When do you need consent for cookies?

What it is

The rule in PECR reg 6 applies to any technology that stores or reads information on a terminal device, whether or not it involves personal data. Consent must meet the UK GDPR standard: no pre-ticked boxes or implied consent from browsing. The new exceptions need clear information and a simple, free way to object.

When you need consent

• Advertising, ad measurement and cross-site tracking cookies and pixels. PECR reg 6
• Analytics that track individuals or are shared beyond a processor acting for you. PECR reg 6; Sch A1
• Social media plugins that track non-logged-in users. PECR reg 6

When you do not

• Strictly necessary for a service the user requested, such as a shopping basket or login. PECR Sch A1
• Solely to transmit a communication. PECR Sch A1
• Aggregate statistics to improve your own service, with information and an opt-out. PECR Sch A1, inserted by DUAA s.112
• Adapting appearance or function to the user's preferences, with information and an opt-out. PECR Sch A1
• Locating a device for emergency assistance after a call for help. PECR Sch A1

Who is responsible

The operator of the website or app, and any third party setting cookies through it.

What it involves

1. Audit every cookie and tracker.
2. Classify each against the exceptions.
3. Ask consent for the rest before they fire.
4. Provide information and a simple objection route for exempt analytics.
5. Re-audit after site changes.

If it goes wrong

Regulatory

The regulator can issue an enforcement notice and, since 2026-02-05, a penalty of up to £17.5 million or 4% of annual worldwide turnover (PECR as amended by DUAA s.115). Directors and officers can be fined personally where a marketing breach resulted from their conduct.

Criminal

No offence.

Civil

Anyone who suffers damage because of a breach of PECR can claim compensation from the person responsible (PECR reg 30).