PECR and UK GDPR: which law governs what, and why businesses confuse them

Introduction

Summary for the time-poor: UK GDPR governs the processing of personal data. PECR adds specific rules for privacy and electronic communications, including storing information on or accessing information from a user's device, as well as certain forms of direct marketing. They sit alongside each other. Where a specific PECR rule applies, the ICO says you should consider PECR compliance first. Since 5 February 2026, breaches of regulation 6 and the principal PECR marketing rules can attract the higher maximum penalty of £17.5 million or, for an undertaking, 4% of total annual worldwide turnover, whichever is higher.

The mistake that causes the confusion

Ask a business which law governs its cookie banner and the answer will often be GDPR. That is incomplete.

The requirement to obtain consent before using non-exempt cookies and similar technologies comes from regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, usually called PECR. UK GDPR still matters where personal data is involved, but regulation 6 is the specific rule governing the act of storing information on, or accessing information stored on, someone's terminal equipment.

The ICO puts the relationship plainly: where PECR's specific rules apply, they take precedence over the more general UK GDPR rules. For storage and access technologies, organisations should therefore consider PECR first and then UK GDPR where personal data is processed.

A privacy policy on its own does not satisfy regulation 6 where consent is required. The consent route requires both clear and comprehensive information about the purpose of the storage or access and the user's consent before non-exempt storage or access takes place. That distinction matters because transparency and permission are not the same thing.

An analogy that holds

Think of a visitor's device as their home. PECR is the rule about crossing the threshold, and UK GDPR is the rule about what you do with whatever you take back. PECR governs whether you may store information on the device or access information already stored there. Regulation 6 is concerned with "information", not only personal data, and the ICO warns specifically against assuming the storage and access rules apply only to personal information. Cookies, pixels and similar technologies can fall within regulation 6 whether or not the information they use identifies anyone.

UK GDPR also applies once personal data is involved, governing lawful basis, transparency, retention, security and individual rights. Two consequences follow, and both catch businesses out. You can breach PECR without processing any personal data, which is why "it's anonymous" is not an answer to regulation 6. And you can satisfy regulation 6 at the threshold while still handling the personal data wrongly once it is inside. The regimes overlap, but they do different jobs.

Where the two connect

PECR uses the UK GDPR standard of consent. Regulation 2 provides that consent by a subscriber or user corresponds to the data subject's consent under UK GDPR. That means consent must be freely given, specific, informed and unambiguous, and signified through a statement or clear affirmative action. This is where many consent mechanisms fail in practice.

The ICO says organisations must allow users to refuse non-exempt storage and access technologies as easily as they can accept them. It also says non-exempt technologies must not be used before consent has been given. Pre-ticked boxes, continued browsing and inactivity do not constitute valid consent.

So a banner with a prominent "Accept all" button but no equally accessible way to reject non-exempt technologies is difficult to reconcile with the ICO's current expectations. And if a non-exempt tag has already stored or accessed information before the user makes a choice, consent obtained afterwards does not retrospectively fix that earlier use. PECR sets the requirement. UK GDPR supplies the consent standard that the requirement must meet.

Where regulation 6 requires consent and the storage or access involves personal data, the ICO says you should use consent as the UK GDPR lawful basis for the subsequent processing covered by that consent. You must not retrospectively switch to legitimate interests because the consent you obtained turns out to be invalid.

Consent also has to work in practice. It must be specific and granular by purpose; it cannot simply be bundled into terms and conditions, and organisations must not rely solely on browser settings as a substitute for valid consent. The consent mechanism must also allow users to withdraw consent with the same ease that they gave it. If a user withdraws consent, the organisation must stop the relevant storage and access technologies, stop the consent-based personal-data processing and inform relevant third parties. The ICO also says withdrawal must be interpreted as a request for erasure of information gathered under that consent.

Where consent involves third parties, you must tell users about those third parties and give them access to specific information about each one. Where information is shared, the consent mechanism must identify the relevant third parties. The ICO's current consent-mechanism checklist also expects users to be able to control information shared with individual third parties.

Where they differ

The penalty distinction matters. It is misleading to say that every PECR infringement automatically carries a £17.5 million or 4% maximum.

Schedule 13 applies the Data Protection Act 2018 enforcement regime to PECR with modifications. The higher maximum applies to specified PECR infringements, including regulations 5, 6, 7, 8, 14 and 19 to 24. Section 116 also puts failures by ICO-accredited code-monitoring bodies to comply with the duties in regulations 32B(4) and 32B(5) within the higher tier. Those duties apply to accredited bodies responsible for monitoring approved PECR codes, not to ordinary website operators simply because they are subject to PECR. Other infringements dealt with through the general penalty-notice regime attract the standard maximum. Regulation 5A is different: breach-notification failures by relevant communications service providers have a separate fixed monetary penalty regime under regulation 5C.

Section 157 of the Data Protection Act 2018 sets the two general maximums. The standard maximum is £8.7 million or, for an undertaking, 2% of total worldwide annual turnover, whichever is higher. The higher maximum is £17.5 million or 4%, whichever is higher. The percentage becomes the larger figure once turnover exceeds £435 million for the standard tier and £437.5 million for the higher tier.

"Undertaking" does not simply mean the company named on the website. It is a competition-law concept based on economic activity and can comprise more than one legal entity forming a single economic unit. Where a controller or processor belongs to a wider undertaking, the ICO says the maximum may be calculated using the turnover of the undertaking as a whole.

For a typical website owner or operator, the important point is that regulation 6 sits in the higher tier, as do the direct-marketing rules in regulations 19 to 24.

What changed on 5 February 2026

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. The Commencement No. 6 Regulations brought the majority of the remaining data protection and privacy provisions in Part 5 into force on 5 February 2026, including the major changes to PECR discussed here. The changes that matter most to businesses are covered below, with the direct-marketing changes dealt with separately later in this article.

1. The higher PECR penalty ceiling rose from £500,000 to £17.5 million or 4%

The ICO's civil monetary penalty power under PECR did not exist when the Regulations were originally made in 2003. The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 came into force on 26 May 2011 and extended a civil monetary penalty regime with a maximum of £500,000 to PECR.

From 5 February 2026, specified PECR infringements, including regulation 6 and the main direct-marketing provisions, became subject to the higher maximum of: £17.5 million or, in the case of an undertaking, 4% of total annual worldwide turnover, whichever is higher.

The words "whichever is higher" are important. Four per cent of turnover does not exceed £17.5 million until worldwide annual turnover exceeds £437.5 million. The ICO's fining guidance confirms the same calculation for the higher maximum: below £437.5 million of turnover, £17.5 million is the higher statutory figure. For example, 4% of £2 million is £80,000. But £80,000 is not the higher statutory maximum. £17.5 million is. That does not mean a £2 million-turnover business should expect a £17.5 million penalty. A statutory maximum is a ceiling, not a tariff. It does mean that describing PECR exposure simply as "4% of turnover" is inaccurate.

2. There are three genuinely new no-consent exceptions to regulation 6

The DUAA rewrote regulation 6 and inserted Schedule A1 into PECR. The ICO now identifies five circumstances in which storage or access may take place without consent.

Two substantially continue existing exceptions:

• Transmission of communications. Storage or access for the sole purpose of transmitting a communication over an electronic communications network.
• Strictly necessary. Storage or access that is essential to provide an information society service requested by the subscriber or user. The legislation now provides illustrative examples including authentication, security, fraud prevention and fault detection.

Three no-consent exceptions are new:

• Statistical purposes. Storage or access for the sole purpose of collecting statistical information about use of the service or website with a view to improving it.
• Appearance and functionality. Storage or access for qualifying purposes connected with adapting or enhancing how the service appears or functions.
• Emergency assistance. Storage or access for the sole purpose of determining the geographical position of a subscriber or user so emergency assistance can be provided.

