PECR and cookie consent: a plain-English guide for UK businesses

The Privacy and Electronic Communications Regulations 2003 (PECR) sit alongside UK GDPR and govern cookies, marketing emails, and marketing calls. If you operate a website or send electronic communications in the UK, PECR applies.

What PECR Covers

Four main areas: cookies and similar technologies, unsolicited marketing by email and SMS, marketing telephone calls (including the TPS), and traffic and location data.

The Cookie Consent Rules

PECR requires you to tell users what cookies your site uses, explain what they do, and get consent before setting non-essential cookies. Strictly necessary cookies do not require consent. Everything else does: analytics, preference, and marketing cookies all need affirmative consent.

Banners that only say “By continuing to use this site you accept cookies” are not compliant. See CM Beyer Cookie Policy for a compliant implementation.

Email Marketing Under PECR

Consent required for unsolicited marketing emails, with one exception: the soft opt-in. If someone has bought from you or actively enquired, you can email about similar services — provided you offered opt-out at collection and in every subsequent email.

ICO Enforcement Priorities for 2026

Cookie compliance (sites setting cookies before consent), unsolicited marketing, and personal data use in AI and automated decision-making.

Frequently Asked Questions

Is PECR the same as GDPR?

No. PECR is separate legislation that adds specific rules for electronic communications on top of GDPR.

Can I use Google Analytics without consent?

Generally no. Google Analytics sets non-essential cookies that require consent under PECR.