The EU Directive and UK PECR share the same legislative ancestry, but they are separate legal regimes. Check the destination jurisdiction before approving cookies, similar technologies, or direct marketing.
The comparison uses the EU Directive and EDPB guidance alongside the latest revised PECR text and ICO guidance on cookies and direct marketing.
For an EU user, start with the Member State law that transposes the ePrivacy Directive. For a UK user, apply the Privacy and Electronic Communications (EC Directive) Regulations 2003 () in their latest revised form. Both regulate storage or access on terminal equipment and electronic marketing, but UK amendments now include PECR-specific statutory exceptions and a charitable-purpose soft opt-in that do not appear in the Directive's text. Do not copy an EU conclusion into a UK file, or a UK exception into an EU launch.
Side-by-side comparison
EU ePrivacy Directive vs UK PECR
Compare the EU framework with current UK statutory rules, then record the jurisdiction-specific source and conclusion for each operation.
Based on the supplied EU ePrivacy sources for Article 5(3), direct marketing, consent, soft opt-in logic, and GDPR/ePrivacy interplay.
Second framework
UK PECR
UK statutory rules for terminal-equipment storage or access, electronic communications and marketing, read with UK data-protection law and ICO guidance.
Article 5(3) covers storing information or gaining access to information already stored in a subscriber's or user's terminal equipment; EDPB guidance frames the test around information, terminal equipment, storage, and access, and it is not limited to ordinary cookies.
regulation 6 and Schedule A1 govern storing information in, or gaining access to information stored in, a subscriber's or user's terminal equipment. The rule covers browser cookies and other technologies that perform the same storage or access operations.
Use one technical inventory, then make separate EU and UK decisions. The same storage or access can be in both regimes' scope, but the available exceptions are not identical.
EU cookie consent exemptions are narrow: the cookie must be solely for transmitting a communication, or strictly necessary for a specific information-society service explicitly requested by the user.
Schedule A1 includes consent, transmission, and strictly necessary routes, plus conditional exceptions for statistical collection, website appearance or functionality purposes, and emergency assistance.
For each UK exception, test every Schedule A1 condition. Do not treat a exception as an EU Article 5(3) exception or rely on a broad label such as analytics or preferences.
Article 13 requires prior consent for electronic mail direct marketing, subject to the customer-contact rule for the sender's own similar products or services with a clear, easy, free opportunity to object at collection and in every later message.
regulation 22 generally requires consent for electronic-mail marketing to individual subscribers unless a statutory soft opt-in applies. Corporate subscribers follow a different PECR route, although UK GDPR still applies when the address or other campaign data is personal data.
Classify the subscriber before choosing the route. Keep the contact source, consent or soft-opt-in facts, sender identity, unsubscribe path, and suppression result.
EU consent evidence should show real choice, clear information, an affirmative action, ability to demonstrate consent, and withdrawal without detriment; scrolling or similar passive activity is not enough for unambiguous consent.
Where requires consent, use the UK data-protection definition and standards for consent. For electronic-mail marketing, the ICO requires consent to be specific to the type of message and sender; a soft opt-in is a conditional exception, not consent.
Consent logs should capture the notice version, purposes, sender, channel, positive action, timestamp, and withdrawal. Soft-opt-in records should capture every condition instead of recording consent that was never given.
EU evidence can be reused across cookie, analytics, consent, and marketing reviews only when each record says which Article 5(3), Article 13, consent, or GDPR/ePrivacy interplay point it supports.
evidence should identify regulation 6 or 22, the Schedule A1 or soft-opt-in branch used, subscriber type where relevant, information shown, consent or objection state, and any linked UK GDPR processing.
EDPB Opinion 5/2019 explains that Articles 5(3) and 13 can apply to website operators and other businesses, and that ePrivacy-specific rules can coexist with GDPR where personal data is involved.
Apply before non-essential storage or access begins and before sending consent-dependent electronic mail. Give the product-and-services or charitable soft-opt-in opt-out at collection and in every later message.
The Directive requires Member States to establish sanctions and designate authorities through national law, so the competent authority and penalty route depend on the transposition.
regulation 31 applies the Information Commissioner's enforcement powers through the UK statutory scheme. Use the current PECR text and ICO material for a concrete UK enforcement question.