Schedule A1 paragraph 2 is better described as the consent route, rather than another no-consent exception. It permits storage or access where clear and comprehensive information is provided and valid consent is obtained.

So the useful distinction is: there are five no-consent exceptions in total, of which three were newly introduced by the DUAA.

For a closer look at each exception, including when analytics may operate without consent and what still requires permission, see UK Cookie Consent Rules in 2026: The Five PECR Exceptions and What Still Needs Consent.

The statistical and appearance exceptions are also conditional. Among other requirements, users must be provided with clear and comprehensive information and a simple, free means of objecting. The list is not necessarily permanent. New regulation 6A allows the Secretary of State to add, remove or vary Schedule A1 exceptions by regulations, after consulting the ICO and other appropriate persons; those regulations are subject to the affirmative parliamentary procedure.

3. "Analytics is exempt now" is much too broad

The statistical-purposes exception is useful, but it is narrower than that phrase suggests. The storage or access must be for the sole purpose of collecting statistical information about use of the service or website with a view to improving it.

The ICO says that where the information is personal data, you must aggregate it and must not retain personal data for longer than is necessary for that aggregation process. If you use the information to make inferences or decisions about individuals, or retain individual-level information after aggregation, the exception does not apply. Using a third-party analytics provider does not automatically prevent you from relying on the exception. But the conditions are stricter than simply asking whether the provider is a third party.

To rely on the statistical-purposes exception, the provider must act on your behalf and use the information only to help improve your service or website. Where UK GDPR applies, the ICO says the provider must be your processor, not a joint controller. You must also tell users that you use the third-party provider and explain what it does with the information it collects.

The provider must not link the information with other information it processes for unrelated purposes. If the analytics service is also being used for advertising, conversion attribution, profiling or another non-exempt purpose, consent is required for that storage or access. The "sole purpose" requirement also matters where one technology performs several jobs. You cannot rely on the statistical exception for one purpose while the same storage or access is simultaneously being used for a non-exempt purpose such as online advertising.

There is another important limit: the statistical-purposes exception does not cover collecting or monitoring information automatically emitted by terminal equipment, such as Wi-Fi probe requests.

The practical rule is therefore: do not assume analytics is exempt, and do not assume third-party analytics automatically requires consent. Test the actual deployment, the provider's legal role, its uses of the information and every condition of Schedule A1 paragraph 5.

4. PECR now expressly covers instigating the storage or access

The rewritten regulation 6 expressly provides that references to a person storing information or gaining access to information include a person instigating that storage or access. The explanatory notes describe this as a clarification. That distinction matters. It would be misleading to suggest that websites were previously free of responsibility whenever a third-party vendor technically set the cookie or ran the tag. ICO guidance has long treated organisations as responsible for technologies they incorporate from third parties. The DUAA now makes the point explicit in the legislation itself. If a third-party advertising, analytics or social-media tag stores or accesses information because you deployed or triggered it, the fact that somebody else's code performed the technical operation does not, by itself, take you outside regulation 6.

The scope is wider than cookies

On 29 April 2026, the ICO finalised its guidance on the use of storage and access technologies, following the DUAA changes. The terminology is deliberate.

The guidance covers technologies including:

• cookies;
• tracking pixels;
• device fingerprinting;
• web storage;
• scripts and tags; and
• link decoration and navigational tracking.

The legal question is therefore not simply whether a website "uses cookies". It is whether a technology stores information on, or accesses information stored on, the subscriber's or user's terminal equipment. "Terminal equipment" is also much wider than a desktop browser. The DUAA explanatory notes give computers, mobile phones, wearable technology, smart TVs and connected devices, including Internet of Things devices, as examples. Regulation 6 also now expressly treats collecting or monitoring information automatically emitted by terminal equipment as gaining access to information. The explanatory notes give Wi-Fi probe requests as an example of this "emissions data".

