Get cookie consent under PECR

If your website uses cookies or similar tracking technologies, you must comply with the Privacy and Electronic Communications Regulations 2003 (PECR). These rules require you to tell visitors about cookies and get their consent before setting cookies unless a statutory exemption applies.

The Information Commission (formerly the ICO) enforces PECR. Since the Data (Use and Access) Act 2025, fines for failing to comply can reach £17.5 million or 4% of global turnover.

What counts as a cookie

PECR applies to:

• Cookies (small text files stored on devices)
• Local storage and session storage
• Tracking pixels and web beacons
• Device fingerprinting
• Any technology that stores or accesses information on a user's device

If you're reading or writing data on someone's device, PECR applies.

Which cookies need consent

Consent is required unless a cookie meets a statutory exemption. These include strictly necessary cookies and qualifying statistical-purpose cookies under Schedule A1 to PECR.

Strictly necessary cookies (no consent required)

You can set these cookies without asking permission. They must be essential for the service the user has requested:

• session cookies that keep a user logged in while browsing
• shopping basket cookies that remember items added to the basket
• load balancing cookies that spread traffic across servers
• security cookies used for fraud prevention and authentication
• accessibility cookies that remember a user's accessibility preferences
• first-party cookies that prevent data loss if a form submission fails

You must still tell users about strictly necessary cookies in your cookie policy, but you don't need consent to set them.

Cookies requiring consent unless an exemption applies

These cookies cannot be set until the user actively agrees:

• analytics cookies, unless the configuration meets all conditions of the statistical-purposes exemption
• advertising cookies, such as ad networks and retargeting
• social media cookies, such as the Facebook pixel and Twitter tracking
• third-party tracking for advertising or profiling
• personalisation cookies that make recommendations based on browsing history
• A/B testing cookies used to track user behaviour over time

Assess each cookie against the statutory conditions; a product name or first-party label does not establish an exemption. Advertising and profiling still require consent.

The statistical-purposes exemption

The Data (Use and Access) Act 2025 added the Schedule A1 exemptions to PECR, which came into force on 5 February 2026. Under paragraph 5 of Schedule A1, you can set analytics cookies without consent only if all of these apply:

• storage or access is solely for collecting statistics about use of your service or website, to improve it
• you share the information collected only to get help improving that service or website
• you give users clear, comprehensive information about the purpose
• you give users a free, simple way to object, and respect it

Use the Commission's guidance to assess your set-up, and get consent if any condition is not met. Tracking, profiling and advertising cookies always need consent.

Getting valid consent

Cookie consent must meet the UK GDPR standard. Before you ask, tell users what cookies do, who sets them and how long they last. Consent must be:

What doesn't count as consent

The Commission has been clear that certain practices do not constitute valid consent:

• Pre-ticked boxes do not count. Users must actively opt in.
• Implied consent from browsing, such as 'By continuing to use this site you consent', is not valid.
• Scrolling or clicking elsewhere does not count. Only an explicit 'Accept' does.
• Bundled consent is not valid. Users must be able to accept some cookies but not others.
• Cookie walls, which make access to the website conditional on accepting all cookies, are not valid.
• 'Reject' must be as easy to find as 'Accept'.
• Design that manipulates users into accepting (dark patterns) is not valid.

Writing your cookie policy

Your cookie policy must include: what cookies you use (by name), their purpose in plain English, whether first or third party, duration, and how to manage or withdraw consent. Review it whenever you add new services.

Penalties for non-compliance

The Commission takes cookie compliance seriously, and the Data (Use and Access) Act 2025 raised the maximum penalties.

Common enforcement triggers

The Commission investigates when: cookies are set before consent, no genuine reject option, 'Reject' is hidden, cookie walls block content, or third-party tracking lacks disclosure. The Commission often begins with warnings, but businesses that ignore them face significant fines.

Compliance checklist

Your cookie banner must be prominent, clear and give users genuine control. Check that your website meets each PECR cookie requirement: