cookies with fingerprinting has not stepped outside the regulation — they have changed the technology while keeping the underlying processing, and PECR and UK GDPR both follow.
For more on how the underlying personal data definition applies to identifiers and online signals, see our personal data guide.
The "instigator" rule
The DUAA introduced a new concept that materially widens the reach of PECR liability. Under the new framework, responsibility for non-compliant placement of cookies or similar technologies extends not only to the party that directly sets the cookie but to any party that instigates the placement.
Responsibility depends on what each party actually does. Examples to assess include:
- Website operators configuring a tag manager to cause third-party storage or access on visitors' devices.
- Advertising partners whose instructions or systems cause storage or access through a participating site.
- Service providers that cause another party to deploy storage or access technologies. Being a processor or sub-processor does not by itself settle liability.
Assess the actual storage, access and instigation across the parties. Contracts and third-party implementation do not remove an organisation's own obligations, but responsibility should not be assigned solely from a job title or place in the supply chain.
For the controller and processor framework that sits behind this, see our controller vs processor guide.
The PECR penalty maximum
From 5 February 2026, the higher PECR penalty maximum became £17.5 million or, for an undertaking, 4% of total worldwide annual turnover, whichever is higher. The fixed sterling maximum is 35 times the former £500,000 cap; individual penalties are not automatically multiplied by 35.
The ICO assesses infringements in their circumstances, including seriousness, relevant turnover, aggravating or mitigating factors and proportionality. The applicable provisions and transitional rules depend on the conduct involved. A maximum penalty is not the expected fine for every infringement.
Cookie compliance can lead to substantial regulatory penalties. The statutory maximum alone does not establish that a particular cookie infringement is as serious as a particular personal data breach. Enforcement depends on the facts and the legal duties breached.
For the wider enforcement picture, see our fines guide.
Common cookie banner failures
Cookie controls should avoid patterns such as:
- "Accept all" prominently styled, with no equivalent "reject all" at the same level.
- "Manage settings" or "More options" used as the reject route, requiring extra clicks the accept route doesn't.
- Pre-ticked boxes for specific cookie categories, particularly analytics or marketing.
- Non-exempt storage or access occurring before a user has given valid consent, including when the banner is first displayed.
- No persistent way to withdraw consent once given.
- Generic descriptions that do not identify the actual cookies or their purposes.
- Making unnecessary tracking an unavoidable condition of access without a valid freely given choice.
- Banners that disappear without a clear choice, defaulting to consent if the user closes them.
Operators reviewing their current banner against this list should also confirm the underlying tag management — many compliance issues sit not in the banner itself but in how cookies are actually triggered behind it.
For broader context on how cookie compliance fits within UK data protection law, see our hub guide to UK GDPR and our UK GDPR vs EU GDPR guide — which covers the divergence between UK cookie rules and the EU's ePrivacy framework.
Frequently asked questions
Do I need consent for analytics cookies?
Some analytics qualify for the statistical purposes exception where their sole purpose is producing aggregate information to improve the service, with clear information and a simple free objection route. A third-party provider may assist within that limited purpose. Advertising, profiling or individual tracking does not qualify.
What is a cookie wall?
A cookie wall makes access conditional on accepting tracking. A take-it-or-leave-it design will generally not provide freely given consent for unnecessary processing. Consent-or-pay models need a separate assessment under the ICO's published criteria.
Are "reject all" buttons required?
Where a service offers an accept-all option for technologies requiring consent, the ICO expects an equally accessible and prominent reject-all choice at the same level. A route requiring extra steps only to refuse does not provide an equivalent choice. Exempt technologies have separate conditions, including objection controls where required.
What changed under the DUAA?
From 5 February 2026, PECR gained additional exceptions with specific conditions, higher penalty limits, and provisions concerning parties who instigate storage or access. The higher penalty maximum is £17.5 million or 4% of an undertaking’s worldwide annual turnover, whichever is higher. Responsibility depends on the actual activities involved.
Does PECR or UK GDPR govern cookies?
Both, in different ways. PECR contains the specific requirement to obtain consent before non-exempt cookies or similar technologies are placed on a user's device. UK GDPR provides the standard for what counts as valid consent. The two work together, and compliance requires meeting both.
What's the maximum fine for cookie violations?
The higher maximum is £17.5 million or 4% of an undertaking’s total worldwide annual turnover, whichever is higher, from 5 February 2026. Conduct dates and transitional rules matter for an individual case; the former £500,000 cap remains relevant when describing older conduct and notices.
Related guides
- GDPR fines and penalties in the UK: how big, who pays, what counts
- GDPR data breach: what to do in the first 72 hours
- GDPR privacy notices: what they must contain and how to write one
Make sure your team is trained to handle personal data safely under UK data protection law.
Explore the GDPR & Data Protection Course →Sources & references
- ICO: storage and access technologies guidance, April 2026
- ICO: the five exceptions and their conditions
- ICO: managing consent in practice
- ICO: consent or pay
- ICO: DUAA changes to PECR
- DUAA section 112: amended PECR storage/access rules
Mark writes about data protection, GDPR compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.