Removing conventional cookies while leaving another form of non-exempt storage or access in place does not necessarily solve the PECR issue. The ICO's current guidance is also explicit that using storage and access technologies for online advertising requires consent, including the technical processes involved in ad selection and delivery and associated tracking or profiling.

As at 3 September 2026, that remains the current position. In May 2026 the ICO advised government on possible future exceptions to regulation 6 for some lower-risk forms of online advertising. However, the ICO made clear that the existing rules remained in force. Any new exception would need to be introduced through the regulation-making power in regulation 6A; the current ICO guidance continues to require consent where storage and access technologies are used for online advertising.

The marketing side: what businesses need to know

Before the soft opt-ins: the scope changed too

The DUAA also amended the basic PECR definitions used by the marketing rules. A "call" now expressly includes an attempted call whether or not it connects. A "communication" includes something that is transmitted rather than only something successfully exchanged or conveyed, and where a call or communication is generated but not received, "recipient" means the intended recipient. Section 110 also moves the existing definition of "direct marketing" into regulation 2 for ease of reference. This is a technical relocation rather than a new substantive definition. The practical consequence is that a PECR marketing infringement does not necessarily depend on the call connecting or the message reaching somebody.

Electronic-mail marketing then divides into solicited and unsolicited messages. If somebody specifically asks you to send them a particular marketing message, that message is solicited and PECR does not require consent or a soft opt-in for it. Unsolicited electronic-mail marketing to an individual subscriber requires consent or a valid soft opt-in. Unsolicited marketing to a corporate subscriber does not require consent or a soft opt-in.

Regulation 23 still applies regardless: you must not disguise or conceal your identity, and you must provide a valid contact address that the recipient can use to opt out or unsubscribe.

PECR also applies to anyone who instigates electronic-mail marketing, not only the person who physically sends it. If you ask another organisation to send your marketing, both organisations may have PECR responsibilities. The same issue arises with "refer a friend" schemes where a business encourages customers to send its marketing to other people.

For a more detailed treatment of the direct-marketing changes, including failed messages, B2B marketing, the soft opt-ins and the post-DUAA penalty regime, see PECR Marketing Rules After the DUAA: What Changed for UK Email and SMS Senders.

The products and services soft opt-in

Regulation 22 contains an important exception for electronic mail marketing to individual subscribers. The products and services soft opt-in may allow an organisation to send marketing without specific consent where all of the relevant conditions are met.

The ICO summarises them as follows:

• you obtained the person's contact details directly;
• you obtained them while selling or negotiating to sell a product or service;
• you market only your own similar products and services;
• you provided an opportunity to refuse the marketing when you collected the details;
• you provide an opt-out in every subsequent communication.

"Negotiations for a sale" has a real meaning. The ICO says the person must actively express an interest in buying. Examples can include asking for a quote, requesting more details about a product or service, or signing up for a free trial. Simply browsing a website is not enough. That is safer than assuming every lead-magnet download or general enquiry automatically qualifies. Bought-in details do not qualify for the soft opt-in because the organisation relying on it must have obtained the contact details directly from the person.

Subscriber type still matters. Individual subscribers include people, sole traders and ordinary partnerships. Corporate subscribers include organisations with their own legal personality, such as limited companies, LLPs and Scottish partnerships. Where contact details amount to personal data, UK GDPR applies as well.

The charitable purposes soft opt-in

The DUAA added a separate charitable-purposes soft opt-in in regulation 22(3A). It came into force on 5 February 2026.

The ICO says it may only be used for contact details obtained on or after that date and only where the charity itself obtained the details directly from the person in circumstances satisfying the statutory requirements. The marketing must be solely for furthering the charity's charitable purposes, the person's details must have been obtained through their expression of interest in or support for those purposes, and a suitable opt-out must be offered both when the details are collected and in every subsequent communication.

