Which Cookies Need Consent Under the UK PECR

How the UK PECR Decides Which Cookies Need Consent

Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR) requires consent before a site stores or reads a cookie on the device of a visitor. The UK GDPR sets the standard for that consent. The UK data protection regulator, the ICO, enforces PECR and publishes the guidance on storage and access technologies.

The Data (Use and Access) Act 2025 amended PECR and moved the exceptions to Schedule A1, which took effect on 5 February 2026. PECR covers cookies, local storage, tracking pixels, and every other technology that stores or reads information on the device, according to the ICO.

Which Cookies Need No Consent Under PECR

PECR holds 5 exceptions to the consent rule, according to the ICO: communication, strictly necessary, statistical purposes, appearance, and emergency assistance. The communication exception covers technology without which the transmission is impossible. The strictly necessary exception covers technology essential to a service the visitor requests, judged from the point of view of the visitor.

The statistical purposes exception covers cookies used only to collect aggregate statistics that improve the site, with a third party allowed to help only with that improvement. The appearance exception covers cookies used only to adapt the appearance or functionality of the site to a preference of the visitor. The exception excludes content personalised on known or inferred interests.

Both exceptions need clear information for visitors and a simple means of objecting, free of charge, according to the ICO. Stop storing or reading the information once a visitor objects, and treat no browser setting alone as proof that a visitor has not objected.

What Valid Consent Looks Like Under the UK GDPR

Article 4(11) of the UK GDPR defines consent as a freely given, specific, informed, and unambiguous indication of the wishes of the visitor, given by a clear affirmative action. A pre-ticked box, a banner that sets advertising cookies before the visitor answers, or a banner without a way to refuse gives no valid consent.

The ICO wrote to the operators of popular UK websites in November 2023 and asked them to make refusing cookies as easy as accepting cookies. Give your consent banner a reject button on its first layer, next to the accept button.

Cookie Categories Under the UK PECR

The table gives the rule of the UK PECR for each cookie category of the Cookie Consent cookie database. The page of each cookie adds the conditions that change the answer for a single tool.

The table describes what the UK PECR requires and is not legal advice. Whether the UK PECR applies to your site depends on where your visitors are, where your business is based, and how you set up each tool.

Cookies in the Database and Their Rule Under the UK PECR

The database gives the rule of the UK PECR for 19 cookies. Open a cookie to read the reason and the setup that changes the answer.