The EU Directive and UK share the same legislative ancestry, but they are separate legal regimes. Check the destination jurisdiction before approving cookies, similar technologies, or direct marketing.
The comparison uses the EU Directive and EDPB guidance alongside the latest revised text and ICO guidance on cookies and direct marketing.
For an EU user, start with the Member State law that transposes the ePrivacy Directive. For a UK user, apply the Privacy and Electronic Communications (EC Directive) Regulations 2003 () in their latest revised form. Both regulate storage or access on terminal equipment and electronic marketing, but UK amendments now include PECR-specific statutory exceptions and a charitable-purpose soft opt-in that do not appear in the Directive's text. Do not copy an EU conclusion into a UK file, or a UK exception into an EU launch.
Side-by-side comparison
EU ePrivacy Directive vs UK PECR
Compare the EU framework with current UK statutory rules, then record the jurisdiction-specific source and conclusion for each operation.
Based on the EU ePrivacy sources for Article 5(3), direct marketing, consent, soft opt-in logic, and GDPR/ePrivacy interplay.
Second framework
UK PECR
UK statutory rules for terminal-equipment storage or access, electronic communications and marketing, read with UK data-protection law and ICO guidance.
Article 5(3) covers storing information or gaining access to information already stored in a subscriber's or user's terminal equipment; EDPB guidance frames the test around information, terminal equipment, storage, and access, and it is not limited to ordinary cookies.
Supports applying Article 5(3) to storage and access operations beyond conventional cookies.
gaining access
regulation 6 and Schedule A1 govern storing information in, or gaining access to information stored in, a subscriber's or user's terminal equipment. The rule covers browser cookies and other technologies that perform the same storage or access operations.
Explains how PECR applies to cookies and similar storage or access technologies.
Use one technical inventory, then make separate EU and UK decisions. The same storage or access can be in both regimes' scope, but the available exceptions are not identical.
EU cookie consent exemptions are narrow: the cookie must be solely for transmitting a communication, or strictly necessary for a specific information-society service explicitly requested by the user.
Supports the EU exemption tests for transmission-only and strictly necessary cookies.
strictly necessary
Schedule A1 includes consent, transmission, and strictly necessary routes, plus conditional exceptions for statistical collection, website appearance or functionality purposes, and emergency assistance.
Schedule A1 contains the current UK consent and exception branches for terminal-equipment storage or access.
For each UK exception, test every Schedule A1 condition. Do not treat a exception as an EU Article 5(3) exception or rely on a broad label such as analytics or preferences.
Article 13 requires prior consent for electronic mail direct marketing, subject to the customer-contact rule for the sender's own similar products or services with a clear, easy, free opportunity to object at collection and in every later message.
Supports the EU Article 13 direct-marketing consent and customer-contact rules.
direct marketing
regulation 22 generally requires consent for electronic-mail marketing to individual subscribers unless a statutory soft opt-in applies. Corporate subscribers follow a different PECR route, although UK GDPR still applies when the address or other campaign data is personal data.
Explains the PECR distinction between individual and corporate subscribers and the electronic-mail consent and soft-opt-in routes.
Classify the subscriber before choosing the route. Keep the contact source, consent or soft-opt-in facts, sender identity, unsubscribe path, and suppression result.
EU consent evidence should show real choice, clear information, an affirmative action, ability to demonstrate consent, and withdrawal without detriment; scrolling or similar passive activity is not enough for unambiguous consent.
Supports EU consent-quality, demonstration, and withdrawal evidence expectations.
withdraw consent
Where requires consent, use the UK data-protection definition and standards for consent. For electronic-mail marketing, the ICO requires consent to be specific to the type of message and sender; a soft opt-in is a conditional exception, not consent.
Explains consent quality for PECR marketing and distinguishes consent from the statutory soft opt-ins.
Consent logs should capture the notice version, purposes, sender, channel, positive action, timestamp, and withdrawal. Soft-opt-in records should capture every condition instead of recording consent that was never given.
EU evidence can be reused across cookie, analytics, consent, and marketing reviews only when each record says which Article 5(3), Article 13, consent, or GDPR/ePrivacy interplay point it supports.
Supports the EU terminal-equipment and unsolicited-communications duties that the evidence record should identify.
unsolicited communications
evidence should identify regulation 6 or 22, the Schedule A1 or soft-opt-in branch used, subscriber type where relevant, information shown, consent or objection state, and any linked UK GDPR processing.