Charities, political parties and other not-for-profit organisations cannot use the products-and-services soft opt-in for campaigning or fundraising, even when communicating with existing supporters. A charity may instead use the charitable-purposes soft opt-in where all of its conditions are satisfied; otherwise it needs consent for unsolicited electronic-mail marketing to individual subscribers.

Regulation 22(5) defines "charity" and "charitable purpose" for this exception by reference to the relevant charity legislation in each UK jurisdiction.

Director and officer liability

PECR also contains personal exposure for company officers in relation to the direct-marketing provisions. The relevant rules first came into force in December 2018. Under the current regime, where a penalty notice is given to a body for failure to comply with regulations 19 to 24, the Commissioner may also give a penalty notice to an officer if the failure took place with that officer's consent or connivance, or was attributable to their neglect. "Officer" can include a director, manager, secretary or similar officer. The important word is also. Personal officer liability should therefore not be described as the ICO fining a director "instead of" the company under this provision. The statutory mechanism allows an officer penalty in addition to the penalty notice given to the body. That route is limited to failures involving regulations 19 to 24. It does not extend to regulation 6. A non-compliant cookie banner therefore does not create personal exposure for a director through this particular officer-liability provision.

Direct-marketing breaches can create that personal exposure where the statutory test is met: the breach must have occurred with the officer's consent or connivance, or be attributable to their neglect.

Why website PECR risk is unusually visible

There is another practical difference worth understanding. A large part of a website's regulation 6 behaviour is externally observable. A visitor can inspect network requests, cookies, local storage and other browser behaviour and compare what happens before and after consent.

The ICO has demonstrated this through proactive testing. In December 2025 it said it had assessed the UK's top 1,000 websites against three criteria concerning non-essential advertising cookies: whether they were placed before consent, whether rejecting was as easy as accepting, and whether advertising cookies were placed after a user had refused them. At that point, 979 of the 1,000 sites (97.9%) met the ICO's checks at their most recent test. Of those, 564 had improved following direct ICO engagement, and the ICO said it had issued 17 preliminary enforcement notices where engagement had not produced the required changes.

By 29 April 2026, the ICO said 99% of the UK's top 1,000 websites met its cookie-banner compliance standards. The figures therefore describe two different points in the ICO's programme: 97.9% in December 2025, rising to the regulator's stated 99% by April 2026. That makes a website materially different from many internal compliance processes. A regulator does not necessarily need a data breach, subject access request or whistleblower to see that a public website is deploying non-exempt tracking before consent. The behaviour can be visible from outside the organisation.

What to do

1. Audit what the browser and device actually do. Do not rely only on what your policy or consent-management platform says should happen.
2. Identify every storage and access technology and every purpose. Include cookies, pixels, web storage, fingerprinting, scripts, tags and other mechanisms, including relevant information emitted by terminal equipment.
3. Test each purpose against Schedule A1 separately. An exception is purpose-specific. If the same storage or access is also used for a non-exempt purpose, consent is required.
4. Check analytics providers properly. If you rely on the statistical-purposes exception, determine whether the provider is acting only on your behalf, whether it is a processor rather than a joint controller, whether it combines the information with other datasets and whether users are properly told about the provider.
5. Test consent technically as well as visually. Non-exempt technologies must not operate before consent. Refusing must be as easy as accepting, choices must be granular by purpose, and consent must not simply be bundled into terms and conditions or delegated to browser settings.
6. Check what happens after consent. Where PECR consent covers subsequent personal-data processing, do not retrospectively switch to legitimate interests if the consent is invalid. Make sure withdrawal stops the technologies and associated processing and triggers the necessary erasure and third-party steps.
7. Re-test direct marketing against the current regulation 22 and 23 rules. Distinguish solicited from unsolicited messages, identify the subscriber type, check every soft-opt-in condition, make your identity clear, provide a valid opt-out address and consider whether you are instigating marketing sent by somebody else.
8. Update the PECR figures on your risk register. The standard maximum is £8.7 million or 2% for an undertaking, whichever is higher, and the higher maximum is £17.5 million or 4%, whichever is higher. Regulation 6 and the main direct-marketing rules fall within the higher tier.

