# UK cookie consent: UK GDPR and PECR rules · Consentl

> How cookie consent works in the UK under PECR and the UK GDPR, what the ICO expects from a cookie banner, and what the Data (Use and Access) Act 2025 changes.

Source: https://consentl.com/laws/uk-gdpr

# UK GDPR and PECR cookie rules

How cookie consent works in the UK under PECR and the UK GDPR, what the ICO expects from a cookie banner, and what the Data (Use and Access) Act 2025 changes.

## The rules in the UK

After Brexit the UK kept its own versions of the EU rules. The **Privacy and Electronic Communications Regulations 2003** (PECR, regulation 6) require consent before storing or reading cookies and similar technologies on a device, unless they are strictly necessary. The **UK GDPR** and the Data Protection Act 2018 define valid consent and govern the personal data collected. The Information Commissioner's Office (**ICO**) enforces both.

## What the ICO expects from a banner

-   Consent before any non-essential cookie is set, including analytics.
-   A "Reject all" option as prominent as "Accept all" on the first layer. In 2023 and 2024 the ICO wrote to many of the UK's most visited websites about banners that made rejecting harder than accepting.
-   No pre-ticked boxes and no consent assumed from continued browsing.
-   Clear information on what each cookie does and who sets it.
-   A simple way to change the choice later.

## The Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 amends PECR. As its provisions come into force it adds exceptions for some low-risk cookies, such as cookies used only for statistics to improve a website, where the visitor is told and can object, and it raises the maximum PECR fine to the UK GDPR level (GBP 17.5 million or 4 % of worldwide turnover). Advertising and most third-party tracking still need consent. Follow the ICO's guidance for the details and dates.

## How Consentl helps

-   A ready-made **UK rule**: opt-in, with "Reject all" next to "Accept all" and a choice per category.
-   Trackers held back until consent, and **Google Consent Mode v2** for Google tags, which Google requires for UK visitors.
-   A "Cookie settings" link, a **consent log** with CSV export and a **cookie scanner** with a cookie declaration.
-   With the Business plan you can adjust the consent model per law as the new exceptions take effect.

## FAQ

### Is the UK rule the same as the EU rule?

Today they are very close: both are opt-in. The UK may diverge as the Data (Use and Access) Act 2025 takes effect, which is why Consentl keeps a separate UK rule.

### Do analytics cookies need consent in the UK?

Yes, under PECR as it stood before the 2025 Act. The Act allows some statistical cookies without consent if visitors are informed and can object, once that provision is in force.

[Start free](https://app.consentl.com/signup) [Pricing](https://consentl.com/pricing)

This page is general information, not legal advice. Laws and guidance change; check the current rules for your situation.

## Privacy laws

-   [GDPR and ePrivacy (EU)](https://consentl.com/laws/gdpr)
-   [CCPA, CPRA and US states](https://consentl.com/laws/ccpa)
-   [LGPD (Brazil)](https://consentl.com/laws/lgpd)
-   [PIPEDA and Quebec Law 25](https://consentl.com/laws/pipeda)

## Features

-   [Cookie banner](https://consentl.com/features/cookie-banner)
-   [Cookie scanner](https://consentl.com/features/cookie-scanner)
-   [Google Consent Mode v2](https://consentl.com/features/google-consent-mode)
-   [Script blocking](https://consentl.com/features/script-blocking)
-   [Consent log](https://consentl.com/features/consent-log)
-   [Privacy requests](https://consentl.com/features/privacy-requests)