UK GDPR PECR Cookies

Regulation 6 of PECR covers storing information on, or accessing information from, a subscriber's or user's terminal equipment. The rule is technology-neutral: cookies, tracking pixels, tags, scripts, local storage, software development kits, device fingerprinting, and automatically emitted device information can all be in scope.

For a non-exempt purpose, give clear and comprehensive information and obtain UK GDPR-standard consent before storage or access begins. Consent must be freely given, specific, informed, and indicated by an unambiguous positive action. Continuing to browse, silence, inactivity, or a pre-enabled control is not enough.

Classify each purpose separately. If one technology serves an exempt purpose and advertising or another non-exempt purpose, consent is still required for the non-exempt purpose. Calling a technology 'essential' or 'analytics' does not determine the result.

The communication exception covers storage or access whose sole purpose is transmitting a communication over an electronic communications network. The strictly necessary exception covers what is essential to provide an information society service expressly requested by the user, such as retaining basket contents, essential authentication, or security for the requested service. Convenience, business preference, and advertising do not become strictly necessary because the operator wants them.

The statistical purposes exception can cover storage or access used solely to collect aggregate statistics about use of the operator's service or website with a view to improving it. The operator must give clear information and a simple, free way to object. It does not cover recordings or logs of individual visitors, profiling, advertising measurement, cross-service monitoring, or a provider reusing the information for its own purposes. A third-party analytics provider must act as the operator's processor and use the information only to improve that operator's service.

The appearance exception can cover adapting or enhancing how the requested service appears or functions on the user's device, such as responsive layout, a chosen language, or an operating-system colour preference. It also requires clear information and a simple, free means of objecting. It does not cover choosing content or advertising from known or inferred interests. The emergency-assistance exception is narrower: its sole purpose must be identifying the device's geographical position after a request or other indication that the subscriber or user needs emergency assistance.

PECR protects information on a device whether or not it identifies anyone. If the storage, access, or subsequent use involves personal data, the controller must also identify a UK GDPR lawful basis, provide privacy information, limit the purpose and data, secure it, set retention, support rights, and assess processors and international transfers.

PECR consent and the UK GDPR lawful basis are linked but not interchangeable. If PECR requires consent, an organisation cannot avoid that requirement by selecting legitimate interests for the same storage or access. For subsequent personal-data processing, document the applicable lawful basis and make sure it is consistent with what the person agreed to.

Children and people likely to misunderstand tracking need particular attention. Use language and controls they can understand, avoid manipulative choice design, and consider whether profiling, sensitive inferences, or large-scale monitoring triggers a DPIA.

The service owner should maintain a live register tied to the deployed configuration. Product and engineering teams identify storage and access; privacy or legal reviewers assess consent and exceptions; marketing and analytics owners state the purpose; procurement records vendor behaviour and onward sharing.

Evidence should show what fires before and after each choice, the exact notice and controls shown, the consent or exception relied on for each purpose, objection and withdrawal behaviour, retention, recipients, contracts, UK GDPR lawful basis where personal data is involved, and the date and result of the last technical test.