GB United Kingdom
Cookie consent rules in United Kingdom
What PECR reg. 6 and the ICO expect from your cookie banner: when you need consent, how the reject option should look, and what has been enforced.
Sources checked 28 October 2026. Not legal advice.
Cookie law
Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), regulation 6 — as amended by the Data (Use and Access) Act 2025
Official guidance
Banner languages
English, Welsh
Maximum fine
Up to £17.5 million or 4% of annual worldwide turnover, whichever is higher, under PECR since the DUAA 2025.
What the rules say
- Consent and clear information are required unless a specific exception applies.
- The DUAA 2025 added conditional exceptions for service statistics, remembering appearance preferences and emergency assistance.
- The statistics and appearance exceptions require a simple, free way to object.
- Communication-only and strictly necessary storage remain exempt.
- Withdrawing consent must be as easy as giving it; there's no fixed consent expiry.
Analytics exemption
Since the Data (Use and Access) Act 2025, collecting statistics about how your own service is used can be exempt — if visitors get clear information and a simple, free way to object. It is not an exemption for advertising or cross-site tracking.
How PrivacyPill handles this
- Nothing optional runs before a choice. Google tags start with Consent Mode v2 set to denied; other scripts marked with data-pp-category wait until their category is allowed.
- Equal first-layer buttons. "Accept all" and "Reject non-essential" sit side by side with the same weight, and a settings button lets visitors withdraw consent at any time.
- Consent per purpose. Analytics, marketing and functional cookies can be allowed separately in the preferences panel.
- Languages. The banner ships in English. Welsh isn't built in yet — rewrite the English texts in the customizer to show your own translation.
- Proof of consent. Every choice is logged pseudonymously with the banner version, exportable as CSV.
Frequently asked questions
Sources
- ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/
- ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/
- ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/04/final-storage-and-access-technologies-guidance-published/
This page summarises official sources checked on 28 October 2026. It isn't legal advice; regulators update guidance, so follow the links for the current text.