EDPB Opinion 5/2019 explains that Articles 5(3) and 13 can apply to website operators and other businesses, and that ePrivacy-specific rules can coexist with GDPR where personal data is involved.
Supports separating ePrivacy-specific obligations from general data-protection obligations for electronic communications.
particularise and complement
Apply before non-essential storage or access begins and before sending consent-dependent electronic mail. Give the product-and-services or charitable soft-opt-in opt-out at collection and in every later message.
Supports controlling non-essential cookies and similar technologies through an appropriate consent mechanism.
A data protection impact assessment (DPIA), lawful-basis record, or privacy notice does not replace the pre-use decision, the collection-stage opt-out, or the message-level unsubscribe.
The Directive requires Member States to establish sanctions and designate authorities through national law, so the competent authority and penalty route depend on the transposition.
Supports the Member State discretion over ePrivacy enforcement bodies and the need to identify national competence.
more than one national body
regulation 31 applies the Information Commissioner's enforcement powers through the UK statutory scheme. Use the current PECR text and ICO material for a concrete UK enforcement question.
Regulation 31 and Schedule 1 establish the PECR enforcement route through the Information Commissioner.
Do not quote an EU-wide ePrivacy penalty or assume the same authority handles both jurisdictions. Record the national EU source and the UK source separately.
The EU and UK analyses can reuse technical and campaign facts, but the EU conclusion must cite the relevant Member State transposition when a country-specific answer is needed.
Supports applying Article 5(3) to storage and access operations beyond conventional cookies.
gaining access
The conclusion can reuse the same inventory, banner, consent log, sale record, and suppression list, but it must identify the UK rule, subscriber type, and any Schedule A1 or soft-opt-in conditions.
For an EU operation, identify the exact storage, access, or marketing act, then apply the relevant Member State law that transposes Article 5(3) or Article 13.
Supports applying Article 5(3) to storage and access operations beyond conventional cookies.
gaining access
For a UK operation, apply regulation 6 and Schedule A1 to storage or access, or the relevant marketing regulation and subscriber category to the campaign. Apply UK GDPR separately where personal data is processed.
Primary source for the UK decision branches in regulation 6, Schedule A1, and the direct-marketing provisions.
Approve each jurisdiction only after its own rule and exception conditions are documented. A single global banner or campaign setting may need different legal configurations.
Supports the EU-side evidence categories that should be kept distinct from any later PECR conclusion.
storage of information and stored information
Scope boundary
EU ePrivacy Directive
Article 5(3) covers storing information or gaining access to information already stored in a subscriber's or user's terminal equipment; EDPB guidance frames the test around information, terminal equipment, storage, and access, and it is not limited to ordinary cookies.
Supports applying Article 5(3) to storage and access operations beyond conventional cookies.
gaining access
UK PECR
regulation 6 and Schedule A1 govern storing information in, or gaining access to information stored in, a subscriber's or user's terminal equipment. The rule covers browser cookies and other technologies that perform the same storage or access operations.
Explains how PECR applies to cookies and similar storage or access technologies.
Operational implication
Use one technical inventory, then make separate EU and UK decisions. The same storage or access can be in both regimes' scope, but the available exceptions are not identical.
Supports the EU-side evidence categories that should be kept distinct from any later PECR conclusion.
storage of information and stored information
Storage and access exceptions
EU ePrivacy Directive
EU cookie consent exemptions are narrow: the cookie must be solely for transmitting a communication, or strictly necessary for a specific information-society service explicitly requested by the user.
Supports the EU exemption tests for transmission-only and strictly necessary cookies.
strictly necessary
UK PECR
Schedule A1 includes consent, transmission, and strictly necessary routes, plus conditional exceptions for statistical collection, website appearance or functionality purposes, and emergency assistance.
Schedule A1 contains the current UK consent and exception branches for terminal-equipment storage or access.
Operational implication
For each UK exception, test every Schedule A1 condition. Do not treat a exception as an EU Article 5(3) exception or rely on a broad label such as analytics or preferences.
Supports the evidence needed to defend an EU exemption analysis.
explicitly requested
Trigger
EU ePrivacy Directive
Article 13 requires prior consent for electronic mail direct marketing, subject to the customer-contact rule for the sender's own similar products or services with a clear, easy, free opportunity to object at collection and in every later message.
