PECR

Overview

PECR (Privacy and Electronic Communications Regulations) is the UK's cookie-specific law. Regulation 6 governs cookies and similar technologies, requiring consent before storing or accessing information on a visitor's device unless an exception applies. The Data (Use and Access) Act 2025 (DUAA) raised the maximum penalties and, from 5 February 2026, added new exceptions for low-risk uses.

What This Means for Your Website

• Consent is required before storing or accessing non-essential cookies on UK visitors' devices, unless an exception applies
• Since 5 February 2026 the exceptions cover strictly necessary storage, statistics gathered only to improve your own site or service, and storage that adapts the site's appearance or functionality to a visitor's preferences, plus two narrow cases for transmitting a communication and locating a device in an emergency
• The statistics and appearance exceptions require clear information about the purpose and a simple, free way to object
• Advertising and tracking of individual visitors still need prior opt-in consent
• Pre-ticked or implied consent is invalid
• Cookie-or-pay models cannot force tracking consent
• Maximum penalties increased from GBP 500,000 to GBP 17.5 million or 4% of global turnover

Key Requirements

The ICO enforces PECR with penalties now aligned to UK GDPR levels since the DUAA 2025: up to GBP 17.5 million or 4% of global turnover. The ICO published its final guidance on storage and access technologies on 29 April 2026. It reads the statistics exception narrowly: the purpose must be only to measure and improve the service, information can go to a third party only to help improve it, and any personal data involved is still subject to the UK GDPR.

How ConsentStack Handles This

ConsentStack presents UK visitors with a PECR-compliant consent banner that blocks all non-essential cookies until explicit consent is given. The platform will adapt to the new analytics exceptions as ICO guidance is published.