LocationsUnited Kingdom
UK cookie consent, after the 2025 Act
The Data (Use and Access) Act 2025 is in force. It received Royal Assent on 19 June 2025. The cookie rules changed on 5 February 2026. Advertising still needs a yes. Low-risk statistics can use an opt-out. EU GDPR did not make the same change.
What you can set, and when
PECR is the cookie rule. UK GDPR is the data-protection rule. An opt-in banner is still a valid, stricter choice for every category.
Still needs prior consent
Advertising cookies, cross-site tracking, and profiling. A tool that shares identifiers with an ad network is in this group, even if you also use it for statistics.
Can run with a simple, free opt-out
From 5 February 2026: cookies used only to collect statistics about that site, so you can improve it, and cookies that only adapt how the site looks or works. The ICO finalised this guidance on 29 April 2026.
No consent required
Cookies that are strictly necessary for the site to work, and storage used only to carry a communication. Say what they do in the cookie policy.
United Kingdom and the EU
A UK exception does not cover a visitor in the EU. The adequacy decision is a transfer rule. It does not copy UK cookie exceptions into EU law.
| Cookie use | UK PECR | EU GDPR |
|---|---|---|
| Strictly necessary | Exempt. Disclose it. | Exempt. Disclose it. |
| Site statistics only | Opt-out, since 5 February 2026 | Opt-in before it loads |
| Appearance only | Opt-out, simple and free | Usually opt-in |
| Advertising or cross-site tracking | Prior consent | Prior consent |
What the ICO can fine
PECR fines, including fines for cookies, have matched UK GDPR since 5 February 2026: up to £17.5 million or 4% of global annual turnover. The old PECR cap was £500,000. UK GDPR still has a second tier of up to £8.7 million or 2%, depending on the infringement.
The British Airways penalty (£20 million) and the Marriott penalty (£18.4 million) were security cases, not cookie-banner cases. Large Google consent penalties came from EU authorities, including the CNIL.
Set it up
- Keep strictly necessary cookies exempt, and describe them.
- Get prior consent before advertising, cross-site tracking, or any analytics tool that shares identifiers with a third party.
- If you use the statistics or appearance exception, give people a simple, free way to object and keep the use inside that purpose.
- Let people change a choice later. Pre-ticked boxes are not consent.
- From 19 June 2026, handle a person’s data-protection complaint yourself before they take it to the ICO. Keep a record of how the choice was offered.
One banner, with the UK rule set apart from the EU rule.
Block advertising until someone agrees. Keep a record of the choice. Use opt-in for EU visitors even when a UK statistics cookie is allowed to wait for an objection.