Do not quote an EU-wide ePrivacy penalty or assume the same authority handles both jurisdictions. Record the national EU source and the UK source separately.
The EU and UK analyses can reuse technical and campaign facts, but the EU conclusion must cite the relevant Member State transposition when a country-specific answer is needed.
The conclusion can reuse the same inventory, banner, consent log, sale record, and suppression list, but it must identify the UK rule, subscriber type, and any Schedule A1 or soft-opt-in conditions.
For an EU operation, identify the exact storage, access, or marketing act, then apply the relevant Member State law that transposes Article 5(3) or Article 13.
For a UK operation, apply regulation 6 and Schedule A1 to storage or access, or the relevant marketing regulation and subscriber category to the campaign. Apply UK GDPR separately where personal data is processed.
Approve each jurisdiction only after its own rule and exception conditions are documented. A single global banner or campaign setting may need different legal configurations.
Article 5(3) covers storing information or gaining access to information already stored in a subscriber's or user's terminal equipment; EDPB guidance frames the test around information, terminal equipment, storage, and access, and it is not limited to ordinary cookies.
regulation 6 and Schedule A1 govern storing information in, or gaining access to information stored in, a subscriber's or user's terminal equipment. The rule covers browser cookies and other technologies that perform the same storage or access operations.
Use one technical inventory, then make separate EU and UK decisions. The same storage or access can be in both regimes' scope, but the available exceptions are not identical.
EU cookie consent exemptions are narrow: the cookie must be solely for transmitting a communication, or strictly necessary for a specific information-society service explicitly requested by the user.
Schedule A1 includes consent, transmission, and strictly necessary routes, plus conditional exceptions for statistical collection, website appearance or functionality purposes, and emergency assistance.
For each UK exception, test every Schedule A1 condition. Do not treat a exception as an EU Article 5(3) exception or rely on a broad label such as analytics or preferences.
Article 13 requires prior consent for electronic mail direct marketing, subject to the customer-contact rule for the sender's own similar products or services with a clear, easy, free opportunity to object at collection and in every later message.
regulation 22 generally requires consent for electronic-mail marketing to individual subscribers unless a statutory soft opt-in applies. Corporate subscribers follow a different PECR route, although UK GDPR still applies when the address or other campaign data is personal data.
Classify the subscriber before choosing the route. Keep the contact source, consent or soft-opt-in facts, sender identity, unsubscribe path, and suppression result.
EU consent evidence should show real choice, clear information, an affirmative action, ability to demonstrate consent, and withdrawal without detriment; scrolling or similar passive activity is not enough for unambiguous consent.
Where requires consent, use the UK data-protection definition and standards for consent. For electronic-mail marketing, the ICO requires consent to be specific to the type of message and sender; a soft opt-in is a conditional exception, not consent.
Consent logs should capture the notice version, purposes, sender, channel, positive action, timestamp, and withdrawal. Soft-opt-in records should capture every condition instead of recording consent that was never given.
EU evidence can be reused across cookie, analytics, consent, and marketing reviews only when each record says which Article 5(3), Article 13, consent, or GDPR/ePrivacy interplay point it supports.
evidence should identify regulation 6 or 22, the Schedule A1 or soft-opt-in branch used, subscriber type where relevant, information shown, consent or objection state, and any linked UK GDPR processing.
EDPB Opinion 5/2019 explains that Articles 5(3) and 13 can apply to website operators and other businesses, and that ePrivacy-specific rules can coexist with GDPR where personal data is involved.
Apply before non-essential storage or access begins and before sending consent-dependent electronic mail. Give the product-and-services or charitable soft-opt-in opt-out at collection and in every later message.
The Directive requires Member States to establish sanctions and designate authorities through national law, so the competent authority and penalty route depend on the transposition.
regulation 31 applies the Information Commissioner's enforcement powers through the UK statutory scheme. Use the current PECR text and ICO material for a concrete UK enforcement question.
Do not quote an EU-wide ePrivacy penalty or assume the same authority handles both jurisdictions. Record the national EU source and the UK source separately.
The EU and UK analyses can reuse technical and campaign facts, but the EU conclusion must cite the relevant Member State transposition when a country-specific answer is needed.
The conclusion can reuse the same inventory, banner, consent log, sale record, and suppression list, but it must identify the UK rule, subscriber type, and any Schedule A1 or soft-opt-in conditions.
