UK cookie rules in 2026: PECR and the DUAA

Updated 25 September 2026 · 7 min read

This guide is general information about UK law as we understand it on 25 September 2026. It is not legal advice. The Data (Use and Access) Act's changes to PECR are brought into force by commencement regulations and supported by ICO guidance, so check the ICO's current guidance and speak to a data protection professional before relying on any exception.

What does PECR say about cookies?

The Privacy and Electronic Communications Regulations 2003 (PECR) are the UK rules on cookies, marketing calls, texts and emails. Regulation 6 says you must not store information on, or gain access to information stored on, a user's device unless the user is given clear and comprehensive information about the purpose and has consented.

The rule is not limited to cookies. It covers any storage and access technology, including tracking pixels, local storage and fingerprinting techniques.

There have long been two exceptions: storage or access needed only to carry a communication over a network, and storage or access that is strictly necessary to provide a service the user has explicitly requested.

What does valid consent look like?

PECR takes its standard of consent from UK GDPR. Consent must be freely given, specific, informed and an unambiguous, clear affirmative action. In practice that means:

• No non-essential cookies set before the visitor chooses.
• No pre-ticked boxes, and scrolling or continuing to browse does not count as consent.
• Rejecting should be as easy as accepting.
• Withdrawing consent must be as easy as giving it.
• You can show what each visitor was told and what they chose.

What did the Data (Use and Access) Act 2025 change?

The Data (Use and Access) Act 2025 received Royal Assent in June 2025. Among many other changes, it amends PECR to add further exceptions to the consent requirement for a limited set of low-risk purposes. They include:

• Statistical purposes: collecting information about how your own service is used, with a view to improving it.
• Appearance and functionality: remembering a visitor's choices about how your website looks or works for them.
• Security: for example, detecting and preventing fraud or technical faults.

These exceptions come with conditions. For the statistical and appearance exceptions in particular, visitors must be given clear and comprehensive information about the purpose and a simple, free way to object. The exemption is about the purpose of the storage or access, not about which product you use.

How narrow is the analytics exemption?

Narrow. It is designed for first-party measurement of how your own site or service is used so that you can improve it. It is not designed for:

• advertising, retargeting or building audiences;
• sending data to an ad platform or analytics provider that uses it for its own purposes;
• tracking people across other websites or services;
• profiling individuals or personalising marketing to them.

If your analytics tool is connected to ad platforms, feeds advertising audiences or lets its provider reuse the data, it is unlikely to fit. It also requires the data to stay aggregate, with no per-user identifiers or advertising features turned on — a tool with advertising features enabled does not qualify even if you have stopped looking at individual visitors. Most businesses that run paid campaigns will still need a consent banner for at least part of their tracking.

Does the exemption change what UK GDPR requires?

No. The PECR exceptions deal with storing and accessing information on the device. If the data you collect is personal data, UK GDPR still applies: you need a lawful basis, you must tell people what you do in your privacy notice, and you must keep the data secure and no longer than necessary. The exemption removes a consent requirement, not your other obligations.

What should a UK business do now?

1. List what your site stores and reads

   Audit every cookie, pixel and script, who sets it and what the data is used for.

2. Sort by purpose

   Group each item as strictly necessary, possibly exempt (such as first-party analytics used only to improve the site) or consent-required (advertising and ad-linked tracking).

3. Take advice on anything you want to treat as exempt

   Check it against the ICO's current guidance and the conditions attached, and document your reasoning.

4. Give people the information and the choice

   Explain exempt analytics clearly with a simple way to object, and ask for consent for everything else.

5. Keep a record

   Store what each visitor saw and chose, so you can show it if asked.

How does consent affect your analytics?

Whatever you decide, some visitors will not be tracked in full. Our guide to why analytics undercounts after cookie consent explains how to report around that gap, and server-side conversion tracking and UK GDPR covers sending conversions to ad platforms.