UK Cookie Consent Laws: PECR and UK GDPR Explained

What Are the UK Cookie Consent Laws?

The United Kingdom does not have one law called the “cookie law.” Website cookies and similar technologies are mainly regulated through:

• PECR: controls when a website may store information on or access information from a visitor’s device;
• UK GDPR: applies when the information collected is personal data;
• Data Protection Act 2018: supports the UK’s wider data protection framework;
• Data (Use and Access) Act 2025: introduced changes affecting PECR, including additional exceptions.

The cookie rules are primarily found in regulation 6 of PECR. They apply to more than traditional browser cookies.

If you need a broader international comparison, see our guide to cookie consent laws around the world.

What Is the Difference Between PECR and the UK GDPR?

PECR and the UK GDPR work together, but they control different parts of online tracking.

PECR applies to information, not only personal data. A technology may therefore fall under PECR even when the information it uses does not directly identify someone.

If the information is personal data, the website must also meet UK GDPR requirements such as lawfulness, fairness, transparency, data minimisation, and security.

The Information Commissioner’s Office explains that websites should consider PECR first when using storage or access technologies. The UK GDPR then applies to any related processing of personal data.

Which Technologies Are Covered by PECR?

PECR is not limited to files labelled as cookies. It can apply to any technology that stores information on or accesses information from a visitor’s device.

Examples include:

• browser cookies;
• tracking pixels;
• local storage and session storage;
• scripts and tags;
• device fingerprinting;
• link decoration and navigational tracking;
• mobile app identifiers and software development kits;
• technologies used on smart TVs and other connected devices.

Whether a technology is first-party or third-party does not decide whether PECR applies. The important questions are whether information is stored or accessed and why the technology is being used.

You can learn more in our guides to tracking pixels, local storage, and browser fingerprinting.

When Is Cookie Consent Required in the UK?

Prior consent is generally required when a cookie or similar technology does not meet a PECR exception.

Website owners should normally obtain consent before using technologies for:

• online advertising;
• personalised advertising;
• advertising measurement;
• cross-site or cross-device tracking;
• visitor profiling;
• social media tracking;
• personalised content based on behaviour;
• recording individual visitor sessions;
• analytics that tracks or profiles individual visitors.

Consent must be collected before these non-exempt technologies are activated. Loading them first and asking for permission afterwards does not meet the prior-consent requirement.

Which Cookies Can Be Used Without Consent?

Following changes introduced by the Data (Use and Access) Act 2025, PECR includes five circumstances in which storage or access may be possible without consent.

These exceptions are purpose-specific and should be interpreted narrowly. A cookie does not become exempt simply because a website owner describes it as necessary.

If the same technology is also used for advertising, profiling, or another non-exempt purpose, consent may still be required.

Strictly necessary cookies

The strictly necessary exception applies when a technology is technically essential to provide a service that the visitor has requested.

Possible examples include:

• remembering products in an online shopping basket;
• maintaining a secure login session;
• authenticating a user;
• supporting essential payment or security functions;
• remembering the visitor’s cookie choices;
• load balancing required to deliver the website.

A cookie is not strictly necessary just because it is useful to the website owner. Advertising, audience profiling, and cross-site tracking are not essential to provide the service requested by the visitor.

Statistical purposes exception

The statistical purposes exception may allow limited website analytics without prior consent. However, it is not a general exemption for every analytics tool.

To rely on this exception:

• the sole purpose must be collecting statistical information about how the service is used;
• the information must be used to improve the website or service;
• the final results must be aggregate information that does not identify people;
• individual-level information should not be retained longer than necessary for aggregation;
• the information must not be used for advertising, profiling, or decisions about individuals;
• visitors must receive clear information;
• visitors must have a simple and free way to object.

A third-party analytics provider may be used only if it acts on the website owner’s behalf and uses the information solely to help improve that website or service.

Appearance and functionality exception

This exception may apply when storage or access is used to adapt how a service looks or works according to a visitor’s preference.

Examples may include:

• remembering a visitor’s language selection;
• remembering accessibility or display preferences;
• adapting a page to the visitor’s screen;
• supporting a user-selected website function.

The website must still provide clear information and a simple, free way to object. The exception does not cover behavioural personalisation or advertising based on a visitor’s interests.

What Counts as Valid Cookie Consent?

PECR uses the UK GDPR standard of consent. Consent should be:

• freely given;
• specific;
• informed;
• unambiguous;
• given through a clear positive action.

Continuing to browse a website is not valid consent. Silence, inactivity, pre-ticked boxes, and statements that cookies are accepted automatically are also insufficient.

Visitors should understand:

• which types of technologies the website wants to use;
• why they are being used;
• which third parties are involved;
• how long the technologies remain active;
• how to accept, reject, or customise their choices;
• how to withdraw consent later.

Consent should be recorded so the website can demonstrate when and how it was obtained.

UK Cookie Banner Requirements

A cookie banner is not automatically required for every UK website. The correct consent mechanism depends on the technologies the website uses.

If a website uses non-exempt cookies or trackers, its consent banner should:

• appear before non-exempt technologies are activated;
• clearly explain why cookies and similar technologies are used;
• include an option to accept non-exempt technologies;
• include an equally accessible option to reject them;
• offer granular controls for different purposes;
• avoid pre-enabled non-exempt categories;
• identify relevant third parties;
• provide access to more detailed information;
• allow visitors to change or withdraw their choices later;
• work correctly on desktop and mobile devices.

The ICO’s current guidance shows “Accept all” and “Reject all” options with equal prominence as good practice. A banner that makes acceptance much easier than rejection may not produce freely given consent.

