PECR applies to cookies, pixels, scripts, device fingerprinting, and other technologies that store information on or access information from a person's device.
Consent is required unless every purpose fits a PECR exception. Since 5 February 2026, the exceptions include limited statistical, appearance, and emergency-assistance uses as well as communication and strictly necessary uses.
The Privacy and Electronic Communications Regulations (PECR) apply to storage and access technologies. Audit each storage and access technology by purpose, not by its label. Obtain valid consent before any non-exempt purpose starts. An exception may apply to transmission, a service that the user requested, limited service-improvement statistics, appearance or functionality, or emergency assistance, but each exception has its own conditions. PECR applies even if the information is not personal data; the UK GDPR also applies when personal data is processed.
The communication exception covers storage or access whose sole purpose is transmitting a communication over an electronic communications network. The covers what is essential to provide an information society service expressly requested by the user, such as retaining basket contents, essential authentication, or security for the requested service. Convenience, business preference, and advertising do not become strictly necessary because the operator wants them.
The statistical purposes exception can cover storage or access used solely to collect aggregate statistics about use of the operator's service or website with a view to improving it. The operator must give clear information and a simple, free way to object. It does not cover recordings or logs of individual visitors, profiling, advertising measurement, cross-service monitoring, or a provider reusing the information for its own purposes. A third-party analytics provider must act as the operator's processor and use the information only to improve that operator's service.
The appearance exception can cover adapting or enhancing how the requested service appears or functions on the user's device, such as responsive layout, a chosen language, or an operating-system colour preference. It also requires clear information and a simple, free means of objecting. It does not cover choosing content or advertising from known or inferred interests. The emergency-assistance exception is narrower: its sole purpose must be identifying the device's geographical position after a request or other indication that the subscriber or user needs emergency assistance.
Sources (2)
ICO explanation of the communication, strictly necessary, statistical purposes, appearance, and emergency-assistance exceptions and their conditions.
Official explanation of Schedule A1, including the new statistical, appearance, and emergency-assistance exceptions and their safeguards.
PECR protects information on a device whether or not it identifies anyone. If the storage, access, or subsequent use involves personal data, the controller must also identify a UK GDPR lawful basis, provide privacy information, limit the purpose and data, secure it, set retention, support rights, and assess processors and international transfers.
PECR consent and the UK GDPR lawful basis are linked but not interchangeable. If PECR requires consent, an organisation cannot avoid that requirement by selecting legitimate interests for the same storage or access. For subsequent personal-data processing, document the applicable lawful basis and make sure it is consistent with what the person agreed to.
Children and people likely to misunderstand tracking need particular attention. Use language and controls they can understand, avoid manipulative choice design, and consider whether profiling, sensitive inferences, or large-scale monitoring triggers a DPIA.
Sources (2)
ICO guidance on when both regimes apply, consent and lawful-basis interaction, and subsequent processing.
ICO examples covering tags, pixels, scripts, apps, connected devices, emitted information, and client- and server-side arrangements.
The service owner should maintain a live register tied to the deployed configuration. Product and engineering teams identify storage and access; privacy or legal reviewers assess consent and exceptions; marketing and analytics owners state the purpose; procurement records vendor behaviour and onward sharing.
Evidence should show what fires before and after each choice, the exact notice and controls shown, the consent or exception relied on for each purpose, objection and withdrawal behaviour, retention, recipients, contracts, UK GDPR lawful basis where personal data is involved, and the date and result of the last technical test.
Sources (2)
ICO implementation guidance on audits, clear information, consent mechanisms, records, third parties, duration, and periodic review.
ICO guidance on consent controls, granular purposes, withdrawal, and technologies used for multiple purposes.
Map every deployed storage or access technology to its exact purpose, consent or Schedule A1 exception, notice, objection or withdrawal control, technical test, owner, and retest trigger.
Create storage-and-access questions, exception checks, and technical review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Decide whether a UK personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report must contain, and when individuals must be told.
Use UK transfer approval regulations by checking the destination, recipient, data, sector, effective status, scope limits, and review evidence.
Current UK GDPR rules for significant solely automated decisions, meaningful human involvement, Article 22B restrictions, and Article 22C safeguards.
Apply the UK GDPR material and territorial scope tests to one processing activity, including exclusions, non-UK organisations, roles, and evidence.
Build UK GDPR Article 30 records for controller and processor activities, apply the narrow under-250 exception, and keep the records current and available to the ICO.