The practical point

PECR compliance cannot be established from a policy or a banner screenshot alone. The important questions are technical: what the browser or device actually stores or accesses, when it happens, why it happens and whether the user's choice is respected in practice.

Stalytics' Website Compliance Risk Audits test that observable behaviour across public-facing pages and record what the site actually does. If you need an independent, evidence-led view of your website's cookie, tracker, storage, consent and transparency risks, you can view our Website Compliance Risk Audit packages or contact us to discuss the appropriate scope.

You can also browse the latest Stalytics website compliance insights for further guidance on PECR, cookie consent, UK GDPR and website governance.

Sources

1. PEC Regulations factsheet GOV.UK - Data (Use and Access) Act factsheet: PEC Regulations
2. Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) Privacy and Electronic Communications Regulations 2003 - legislation.gov.uk
3. Data Protection Act 2018, section 157 - maximum amount of penalty Data Protection Act 2018 - section 157
4. Data (Use and Access) Act 2025 Data (Use and Access) Act 2025 - legislation.gov.uk
5. DUAA section 112 - storing information in terminal equipment Section 112 - legislation.gov.uk
6. DUAA Schedule 12 - Schedule A1 to PECR Schedule 12 - legislation.gov.uk
7. DUAA Schedule 13 - PECR enforcement powers and penalty levels Schedule 13 - legislation.gov.uk
8. DUAA section 110 - Interpretation of the PEC Regulations DUAA section 110 - Interpretation of the PEC Regulations
9. DUAA section 116 - Codes of conduct DUAA section 116 - Codes of conduct
10. Data (Use and Access) Act 2025 - Explanatory Notes, Chapter 2: Privacy and electronic communications DUAA 2025 Explanatory Notes - Chapter 2: Privacy and electronic communications
11. Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 Commencement No. 6 Regulations - legislation.gov.uk
12. GOV.UK - DUAA plans for commencement Data Use and Access Act 2025: plans for commencement
13. ICO - What are storage and access technologies? ICO - What are storage and access technologies?
14. ICO - How do the rules apply to online advertising? ICO - How do the rules apply to online advertising?
15. ICO - Key concepts for direct marketing using electronic mail ICO - Key concepts for direct marketing using electronic mail
16. ICO - The concept of an undertaking for the purpose of imposing fines ICO - The concept of an undertaking for the purpose of imposing fines
17. ICO - Statement on the commencement of the Data (Use and Access) Act, 5 February 2026 ICO - Statement on the commencement of the Data (Use and Access) Act
18. ICO - Final storage and access technologies guidance published, 29 April 2026 ICO - Final storage and access technologies guidance published
19. ICO - Guidance on the use of storage and access technologies ICO storage and access technologies guidance
20. ICO - How PECR relates to UK GDPR ICO: How do the PECR rules relate to the UK GDPR?
21. ICO - Storage and access exceptions ICO: What are the exceptions?
22. ICO - Managing consent in practice ICO: How do we manage consent in practice?
23. ICO - Guidance on direct marketing using electronic mail ICO electronic mail marketing guidance
24. ICO - Products and services and charitable purposes soft opt-ins ICO: How do we comply with the PECR electronic mail marketing rules?
25. Privacy and Electronic Communications (Amendment) Regulations 2018 - historic introduction of officer liability 2018 Amendment Regulations - legislation.gov.uk
26. Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 - historic penalty regime 2011 Amendment Regulations - legislation.gov.uk
27. ICO - statutory maximum fine calculations ICO: The maximum amount of a fine under UK GDPR and DPA 2018
28. ICO - proactive cookie compliance work ICO: cookie compliance action across the UK's top 1,000 websites
29. ICO - Our advice to government on potential changes to online advertising rules, 18 May 2026 ICO - Our advice to government on potential changes to online advertising rules

This article explains the law in general terms and is not legal advice for any specific organisation.