Supports the EU Article 13 direct-marketing consent and customer-contact rules.
direct marketing
UK PECR
regulation 22 generally requires consent for electronic-mail marketing to individual subscribers unless a statutory soft opt-in applies. Corporate subscribers follow a different PECR route, although UK GDPR still applies when the address or other campaign data is personal data.
Explains the PECR distinction between individual and corporate subscribers and the electronic-mail consent and soft-opt-in routes.
Operational implication
Classify the subscriber before choosing the route. Keep the contact source, consent or soft-opt-in facts, sender identity, unsubscribe path, and suppression result.
Supports the EU evidence fields for direct-marketing and objection records.
electronic mail
Core obligations
EU ePrivacy Directive
EU consent evidence should show real choice, clear information, an affirmative action, ability to demonstrate consent, and withdrawal without detriment; scrolling or similar passive activity is not enough for unambiguous consent.
Supports EU consent-quality, demonstration, and withdrawal evidence expectations.
withdraw consent
UK PECR
Where requires consent, use the UK data-protection definition and standards for consent. For electronic-mail marketing, the ICO requires consent to be specific to the type of message and sender; a soft opt-in is a conditional exception, not consent.
Explains consent quality for PECR marketing and distinguishes consent from the statutory soft opt-ins.
Operational implication
Consent logs should capture the notice version, purposes, sender, channel, positive action, timestamp, and withdrawal. Soft-opt-in records should capture every condition instead of recording consent that was never given.
Supports keeping consent logs and withdrawal evidence reviewable.
demonstrate consent
Evidence record
EU ePrivacy Directive
EU evidence can be reused across cookie, analytics, consent, and marketing reviews only when each record says which Article 5(3), Article 13, consent, or GDPR/ePrivacy interplay point it supports.
Supports the EU terminal-equipment and unsolicited-communications duties that the evidence record should identify.
unsolicited communications
UK PECR
evidence should identify regulation 6 or 22, the Schedule A1 or soft-opt-in branch used, subscriber type where relevant, information shown, consent or objection state, and any linked UK GDPR processing.
Supports the EU source labels used in the shared evidence pack.
Article 13
Applicable businesses and pre-launch controls
EU ePrivacy Directive
EDPB Opinion 5/2019 explains that Articles 5(3) and 13 can apply to website operators and other businesses, and that ePrivacy-specific rules can coexist with GDPR where personal data is involved.
Supports separating ePrivacy-specific obligations from general data-protection obligations for electronic communications.
particularise and complement
UK PECR
Apply before non-essential storage or access begins and before sending consent-dependent electronic mail. Give the product-and-services or charitable soft-opt-in opt-out at collection and in every later message.
Supports controlling non-essential cookies and similar technologies through an appropriate consent mechanism.
Operational implication
A data protection impact assessment (DPIA), lawful-basis record, or privacy notice does not replace the pre-use decision, the collection-stage opt-out, or the message-level unsubscribe.
Supports separate evidence for ePrivacy-specific conclusions instead of relying only on GDPR records.
particularise and complement
Enforcement
EU ePrivacy Directive
The Directive requires Member States to establish sanctions and designate authorities through national law, so the competent authority and penalty route depend on the transposition.
Supports the Member State discretion over ePrivacy enforcement bodies and the need to identify national competence.
more than one national body
UK PECR
regulation 31 applies the Information Commissioner's enforcement powers through the UK statutory scheme. Use the current PECR text and ICO material for a concrete UK enforcement question.
Regulation 31 and Schedule 1 establish the PECR enforcement route through the Information Commissioner.
Operational implication
Do not quote an EU-wide ePrivacy penalty or assume the same authority handles both jurisdictions. Record the national EU source and the UK source separately.
Supports keeping national ePrivacy enforcement competence distinct from the UK PECR route.
Implementation and enforcement
Overlap and reuse
EU ePrivacy Directive
The EU and UK analyses can reuse technical and campaign facts, but the EU conclusion must cite the relevant Member State transposition when a country-specific answer is needed.
Supports applying Article 5(3) to storage and access operations beyond conventional cookies.
gaining access
UK PECR
The conclusion can reuse the same inventory, banner, consent log, sale record, and suppression list, but it must identify the UK rule, subscriber type, and any Schedule A1 or soft-opt-in conditions.
