UK GDPR and PECR cookie rules for business websites (2026)

Last checked: October 2026. Two sets of rules decide how a UK business website can use cookies and similar technologies. The Privacy and Electronic Communications Regulations 2003 (PECR) govern storing or reading information on a visitor’s device. The UK GDPR governs any personal data you collect that way, and it sets the standard for what counts as valid consent.

The Data (Use and Access) Act 2025 (DUAA), which received Royal Assent on 19 June 2025, rewrote the PECR cookie rule. Since 5 February 2026 some low-risk uses, including certain analytics, no longer need consent, and PECR fines can now reach £17.5 million or 4 % of global turnover. The ICO published its final guidance, now called guidance on storage and access technologies, on 29 April 2026.

This article is practical guidance from a web agency, not legal advice. For high-risk processing or a complaint, talk to a data protection specialist.

Regulation 6 of PECR, as substituted by section 112 of the DUAA, says you must not store information, or gain access to information stored, on a user’s device unless one of the exceptions in the new Schedule A1 applies. The most familiar exception is consent: the user is given clear and comprehensive information about the purpose and then agrees.

PECR applies even when no personal data is involved: the ICO points out that regulation 6 is about “information”, not “personal data”. Where the information is personal data – which is usually the case with identifiers, analytics and advertising tags – the UK GDPR applies as well, so you have to comply with both.

Not just cookies

The ICO’s guidance covers cookies alongside tracking pixels, link decoration, local storage, device fingerprinting, and scripts and tags. The ICO says the wider wording reflects the technologies organisations now use and has not expanded the scope of the law. A social media tracking pixel on your checkout page is in scope just as much as a classic cookie.

The consent standard

Where consent is needed, PECR uses the UK GDPR definition. According to the ICO, consent must be freely given, specific, informed and unambiguous, given by a clear affirmative action. Silence, inactivity and pre-ticked boxes do not count, and you must be able to show records that demonstrate consent. When PECR requires consent and the information is personal data, the ICO says you should use consent as your UK GDPR lawful basis for the subsequent processing as well.

The ICO’s guidance sets out five exceptions to the ban on storing or accessing information on a device. Each one applies only where your use stays within its purpose.

• Communication: the sole purpose is transmitting a communication over a network – for example a session cookie used for load balancing.
• Strictly necessary: the storage or access is strictly necessary to provide the service the user asked for. PECR’s examples include security of the device, preventing or detecting fraud, detecting technical faults and authenticating the user. Advertising cookies are not strictly necessary, even if the revenue funds your site.
• Statistical purposes (analytics): the sole purpose is collecting statistical information about how your service is used, with a view to improving it. The information collected may only be shared with others to help you improve the service or website. You must give clear and comprehensive information and a simple means of objecting, free of charge. Where you repeat the same storage or access for the same purpose, Schedule A1 says it is enough to meet those conditions at the first use.
• Appearance: the sole purpose is adapting how the service looks or works to the user’s preferences, with the same information and objection duties.
• Emergency assistance: the sole purpose is locating a device so that emergency help can be provided.

The sole-purpose trap

The ICO is clear that you cannot rely on the statistical exception while also using the same information for something else, such as online advertising. Advertising-related purposes – frequency capping, ad measurement, click-fraud detection and similar – do not fall within any exception. If you use third-party analytics, you need appropriate arrangements with the provider, and any consent request must name the third parties involved.

The Secretary of State can add or change exceptions by regulations, after consulting the ICO and with the approval of both Houses of Parliament. On 18 May 2026 the ICO published its advice to government on how regulation 6 could be amended to let certain low-risk forms of online advertising run without consent. The ICO stresses that nothing has changed at this stage and the existing PECR rules still apply. When we checked in October 2026, legislation.gov.uk showed no outstanding changes to Schedule A1, so advertising still needs consent.

This table summarises the position as the ICO describes it. Edge cases depend on exactly how a tool is configured, so treat it as a starting point for your own audit.

Until 4 February 2026, regulation 6(4) contained only two exemptions: communication and strictly necessary. The ICO has always said “strictly necessary” means essential to provide the service the user requests, not merely useful for the provider. Analytics therefore normally needed consent before the new statistical purposes exception arrived.

The ICO’s consent guidance is specific. In practice, a compliant banner on a business site does the following:

• Sets no non-exempt technologies before the user has taken a positive action to consent, and keeps their toggles switched off by default in a “more options” panel.
• Makes refusing as easy as accepting. The ICO’s good-practice example shows equally prominent “accept all” and “reject all” options next to a “more options” button; its bad-practice example offers “accept all” and “more options” with no “reject all”.
• Does not rely on “by continuing to use our website, you consent” wording, even with an “OK” button next to it. The ICO treats this as pre-enabling technologies without consent.
• Lets users withdraw consent as easily as they gave it and tells them how to revisit their choices, for example through a settings icon or link that stays available.
• Tells users which third parties their information will be shared with, either on the first layer or on a second layer that the first layer clearly points to.
• Honours a refusal: technologies are only set when valid consent has been given or an exception applies.

