UK cookie law for small businesses in 2026: PECR, the Data (Use and Access) Act and fines

In the UK, the Privacy and Electronic Communications Regulations (PECR) say you must get a visitor's consent before you store or read anything on their device, unless an exception applies. Since 5 February 2026, the Data (Use and Access) Act 2025 has added exceptions for low-risk analytics and site-preference cookies, as long as you tell people and let them object for free. It has also raised the maximum PECR fine from £500,000 to £17.5 million or 4% of worldwide turnover. Advertising and retargeting tags still need opt-in consent.

The short version for a small business

What PECR regulation 6 requires

PECR is the UK law that sits alongside UK GDPR for electronic communications. Regulation 6 is the cookie rule. Since 5 February 2026 its wording is short: subject to Schedule A1, a person must not store information on a user's device, or gain access to information stored there.

Three points in the new wording matter for small businesses:

• It is not just cookies. The rule covers any storage or access technology. That includes local storage, tracking pixels, SDKs in apps and device fingerprinting.
• "Instigating" counts. Regulation 6(2)(a) now says storing or accessing includes instigating the storage or access. If you add a third-party tag to your site and it sets cookies, you are responsible, not only the tag's provider.
• Information the device sends automatically can count. Regulation 6(2)(b) says gaining access includes collecting or monitoring information automatically emitted by the device, unless the regulations say otherwise. This is aimed at techniques such as fingerprinting.

Where consent is needed, it must meet the UK GDPR standard. That means it must be freely given, specific, informed and unambiguous, given by a clear positive action. Pre-ticked boxes, "by using this site you agree" notices and continuing to scroll are not valid consent.

What changed under the Data (Use and Access) Act 2025

The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025. Its changes came in over several stages. For cookies, the key date is 5 February 2026. On that date commencement regulations (SI 2026/82) brought in the new regulation 6, the new Schedule A1 exceptions and the higher PECR fines.

The exceptions in Schedule A1

Schedule A1 to PECR lists when you do not need consent. The ICO's guidance describes five exceptions to the rule:

1. Communication. Storage or access for the sole purpose of carrying out the transmission of a communication over a network.
2. Strictly necessary. Storage or access that is strictly necessary to provide a service the user has requested. Schedule A1 gives examples: protecting information the user provides, keeping the user's device secure, preventing or detecting fraud, preventing or detecting technical faults, logging the user in automatically, and remembering selections the user makes on a website (such as a basket).
3. Statistical purposes. New. Analytics about how your service is used, to improve it. Conditions below.
4. Appearance and functionality. New. Adapting how your website looks or works to the user's preferences, or otherwise enhancing its appearance or functionality. Conditions below.
5. Emergency assistance. New. Finding a device's location when the user asks for emergency help.

The statistical purposes exception: every condition must be met

Paragraph 5 of Schedule A1 lets you run analytics without consent only if all of these are true:

• You provide an information society service, which in practice includes most business websites and apps.
• The sole purpose is to collect statistics about how your service or website is used, with a view to improving it.
• The information is not shared with anyone else, except to let them help you improve your service or website.
• The visitor gets clear and comprehensive information about the purpose.
• The visitor is given a simple means of objecting, free of charge, and does not object.

The ICO's guidance adds detail that rules out many common setups:

• A third-party analytics provider can be used, but it must act as your processor, not a joint controller. It must only help you with your purpose and must not link the data with other information it holds.
• You must only use the data to improve your service. Any secondary use, such as linking activity to an advert, needs consent.
• The ICO states the exception "does not apply to purposes related to online advertising". It also does not let you monitor or track individual visitors. Ad measurement and frequency capping need consent.
• You must not rely only on browser settings to decide that someone does not object. One way to offer the objection is a setting that is on by default and that the visitor can switch off at any time. If they switch it off, you must stop.

The appearance and functionality exception

Paragraph 6 covers storage or access whose sole purpose is to make your website appear or work in line with a visitor's preferences, or to otherwise enhance its appearance or functionality. Examples are remembering a chosen language, text size, dark mode or the region a visitor picked. As with analytics, you must give clear and comprehensive information and a simple, free way to object.

Higher fines

Before 5 February 2026, the maximum PECR fine was £500,000. The ICO now says the Act lets it issue fines of up to £17.5 million or 4% of global turnover under PECR. That is the same as the higher UK GDPR maximum. The new level applies to breaches from 5 February 2026 onwards. The ICO's Data Protection Act 2018 enforcement powers, such as information and assessment notices, now also apply to PECR, with modifications.

A large fine for a small local business is unlikely. The ICO's public enforcement has focused on high-traffic sites. But the risk is not only fines. Complaints, enforcement notices and, for businesses that use Google or Microsoft tools, those providers' own consent policies all apply.

