UK Cookie Law 2026: What PECR and the ICO's New Guidance Actually Require

The ICO published finalised guidance on tracking technologies on April 29, 2026 — the most significant update to UK cookie rules since GDPR. The Data Use and Access Act raised PECR fines from £500,000 to £17.5 million. Three new cookie exemptions came into force in February 2026. This is the complete picture of what UK websites must do now — including what changed, what didn't, and where agencies are still getting it wrong.

UK cookie compliance sits at the intersection of two statutes and one regulator. PECR (Privacy and Electronic Communications Regulations 2003) creates the consent requirement for placing cookies. UK GDPR defines what valid consent looks like and applies when those cookies process personal data. Both are enforced by the ICO. The rules are broadly similar to EU GDPR, but the UK's post-Brexit path has produced some differences — including the new PECR exemptions and fine ceiling introduced by the Data Use and Access Act 2025. This article maps the current UK requirements precisely. Not legal advice; consult qualified counsel for specific situations.

PECR and UK GDPR: two laws, one regulator

Understanding the distinction between PECR and UK GDPR matters because they create overlapping but distinct compliance obligations:

PECR Regulation 6 creates the cookie consent obligation itself. It derives from the EU's ePrivacy Directive 2002/58/EC (transposed into UK law before Brexit) and requires that you must not store or access information in the terminal equipment of a user unless you have provided clear and comprehensive information about the purpose and the user has given consent. The "strictly necessary" exemption is narrow — it covers only what is genuinely required to deliver the service the user explicitly requested.

UK GDPR applies when cookies collect or process personal data — which analytics and advertising cookies always do, since they transmit IP addresses, device identifiers, and browsing behaviour. UK GDPR defines the quality and validity of consent: freely given, specific, informed, unambiguous, and documented. In practice, every analytics or advertising cookie deployment has two compliance layers: PECR requires consent before placement, and UK GDPR governs the quality of that consent and the evidence required to demonstrate it.

Both laws are enforced by the ICO, but under different penalty regimes — which the Data Use and Access Act has now substantially aligned.

What the Data Use and Access Act changed

The Data (Use and Access) Act 2025 received Royal Assent on June 19, 2025. Several key provisions relevant to cookie compliance came into force on February 5, 2026. Understanding what changed is essential for any UK website compliance review conducted in 2026.

The three new cookie exemptions — and what they don't cover

The three new PECR exemptions that came into force in February 2026 are frequently misunderstood. Understanding their precise scope — and their limitations — is critical before relying on them to remove consent requirements from your site.

ICO's April 2026 guidance: what's new

The ICO's finalised guidance on storage and access technologies, published April 29, 2026, introduced several important clarifications and expansions:

Technology-neutral language. The guidance explicitly drops "cookies" as the primary frame and addresses "storage and access technologies" — a broader category covering cookies, tracking pixels, device fingerprinting, web storage (HTML5 local storage, IndexedDB), scripts, tags, and link decoration. All of these fall within PECR Regulation 6's scope.

Multiple purposes must be separated. If a technology serves both an exempt purpose and a non-exempt purpose, you cannot collapse them into a single deployment and call it exempt. Either separate the technologies — deploying one for the exempt purpose and obtaining consent for the non-exempt one — or obtain consent for everything. This directly affects analytics tools that dual-purpose as advertising measurement.

"Simple means of objecting" clarified. For the two exemptions that require a means of objecting (statistical and website appearance), the ICO clarified what "simple and free means of objecting" means: it must be accessible, not buried in a privacy policy, presented in plain language, and not require users to navigate complex settings menus. A preference centre linked from every page footer meets this standard.

Pre-enabling is explicitly forbidden. The guidance explicitly forbids "pre-enabling" non-exempt tracking technologies or relying on silence and inactivity as agreement. This re-confirms what has always been required under PECR but makes the ICO's enforcement position explicit.

Pixels, fingerprinting, scripts: the expanded scope

One of the most practically significant elements of the April 2026 ICO guidance is the explicit confirmation that PECR Regulation 6 applies to technologies beyond HTTP cookies. The ICO has aligned with the EU EDPB's position (from EDPB Guidelines 2/2023) that any technology that stores or accesses information on a user's terminal device requires consent if non-essential:

• Tracking pixels in web pages — any 1x1 pixel or transparent image that triggers a request to a third-party server on page load. When a visitor's browser fetches the pixel, it transmits the IP address, user agent, referral URL, and any identifiers in the request. This constitutes "access to" the terminal device's outgoing communications, requiring prior consent if the pixel is non-essential.
• Device fingerprinting — collecting combinations of browser and device characteristics to identify individual users without cookies. Explicitly within scope — if your analytics or advertising tools use fingerprinting to identify returning visitors, consent is required regardless of whether any cookie is set.
• Scripts and tags — JavaScript tags loaded from third-party servers (Google Tag Manager tags, Meta Pixel base code, LinkedIn Insight Tag) that access and transmit information about the user's session. All require consent before loading if they serve non-essential purposes.
• Link decoration — URL parameters appended to links that track individual users across sessions or sites. Where these identifiers are used to track individual user journeys (as opposed to aggregate campaign tracking), they may fall within scope.

What still needs consent

What valid consent looks like under UK law

UK GDPR Article 4(11) defines consent identically to EU GDPR: freely given, specific, informed, and unambiguous. The specific requirements the ICO enforces:

• Accept and Reject must have equal visual prominence on the first layer. The ICO's finalised guidance is explicit: a prominent Accept button with a small "Manage preferences" link is non-compliant. Both options must be immediately visible and equally easy to use.
• No pre-ticked boxes. Planet49 (CJEU 2019) established this as non-compliant throughout the UK's EU membership, and the UK carried this standard forward post-Brexit. Pre-ticked optional cookie categories remain non-compliant.
• No implied consent. "By continuing to use this site, you agree to cookies" is not valid consent. The visitor must actively click something.
• Consent must precede placement. The cookie — or tracking pixel, or script — must not fire while the banner is loading or before the visitor has made a choice. Prior consent is required.
• Consent records with timestamps. If the ICO investigates, you need to be able to demonstrate that a specific user consented on a specific date, what banner version they saw, and what they chose. Storing a cookie called "consent=accepted" with a date is not sufficient — you need a timestamped log with the banner version, choices offered, and the user's selection.

ICO enforcement: what it actually looks like

The ICO's actual enforcement record on cookies has been dominated by public reprimands and compliance letters rather than large fines — but the DUAA's fine increase changes the risk calculus significantly.

In November 2023, the ICO wrote to 53 of the top 100 UK websites warning them their banners did not comply. In January 2025, it extended this campaign to the top 1,000 UK websites. The ICO's enforcement strategy has been coordinated and public — making the reprimand itself a reputational risk alongside the legal one.

The practical steps the ICO uses to assess compliance: visiting the website with a fresh browser session and watching the network tab. If third-party requests to Google Analytics, Meta, or similar domains appear before any consent interaction — the site fails. This is the identical test plaintiff firms run to generate CIPA demand letters in the US. In the UK, it generates an ICO letter. The test is the same; the consequence is different.

UK website compliance checklist

Frequently asked questions