Example of an appropriate first layer

A simple first layer could include:

• Accept All
• Reject Non-Essential
• Customise Choices

The second layer can provide category controls and more information about purposes, providers, and duration.

Banner designs to avoid

A UK consent banner should not:

• activate marketing cookies before a choice is made;
• treat scrolling or continued browsing as consent;
• include only an “Accept” button;
• hide rejection behind several unnecessary steps;
• use pre-enabled marketing or tracking categories;
• use confusing colours or wording to push visitors towards acceptance;
• claim that every cookie is strictly necessary;
• make withdrawing consent more difficult than giving it.

See our complete guide to cookie banner requirements for more design and configuration guidance.

Do UK Websites Need a Reject All Button?

PECR does not prescribe one exact button label for every website. However, visitors must be able to refuse non-exempt technologies as easily as they can accept them.

For most standard website banners, a visible first-layer option such as “Reject All” or “Reject Non-Essential” is the clearest way to provide that choice.

Providing “Accept All” on the first layer while hiding rejection inside a settings menu creates an unnecessary imbalance. It may also make it harder to demonstrate that consent was freely given.

Do Analytics Cookies Require Consent in the UK?

Some limited analytics may now qualify for the statistical purposes exception. This does not mean that all analytics cookies can be activated automatically.

Consent is still likely to be required when analytics is used to:

• track individual visitors over time;
• create visitor profiles or audience segments;
• connect website behaviour with advertising data;
• measure advertising performance;
• share information with advertising partners;
• follow visitors across different websites or services;
• personalise content for specific people or groups.

Before treating analytics as exempt, the website owner should examine the tool’s purpose, configuration, retention period, provider relationship, and any additional use of the information.

Our separate guide explains what website owners should know about Google Analytics cookie consent.

What About YouTube, Maps, and Social Media Embeds?

Embedded services can load cookies, pixels, scripts, or other technologies from third parties.

Examples include:

• YouTube and Vimeo videos;
• Google Maps;
• social media sharing or feed plugins;
• chat widgets;
• advertising widgets;
• third-party forms.

Website owners should check what an embedded service loads before the visitor interacts with it.

Possible approaches include:

• blocking the embed until the visitor consents;
• using a privacy-enhanced mode where available;
• displaying a placeholder with a clear activation button;
• using an external link instead of an automatic embed.

In limited circumstances, a visitor’s deliberate request to activate an embedded function may support its necessary operation. However, any separate analytics, advertising, or tracking performed by the provider still needs to be assessed.

Does a UK Website Need a Cookie Policy?

Website owners must provide clear and comprehensive information about the storage and access technologies they use.

A cookie policy should normally explain:

• which cookies and similar technologies are used;
• the purpose of each technology;
• which provider controls it;
• whether it is first-party or third-party;
• how long it remains active;
• whether consent is required or an exception is being used;
• how visitors can manage or withdraw their choices.

The information should be easy to find and written in language ordinary visitors can understand.

Learn how to structure this information in our guide on how to create a cookie policy page.

Do UK Cookie Laws Apply to Websites Outside the UK?

A business does not necessarily avoid UK requirements because its website or company is located in another country.

The scope depends on factors such as:

• whether the online service is provided to people in the UK;
• whether the website targets UK customers;
• where the visitor and relevant equipment are located;
• what tracking technologies are used;
• whether personal data is collected from people in the UK.

International websites may also need to consider EU rules or other regional privacy laws at the same time.

What Happens If a Website Does Not Comply?

The Information Commissioner’s Office is responsible for enforcing PECR and UK data protection requirements.

Possible regulatory action can include:

• requests for information;
• compliance investigations;
• enforcement notices;
• requirements to change how technologies are used;
• monetary penalties for serious infringements.

The PECR enforcement framework is being aligned more closely with the UK GDPR framework following the Data (Use and Access) Act. The ICO has stated that it will update its detailed enforcement guidance as the new regime takes effect.

Website owners should not base compliance decisions only on the possible size of a fine. Incorrect tracking can also create complaints, loss of visitor trust, and problems with advertising or analytics providers.

Practical UK Cookie Compliance Checklist

Website owners can use the following steps to review their UK setup.

A cookie audit can help identify the technologies your website currently loads.

After configuring your consent solution, follow our guide on how to test a cookie banner.

Official UK Cookie Guidance

The Information Commissioner’s Office published its final detailed guidance on storage and access technologies on 29 April 2026.

The guidance covers cookies, pixels, scripts, tags, fingerprinting, web storage, consent mechanisms, the five PECR exceptions, online advertising, and the relationship between PECR and the UK GDPR.

Website owners can read:

• ICO guidance on storage and access technologies;
• ICO guidance on PECR exceptions;
• ICO guidance on managing consent;
• regulation 6 of PECR.

Conclusion

UK cookie consent laws are mainly based on PECR and the UK GDPR. Websites generally need prior consent before activating advertising, profiling, cross-site tracking, and other non-exempt technologies.

Consent must be informed, specific, and given through a positive action. Visitors should be able to reject non-exempt technologies as easily as they can accept them and should be able to change their choices later.

The newer statistical and appearance exceptions may reduce the need for consent in limited situations. However, they have specific conditions and should not be treated as general exemptions for analytics or preference technologies.

The practical starting point is to identify what the website loads, determine the purpose of each technology, assess whether an exception genuinely applies, and block everything else until valid consent is received.

Ready to compare the UK approach with European Union rules? Continue with our EU cookie consent guide to understand the GDPR and ePrivacy requirements.

This article provides general information about cookie consent and privacy requirements. It does not constitute legal advice.