The ICO's guidance on storage and access technologies

The ICO published its final Guidance on the use of storage and access technologies on 29 April 2026, after two consultations. It replaces the older cookie guidance and reflects the DUAA changes. Key features:

• It covers cookies, tracking pixels, device fingerprinting and similar technologies, under PECR and, where relevant, UK GDPR.
• It uses "must", "should" and "could" to separate legal requirements from good practice.
• It has a new chapter on the five exceptions and a mostly new chapter on online advertising.
• The ICO says its review of regulation 6 for online advertising is separate work. In December 2025 it said it was working with stakeholders and the government on whether publishers could offer privacy-friendly advertising, where risk is low, to people who have not consented. Any such change would need a change in the law. As at November 2026, advertising cookies still need consent.

What the ICO has done about cookies

The ICO's recent cookie work has targeted the UK's busiest websites. In January 2025 it announced it would assess the top 1,000 UK websites. On 4 December 2025 it reported that:

• 979 of the top 1,000 sites met its compliance checks at their most recent test, and 21 still failed.
• 415 passed without intervention. 564 improved after first failing, following ICO contact.
• It escalated from letters to investigations and, in 17 cases, preliminary enforcement notices.

The ICO tested three things: whether non-essential advertising cookies were stored before visitors could accept or reject them; whether rejecting was as easy as accepting; and whether advertising cookies were placed without consent. These are the same three failures you should test for on your own site. Our 10-minute cookie banner test shows how.

In April 2026 the ICO said 99% of the UK's top 1,000 websites met its compliance standards for cookie banners, and that it would keep testing. The ICO has not published the list of sites tested. We have not found a published ICO fine under the new PECR cap for cookies as at 3 November 2026. Check the ICO enforcement page for the latest.

If you have EU visitors: the ePrivacy Directive and GDPR

If you sell to or monitor people in the EU, EU rules apply to those visitors as well as UK rules. The EU equivalent of regulation 6 is Article 5(3) of the ePrivacy Directive (2002/58/EC). Each EU country implements it in its own law, and national regulators enforce it.

The EU's highest court ruled in Planet49 (case C-673/17, 2019) that a pre-ticked checkbox is not valid consent for cookies. The European Commission proposed changes to EU cookie rules in November 2025 as part of its "Digital Omnibus" package. As at November 2026 those proposals were still being negotiated and were not law. Do not rely on them yet.

The practical result: a UK site with meaningful EU traffic usually keeps a consent banner that covers analytics too, at least for EU visitors. Some consent tools can apply different rules by visitor country.

A practical checklist for your website

1. List every tag and cookie. Open your site in a private browser window and check what loads (see our step-by-step test). Also list tags added through Google Tag Manager, plugins, themes, chat widgets, booking tools and embedded videos or maps.
2. Sort each one into a purpose. Strictly necessary, statistics, appearance and functionality, or advertising and everything else.
3. Check analytics against all five statistical conditions. If your analytics is linked to an ad platform, used for audiences or shared for the provider's own purposes, treat it as needing consent.
4. Block advertising tags until consent. Nothing advertising-related should load, set cookies or send hits before the visitor clicks Accept.
5. Make Reject as easy as Accept. Put "Reject all" on the first layer, with the same prominence as "Accept all". No pre-ticked boxes.
6. Respect a rejection. After Reject, no advertising cookies and no advertising requests, on this page or the next.
7. Offer the objection for exempt analytics and preferences. A clear toggle in your cookie settings or privacy page that works and is free.
8. Update your cookie and privacy information. Say what each technology does, who provides it and how long it lasts, in plain words.
9. Let people change their mind. A persistent "Cookie settings" link in the footer is the usual way.
10. Re-test after every change. A new plugin, theme update or marketing tag can break a compliant setup. The SiteVerdict Chrome extension and WordPress plugin can flag tags that fire before consent or after Reject.

Common mistakes we see described in guidance and enforcement

• A banner that only says "OK" or "Accept". With no real choice, there is no valid consent.
• "Reject" hidden in a second layer while "Accept all" is one click.
• Tags hard-coded in the theme as well as in the consent tool, so they fire whatever the visitor chooses.
• Assuming the new analytics exception covers everything called "analytics". It does not cover advertising, individual tracking or data shared for a provider's own purposes.
• Forgetting EU visitors, who are not covered by the UK exceptions.
• Treating Google Consent Mode as a banner. It is a way for Google tags to read the choice your banner records. It does not ask for consent itself.

Related guides

• How to check if your cookie banner is compliant: a 10-minute test
• Website accessibility law for small businesses
• "Not secure" warning: what it means and how to fix it
• SPF, DKIM and DMARC for small businesses