← ALL REGULATIONS
UK cookie law: the PECR consent rules, and what changed in 2025.
In the UK, PECR requires consent before a site stores or reads non-essential cookies, and UK GDPR sets the standard that consent must meet. The Data (Use and Access) Act 2025 adds exemptions for some low-risk cookies and raises the fines, and its changes come into force in stages.
PECR at a glanceOpt-in before tracking
- Applies to
- Sites that set cookies on the devices of people in the UK
- Cookie rule
- PECR, regulation 6
- Enforced by
- Information Commissioner’s Office (ICO)
- Recent change
- Data (Use and Access) Act 2025, commenced in stages
- Penalties
- UK GDPR fines up to £17.5 million or 4% of worldwide turnover. The 2025 Act brings PECR fines up to the same level.
WHAT PECR REQUIRES
What the ICO expects from a UK cookie banner.
THE RULEConsent before non-essential cookiesRegulation 6 allows cookies without consent only when they are strictly necessary for a service the user asked for. Everything else needs a clear, affirmative opt-in.
WITH KATLAIn GDPR mode, the cookie guard refuses every cookie outside the functional category until the visitor chooses, and deletes any that were set before it ran.
THE RULEThe new low-risk exemptions come with conditionsThe 2025 Act lets some cookies run without consent, such as those that only collect statistics to improve your own site or remember a visitor’s settings, provided you explain them and give a simple way to object.
WITH KATLAKatla keeps analytics in its own category, and analytics waits for consent. There is no objection-only mode for exempt analytics yet, so Katla applies the stricter rule.
THE RULERejecting must be as easy as acceptingThe ICO has told the operators of popular UK websites that a banner without an equally easy way to reject does not collect valid consent.
WITH KATLAAccept, Reject and Customise sit together on the first layer of the banner, and nothing is pre-selected.
THE RULEExplain every cookieUsers must be told what each cookie does and who sets it before they choose.
WITH KATLAKatla scans the site, classifies every cookie it finds and generates the cookie policy from that list, in 13 languages. British English is one of them.
PECR questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- What changed with the Data (Use and Access) Act 2025?
- It amends PECR to exempt some low-risk cookies from consent, such as analytics that only improve your own site, and brings PECR fines up to UK GDPR levels. Its provisions come into force in stages, so check the ICO’s guidance for the date that applies to you.
- Do I need consent for Google Analytics in the UK?
- Until the new exemption applies to your use, yes: analytics cookies are not strictly necessary. Even under the exemption, you must explain the cookies and offer a simple way to object.
- Is UK cookie law the same as the EU’s?
- The core rule is the same, consent for non-essential cookies, because PECR implements the same ePrivacy Directive. The UK has since diverged with the 2025 Act, so a site serving both should follow the EU rule for EU visitors.
- Who enforces cookie rules in the UK?
- The Information Commissioner’s Office. It publishes the cookie guidance and has written to the operators of popular UK websites about banners that did not meet it.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.