For an EU operation, identify the exact storage, access, or marketing act, then apply the relevant Member State law that transposes Article 5(3) or Article 13.
For a UK operation, apply regulation 6 and Schedule A1 to storage or access, or the relevant marketing regulation and subscriber category to the campaign. Apply UK GDPR separately where personal data is processed.
Approve each jurisdiction only after its own rule and exception conditions are documented. A single global banner or campaign setting may need different legal configurations.
Identify the user and campaign jurisdictions before choosing a rule.
For the EU, apply the relevant Member State transposition to the specific Article 5(3) or Article 13 operation.
For the UK, apply regulation 6 and Schedule A1 to storage or access, and classify the marketing channel and subscriber before using consent or a soft opt-in.
Do not import the statistical, website appearance or functionality, emergency-assistance, or charitable-purpose branches into an EU conclusion.
Apply GDPR or UK GDPR separately whenever the operation processes personal data.
The ePrivacy Directive requires Member States to transpose its rules, so the operative EU requirement comes from the relevant national law. is the UK's own statutory instrument and is read with UK data-protection law and ICO guidance.
A service can need both workstreams when it serves people in the EU and UK. Keep separate legal conclusions even when the same tracker inventory, consent interface, customer record, or suppression list supplies the underlying facts.
Record the user's location, the service and sender entities, the applicable EU Member State transposition, and whether applies to the UK activity.
Inventory cookies and similar technologies by purpose, party, duration, information stored or read, and the service function the user requested.
Inventory marketing by channel, subscriber type, source of contact details, sale or support context, product similarity, consent, objection, and suppression status.
Keep EU and UK authority, enforcement, and penalty conclusions separate.
EU Article 5(3) requires clear information and consent for storage or access on terminal equipment unless the operation is solely for transmitting a communication or strictly necessary for an information-society service explicitly requested by the user. EDPB guidance applies the technical test beyond browser cookies to pixels, local processing, identifiers, and connected devices.
Current regulation 6 and Schedule A1 retain consent, transmission, and strictly necessary routes, and also contain UK statutory exceptions for qualifying statistical collection, certain website appearance or functionality purposes, and emergency assistance. Each exception has conditions in Schedule A1; its title alone is not enough.
Do not import a Schedule A1 exception into an EU Article 5(3) decision. Check the relevant Member State law for any national rule or regulator position.
For statistical collection, verify the statutory safeguards, purpose limits, information duties, and opt-out requirements in the current Schedule A1 text.
For a website appearance or functionality purpose, record whether the storage or access adapts the service to the user's preferences or enhances its appearance or functionality, and verify the information and opt-out conditions.
Where personal data is involved, complete a separate GDPR or UK GDPR analysis after the ePrivacy or storage-access decision.
Direct marketing has shared concepts and UK-specific branches
EU Article 13 requires prior consent for automated calls, fax, and electronic mail direct marketing, subject to the customer-contact exception for the sender's own similar products or services and a free, easy objection at collection and in each message. Member States retain choices for some other communications and must protect legal persons' legitimate interests.
regulation 22 distinguishes individual subscribers from corporate subscribers for electronic-mail marketing. The ICO explains the product-and-services soft opt-in as a five-condition exception for contact details obtained directly during a sale or sale negotiation, the sender's similar products or services, and opt-out opportunities at collection and in every message. Current UK law and ICO guidance also include a separate charitable-purposes soft opt-in with its own eligibility and six conditions. That exception commenced on 5 February 2026 and can apply only when the charity obtained the recipient's contact details on or after that date.
Identify the recipient as an individual or corporate subscriber for ; a named business email can still be personal data even where PECR's corporate-subscriber rule differs.
For the product-and-services soft opt-in, keep evidence for all five conditions. A purchased list, a contact obtained from another group company, or unrelated third-party marketing does not satisfy the ICO's stated route.
Only a qualifying charity can use the charitable-purposes soft opt-in, and only for its own charitable purposes when every statutory condition is met.
For EU campaigns, check the recipient country's Article 13 transposition rather than copying 's subscriber categories or charitable exception.
Confirms that the charitable-purposes soft opt-in commenced on 5 February 2026 and is available only for contact details obtained on or after that date, subject to the other statutory conditions.