Glossary · Privacy & compliance
What is PECR (the UK cookie law)?
PECR, the Privacy and Electronic Communications Regulations 2003, is the UK law that implements the ePrivacy Directive's rules on cookies and similar technologies, electronic marketing and communications security, enforced by the Information Commissioner's Office (ICO).
Also called: Privacy and Electronic Communications Regulations, UK cookie law
Updated
What PECR requires for cookies
Regulation 6 requires clear information and consent before storing or accessing information on a user's device, unless an exception applies. The Data (Use and Access) Act 2025 added new exceptions that took effect on February 5, 2026 — including one for analytics.
The statistical-purposes exception
- Applies when the sole purpose is collecting information about how your website or service is used, so you can improve it.
- You must give users clear information about it and a simple, free way to object (opt out).
- It's about *how* a service is used, not *who* is using it — it doesn't cover tracking or profiling individuals, or sharing data for advertising.
- Advertising and cross-site tracking cookies still need consent.
PECR fines
Maximum PECR fine (since February 2026) = the higher of £17.5 million or 4% of worldwide annual turnover
Previously the cap was £500,000. The increase aligns PECR penalties with UK GDPR. The ICO published its final updated guidance on storage and access technologies in 2026; check it for the current interpretation.
Example
A UK SaaS uses first-party analytics only to see which pages people read and where sign-ups drop off, with an opt-out link in its privacy notice. Since February 2026 that can fall under the statistical exception without a consent banner. The same site adding a retargeting pixel still needs consent for that pixel. This is general information, not legal advice.
PECR and VisitTrack
VisitTrack is first-party analytics: no third-party cookies, no advertising use, no cross-site profiles. In cookieless mode it stores nothing on the device at all, which avoids the device-storage question entirely; hybrid mode treats UK visitors as cookieless. If you use standard mode in the UK under the statistical exception, give visitors a simple opt-out: the per-browser ?vt_ignore=1 switch described in script configuration can serve as an opt-out link, or load the script conditionally.
Frequently asked questions
Do UK websites still need cookie consent for analytics?
Not always, since February 5, 2026. Analytics used only to understand and improve how a website is used can rely on PECR's statistical exception if users get clear information and a simple way to opt out. Advertising cookies still need consent.
How does PECR differ from the EU ePrivacy Directive?
PECR started as the UK's implementation of the ePrivacy Directive. Since 2026 it diverges: the UK has a statistical-purposes exception with an opt-out and GDPR-level fines, while the EU still generally requires consent for analytics cookies.
Related terms
- ePrivacy DirectiveThe ePrivacy Directive (Directive 2002/58/EC, amended in 2009) is the EU law on privacy in electronic communications whose Article 5(3) requires consent before storing information on, or reading it from, a user's device — which is why it's called the "cookie law."
- GDPRGDPR, the General Data Protection Regulation (Regulation (EU) 2016/679), is the European Union law that governs how personal data about people in the EU is collected, used and stored, in force since May 25, 2018.
- Consent bannerA consent banner, or cookie banner, is the notice a website shows to ask visitors for permission before storing or reading non-essential cookies and similar identifiers on their device, and to record their choice.
- Cookieless trackingCookieless tracking is web analytics that counts visitors without storing any identifier on the visitor's device — no cookies, localStorage or similar — typically by deriving a short-lived anonymous id on the server instead.
- First-party vs third-party cookiesA first-party cookie is set by the website you are visiting, under its own domain; a third-party cookie is set by a different domain embedded in that page — such as an ad network or social widget — and can follow you across every site that embeds it.
Tools and guides
See which channels actually bring paying customers
VisitTrack is cookie-free analytics with revenue attribution built in. One script tag, no consent banner, live in two minutes. 14 days free, no card required.