On 23 January 2025 the ICO announced plans to bring the UK’s top 1,000 websites into compliance. It had already assessed the top 200 and raised concerns with 134 of them. On 4 December 2025 it reported that 979 of the top 1,000 sites met its compliance checks at their most recent test: 415 without any intervention and 564 after initially failing and being contacted by the ICO. The ICO started with letters, opened investigations where that did not work, and issued preliminary enforcement notices in 17 cases. It also said consent management platforms had changed their banner options to be compliant by default. With its final guidance in April 2026, the ICO put the share of the top 1,000 sites meeting its cookie banner standards at 99 %.

The DUAA also aligns PECR enforcement with the UK GDPR regime under the Data Protection Act 2018. Since 5 February 2026 the ICO can fine up to £17.5 million or 4 % of global turnover under PECR. Its storage and access guidance says it will produce new guidance on its approach to PECR enforcement to replace the Regulatory Action Policy. When we checked in October 2026, that chapter still said the Regulatory Action Policy applies in the meantime and that monetary penalties are reserved for the most serious infringements. For a small business, the realistic first step is a letter, not a fine – but that is no reason to leave a broken banner in place.

1. Audit what actually loads. Open the site in a clean browser and list every cookie, pixel, local storage entry, script and tag: who sets it, what for, and how long it lasts. Check checkout, booking and embedded video pages, not just the home page.
2. Classify each item against the five exceptions. Anything with an advertising or cross-site purpose goes in the consent category.
3. Decide on analytics. If you want to run analytics without consent, configure it for statistics only, switch off advertising features and data sharing, and check your contract with the provider. Tell users what you collect and give them a simple, free opt-out.
4. Configure your consent management platform (CMP): block non-exempt tags by default, show “reject all” as prominently as “accept all”, keep non-exempt categories switched off by default, list third parties and add a settings link that stays available.
5. Update your privacy and cookie notice so the information is clear and comprehensive, including the analytics opt-out and your UK GDPR transparency information.
6. Keep records of consent: what the user saw (banner version), what they chose and when.
7. Test after every change. Reject everything, then check the browser’s network and storage tabs to confirm nothing non-exempt has loaded. Repeat whenever marketing adds a new tag.

Common culprits on small business sites

The banner itself is often only part of the problem. Tracking tends to arrive through things added later: embedded videos and maps, social media pixels, live chat widgets, booking and review tools, and A/B testing scripts. Many of these set their own cookies or read device information as soon as the page loads. Load them only after consent, or use a privacy-friendly mode or a click-to-load placeholder where the provider offers one.

Cookie compliance is mostly an implementation problem: tags fire too early, banners are styled to nudge, and analytics settings drift. We set up consent management, tag loading and analytics configuration as part of our web builds and maintenance – see our services. If you would like us to check what your site loads today, get in touch.

• Data (Use and Access) Act 2025, section 112 – Storing information in the terminal equipment of a subscriber or user
• Privacy and Electronic Communications (EC Directive) Regulations 2003, Schedule A1
• PECR regulation 6 as it stood on 4 February 2026 (legislation.gov.uk, point in time)
• The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, regulation 2
• GOV.UK – Data (Use and Access) Act 2025: factsheets
• GOV.UK – Data (Use and Access) Act factsheet: PEC Regulations
• ICO – Guidance on the use of storage and access technologies: About this guidance
• ICO – Guidance on the use of storage and access technologies: What are the exceptions?
• ICO – Guidance on the use of storage and access technologies: How do the PECR rules relate to the UK GDPR?
• ICO – Guidance on the use of storage and access technologies: How do we manage consent in practice?
• ICO – Guidance on the use of storage and access technologies: What happens if we don’t comply?
• ICO – Final storage and access technologies guidance published (29 April 2026)
• ICO – Statement on the commencement of the Data (Use and Access) Act (DUAA)
• ICO – What is valid consent?
• ICO – What are PECR?
• ICO – Fact vs fiction: ICO debunks myths on storage and access technologies (September 2025)
• ICO – ICO takes action to tackle cookie compliance across the UK’s top 1,000 websites (January 2025)
• ICO – ICO action secures increased cookie compliance (December 2025)
• ICO – Our advice to government on potential changes to online advertising rules (18 May 2026)