Supports the EU-side evidence categories that should be kept distinct from any later PECR conclusion.
storage of information and stored information
Practical decision rule
EU ePrivacy Directive
For an EU operation, identify the exact storage, access, or marketing act, then apply the relevant Member State law that transposes Article 5(3) or Article 13.
Supports applying Article 5(3) to storage and access operations beyond conventional cookies.
gaining access
UK PECR
For a UK operation, apply regulation 6 and Schedule A1 to storage or access, or the relevant marketing regulation and subscriber category to the campaign. Apply UK GDPR separately where personal data is processed.
Primary source for the UK decision branches in regulation 6, Schedule A1, and the direct-marketing provisions.
Operational implication
Approve each jurisdiction only after its own rule and exception conditions are documented. A single global banner or campaign setting may need different legal configurations.
Supports the EU-side evidence categories that should be kept distinct from any later PECR conclusion.
storage of information and stored information
Practical decision rule
How should teams make the EU and UK decisions?
Identify the user and campaign jurisdictions before choosing a rule.
For the EU, apply the relevant Member State transposition to the specific Article 5(3) or Article 13 operation.
For the UK, apply regulation 6 and Schedule A1 to storage or access, and classify the marketing channel and subscriber before using consent or a soft opt-in.
Do not import the statistical, website appearance or functionality, emergency-assistance, or charitable-purpose branches into an EU conclusion.
Apply GDPR or UK GDPR separately whenever the operation processes personal data.
Supports the PECR subscriber, consent, product-and-services soft-opt-in, and charitable-purposes soft-opt-in steps.
1
Section 1
Choose the governing jurisdiction first
The ePrivacy Directive requires Member States to transpose its rules, so the operative EU requirement comes from the relevant national law. is the UK's own statutory instrument and is read with UK data-protection law and ICO guidance.
A service can need both workstreams when it serves people in the EU and UK. Keep separate legal conclusions even when the same tracker inventory, consent interface, customer record, or suppression list supplies the underlying facts.
Record the user's location, the service and sender entities, the applicable EU Member State transposition, and whether applies to the UK activity.
Inventory cookies and similar technologies by purpose, party, duration, information stored or read, and the service function the user requested.
Inventory marketing by channel, subscriber type, source of contact details, sale or support context, product similarity, consent, objection, and suppression status.
Keep EU and UK authority, enforcement, and penalty conclusions separate.
Latest revised UK statutory text for PECR, including regulation 6, Schedule A1, direct-marketing rules, and Information Commissioner enforcement provisions.
2
Section 2
Compare the device-storage rules carefully
EU Article 5(3) requires clear information and consent for storage or access on terminal equipment unless the operation is solely for transmitting a communication or strictly necessary for an information-society service explicitly requested by the user. EDPB guidance applies the technical test beyond browser cookies to pixels, local processing, identifiers, and connected devices.
Current regulation 6 and Schedule A1 retain consent, transmission, and strictly necessary routes, and also contain UK statutory exceptions for qualifying statistical collection, certain website appearance or functionality purposes, and emergency assistance. Each exception has conditions in Schedule A1; its title alone is not enough.
Do not import a Schedule A1 exception into an EU Article 5(3) decision. Check the relevant Member State law for any national rule or regulator position.
For statistical collection, document the sole improvement-statistics purpose, sharing only with a person assisting those improvements, clear and comprehensive purpose information, a simple free objection route, and that the user has not objected. Paragraph 5 excludes collecting or monitoring automatically emitted terminal-equipment information from its access route.
For a website appearance or functionality purpose, record whether the storage or access adapts the service to the user's preferences or enhances its appearance or functionality, and verify the information and opt-out conditions.
Where personal data is involved, complete a separate GDPR or UK GDPR analysis after the ePrivacy or storage-access decision.
Regulation 6 and Schedule A1 provide the current UK consent route and exceptions for transmission, strictly necessary services, statistics, website appearance or functionality, and emergency assistance.
ICO guidance for auditing cookies and similar technologies, giving clear information, identifying strictly necessary uses, and controlling non-essential storage or access.
Specific conditions for current UK storage/access routes; paragraph5 statistical and paragraph6 appearance/functionality conditions.
