UK GDPR PECR Cookies

Regulation 6 is broader than cookies and websites. It covers storage and access technologies that store information on or access information from terminal equipment such as computers, phones, tablets, smart TVs, wearables, connected vehicles, and other connected devices. Pixels, software development kits, local storage, scripts, tags, fingerprinting, and similar methods can all fall within scope.

The rule concerns information, whether or not it identifies a person. If the technology also processes personal data, the UK GDPR applies to that processing. Check PECR consent or exceptions first, then identify the UK GDPR basis, transparency duties, retention, security, rights, and any DPIA requirement.

There are five purpose-specific exceptions. The communication exception covers storage or access whose sole purpose is transmitting a communication and without which transmission is impossible. The strictly necessary exception covers what is essential to provide the online service the user requested. The emergency assistance exception applies after a device sends a request or another indication that the subscriber or user needs emergency assistance, where the sole purpose of the storage or access is to identify their geographical position so that assistance can be provided.

The statistical purposes exception is limited to aggregate, non-identifying statistics used solely to improve the service or website. The appearance exception is limited to adapting appearance or functionality to the user's preference or otherwise enhancing how the website appears or functions on the device. Both require clear and comprehensive information and a simple, free means to object.

Any purpose outside an exception requires consent before the storage or access occurs. Online advertising, cross-site or cross-device tracking, profiling, social-media tracking, and advertising measurement require consent. If one technology has both exempt and non-exempt purposes, do not enable the non-exempt purpose until consent is obtained.

Before requesting consent, tell the subscriber or user which technologies will operate, their purposes, whether third parties store, access, or receive information, and how long the storage or access will last. Consent must result from a clear positive action. Continuing to use a service, silence, inactivity, or a pre-ticked control is not enough.

The mechanism must make refusal as easy as acceptance, provide controls for non-exempt purposes, and allow withdrawal as easily as consent was given. Keep non-exempt technologies disabled until consent. Revisit consent when purposes or technologies change enough that the original choice no longer covers them.

Keep an audit showing the scan or inventory, purpose classification, exception assessment, information displayed, banner and preference-centre configuration, consent or objection records, withdrawal handling, third-party settings, test results, owner, and review date. Test the deployed service because a written policy does not show which requests, tags, SDKs, or pixels actually run.