UK Cookie Rules: PECR and the Data (Use and Access) Act 2025
The UK's PECR requires consent for affiliate cookies, and the 2025 DUAA raised the maximum fine to £17.5M or 4% of global turnover.
After Brexit, the United Kingdom retained a cookie-consent regime closely modeled on the EU’s, but with its own statute and its own regulator. Affiliates with UK traffic must follow the Privacy and Electronic Communications Regulations (PECR) as interpreted by the Information Commissioner’s Office (ICO), now updated by the Data (Use and Access) Act 2025.
PECR and UK GDPR
PECR Regulation 6 is the UK cookie rule: consent is required before setting non-essential cookies, with a narrowly construed “strictly necessary” exemption. The standard of consent is imported from the UK GDPR — the same freely given, specific, informed, unambiguous test as in the EU.
The ICO’s position
The ICO has been clear that analytics, advertising, and affiliate tracking cookies almost always need opt-in consent, that the strictly necessary exemption is narrow, and that “low-impact” analytics is not exempt. Banners must offer Accept and Reject with equal prominence, avoid pre-ticked boxes and cookie walls, provide granular controls, and log consent. The ICO published updated cookie guidance in 2025.
The Data (Use and Access) Act 2025
The DUAA is the UK’s 2025 data reform. Two points matter to affiliates:
- It narrowly expands the cookies that may be set without consent — certain low-risk first-party analytics and functional cookies for site improvement. Crucially, advertising, affiliate attribution, and cross-site tracking cookies still require consent.
- It raises the maximum PECR fine from £500,000 to the UK GDPR level: £17.5 million or 4% of global annual turnover, whichever is higher.
A large increase in exposure
The tenfold-plus increase in the maximum PECR penalty is the single most important recent change for UK-facing affiliates. Cookie compliance that was a modest risk is now backed by GDPR-scale fines.
Practical takeaway
If you serve UK visitors, treat affiliate cookies exactly as you would under EU rules: block until consent, offer a genuine reject option, log consent, and disclose the tracking in your privacy and cookie notices. See cookie consent management for implementation.
Authoritative sources
Last reviewed July 2026. This page is general educational information, not legal or tax advice.