3
Section 3
Direct marketing has shared concepts and UK-specific branches
EU Article 13 requires prior consent for automated calls, fax, and electronic mail direct marketing, subject to the customer-contact exception for the sender's own similar products or services and a free, easy objection at collection and in each message. Member States retain choices for some other communications and must protect legal persons' legitimate interests.
regulation 22 distinguishes individual subscribers from corporate subscribers for electronic-mail marketing. The ICO explains the product-and-services soft opt-in as a five-condition exception for contact details obtained directly during a sale or sale negotiation, the sender's similar products or services, and opt-out opportunities at collection and in every message. Current UK law and ICO guidance also include a separate charitable-purposes soft opt-in with its own eligibility and six conditions. That exception commenced on 5 February 2026 and can apply only when the charity obtained the recipient's contact details on or after that date.
For the UK charitable-purpose branch, record all six conditions: the sender meets the applicable UK charity definition; it obtained the contact details directly; the person expressed interest in, or offered or provided support for, its charitable purposes; the sole marketing purpose furthers those purposes; an opt-out was offered at collection; and every subsequent message offers an opt-out. The contact details must have been obtained on or after 5 February 2026. A donation list supplied by another organisation does not satisfy direct collection.
Identify the recipient as an individual or corporate subscriber for ; a named business email can still be personal data even where PECR's corporate-subscriber rule differs.
For the product-and-services soft opt-in, keep evidence for all five conditions. A purchased list, a contact obtained from another group company, or unrelated third-party marketing does not satisfy the ICO's stated route.
Only a qualifying charity can use the charitable-purposes soft opt-in, and only for its own charitable purposes when every statutory condition is met.
For EU campaigns, check the recipient country's Article 13 transposition rather than copying 's subscriber categories or charitable exception.
Explains PECR's individual and corporate subscriber distinction, electronic-mail consent, the five product-and-services soft-opt-in conditions, and the six charitable-purposes soft-opt-in conditions.
Confirms that the charitable-purposes soft opt-in commenced on 5 February 2026 and is available only for contact details obtained on or after that date, subject to the other statutory conditions.
Latest revised PECR text for terminal-equipment storage and access, Schedule A1 exceptions, direct marketing, and Information Commissioner enforcement powers.
Latest revised UK statutory text for PECR, including regulation 6, Schedule A1, direct-marketing rules, and Information Commissioner enforcement provisions.
Regulation 6 and Schedule A1 provide the current UK consent route and exceptions for transmission, strictly necessary services, statistics, website appearance or functionality, and emergency assistance.
Show 8 more
Current statutory source for regulation 22 electronic-mail marketing and related PECR provisions.
Regulation 6 and Schedule A1 establish the current UK terminal-equipment rule.
Schedule A1 contains the current UK consent and exception branches for terminal-equipment storage or access.
Primary source for the UK rules and branches that evidence records must identify.
Regulation 31 and Schedule 1 establish the PECR enforcement route through the Information Commissioner.
Supports the PECR-specific branches that must remain distinct in a shared evidence pack.
Primary source for the UK decision branches in regulation 6, Schedule A1, and the direct-marketing provisions.
Primary source for current PECR regulation 6, Schedule A1, marketing, and enforcement branches.
UK regulator guidance for subscriber categories, electronic-mail consent, product-and-services soft opt-in, charitable-purposes soft opt-in, and evidence planning.
Explains PECR's individual and corporate subscriber distinction, electronic-mail consent, the five product-and-services soft-opt-in conditions, and the six charitable-purposes soft-opt-in conditions.
Explains the PECR distinction between individual and corporate subscribers and the electronic-mail consent and soft-opt-in routes.
Show 3 more
Explains consent quality for PECR marketing and distinguishes consent from the statutory soft opt-ins.
States the collection-stage and subsequent-message opt-out conditions for both UK soft opt-ins.
Supports the PECR subscriber, consent, product-and-services soft-opt-in, and charitable-purposes soft-opt-in steps.
UK regulator guidance for auditing cookies and similar technologies, consent controls, information, and strictly necessary classification.
ICO guidance for auditing cookies and similar technologies, giving clear information, identifying strictly necessary uses, and controlling non-essential storage or access.
Explains how PECR applies to cookies and similar storage or access technologies.
Show 1 more
Supports controlling non-essential cookies and similar technologies through an appropriate consent mechanism.
Current UK regulator guidance for the charitable-purposes soft opt-in commencement date, contact-detail timing rule, and statutory conditions.
Confirms that the charitable-purposes soft opt-in commenced on 5 February 2026 and is available only for contact details obtained on or after that date, subject to the other statutory conditions.