Decide whether a personal data breach must be reported to the ICO or communicated to individuals, with deadlines, exceptions, content, and evidence.
Run a UK GDPR personal data breach workflow from containment and awareness through risk assessment, ICO reporting, individual notice, and the breach record.
Apply UK GDPR children's protections and the Age Appropriate Design Code to online services likely to be accessed by children.
A practical guide to Children's Code scope, its 15 standards, age 13 consent, evidence, exceptions, and product implementation.
A verifiable UK GDPR checklist for scope, lawful processing, transparency, rights, governance, security, breaches, DPIAs, children, and transfers.
Answer common UK GDPR questions on scope, lawful basis, records, DPIAs, DPOs, rights, breaches, children, automated decisions, and international transfers.
Build a UK GDPR compliance programme around processing records, lawful decisions, rights operations, security, incidents, DPIAs, suppliers, and transfers.
Decide whether each party is a controller, joint controller, or processor under the UK GDPR, then record the role-specific duties, contract terms, and evidence.
Operate UK GDPR access, rectification, erasure, restriction, portability, objection, and automated-decision rights under the amended Article 12 timing rules.
Track UK GDPR deadlines for rights requests, privacy information, breach notification, DPIAs, and ICO prior consultation, with triggers and exceptions.
Screen UK GDPR processing for likely high risk, complete the required DPIA analysis before processing, reduce risk, and consult the ICO when high residual risk remains.
Decide when the UK GDPR requires a DPIA or DPO, what each must cover, when to consult the ICO, and what evidence to retain.
Run a UK subject-access workflow using the current Article 12A clock, reasonable identity and clarification steps, proportionate searches, exemptions, redactions, and response evidence.
Choose the UK IDTA or Addendum, complete the current Article 46 data protection test, add needed measures, and maintain evidence for restricted transfers.
Choose among the six familiar Article 6 bases and the UK's recognised legitimate interests basis, then document any Article 9 or 10 condition.
Understand the UK GDPR £8.7 million or 2% and £17.5 million or 4% fine ceilings, which infringements fall into each band, and how the ICO sets a fine.
Map UK GDPR requirements by processing activity, role, lawful basis, data type, risk, rights, suppliers, automated decisions, and transfers.
Apply the UK GDPR restricted-transfer sequence: map the transfer, check Article 45A approval, choose an Article 46 safeguard and assessment, or justify a specific Article 49 derogation.
Decide whether a UK restricted transfer exists, whether adequacy applies, how to use the IDTA or UK Addendum, and how to document the data protection test.
See when to use the UK GDPR, when the Data Protection Act 2018 adds a condition or exemption, and which regime covers law enforcement or intelligence processing.
Determine whether UK GDPR, EU GDPR, or both apply, then separate representatives, regulators, transfer routes, national law, and post-Brexit UK amendments.
Choose between the UK IDTA and EU SCCs with the UK Addendum, complete the right documents, and record the separate UK and EU transfer assessments.
Compare current UK and EU rules for recognised legitimate interests, rights requests, access searches, automated decisions, and international transfers.
Configure separate UK and EU privacy operations for representatives, regulator contacts, rights requests, breach reporting, transfer tools, and evidence.
Choose and document the UK GDPR lawful basis that fits each processing purpose, including recognised legitimate interest, in force since 5 February 2026.
Decide whether an online service is likely to be accessed by UK children and apply the ICO Children's Code standards to product design and personal-data use.
Decide whether a personal data breach must be reported to the ICO, when the 72-hour clock starts, what the report needs, and when affected people must be told.
Check whether current UK adequacy regulations cover a restricted transfer, including partial coverage for Canada, Japan, and the US UK Extension.
Apply the current UK rules for significant solely automated decisions, special-category restrictions, meaningful human involvement, and Article 22C safeguards.
See which controllers and processors need records of processing activities, what each record must contain, and how the under-250-employee exemption works.
Decide whether each party is a controller, joint controller, processor, or sub-processor, then record the contracts, responsibilities, and evidence the role requires.
Screen for likely high-risk processing, complete the Article 35 assessment before processing, and consult the ICO if high residual risk remains.
Apply the three UK GDPR DPO triggers and document expertise, independence, reporting line, resources, tasks, contacts, and conflict controls.
Decide when to use the UK IDTA or Addendum, complete the Article 46 data protection test, add supplementary measures, and keep the transfer under review.
Apply the current UK PECR rules to cookies and similar technologies, including consent, five exceptions, UK GDPR overlap, and evidence.