UK cookie compliance is governed by the Privacy and Electronic Communications Regulations 2003 (PECR) — updated since Brexit — alongside UK GDPR. The legal framework is separate from EU ePrivacy rules but reaches similar practical conclusions. For companies serving UK users, cookie compliance is one of the most visible and most enforced aspects of data protection law.
The Legal Framework: PECR + UK GDPR
UK cookie law operates on two levels:
PECR (Privacy and Electronic Communications Regulations): Sets the rule on accessing or storing information on users' devices. Regulation 6 requires prior consent before setting non-essential cookies.
UK GDPR: Governs the processing of personal data collected through cookies. Where cookie data is personal (most analytics and tracking cookies create personal data), UK GDPR obligations also apply — lawful basis, privacy notice disclosure, retention limits.
Together, these mean: you need PECR consent to set non-essential cookies, and a UK GDPR lawful basis for processing the data they collect.
Which Cookies Need Consent?
Strictly necessary cookies — no consent required
Examples:
- Session cookies (maintaining login state)
- Shopping cart cookies
- Security cookies (CSRF protection, fraud prevention)
- Load balancing cookies
- User interface customisation cookies that the user set explicitly
These are essential to the service the user has requested. You can set them without consent.
Non-essential cookies — consent required
Examples:
- Analytics cookies (Google Analytics, Mixpanel, Amplitude)
- Marketing and advertising cookies (Google Ads conversion, Facebook Pixel, LinkedIn Insight Tag)
- Social media tracking pixels
- A/B testing cookies
- Personalisation cookies (not strictly necessary for the service)
- Third-party chat tools that set persistent cookies
All of these require prior, informed, freely given consent before being set.
What Makes Valid UK Cookie Consent
The ICO's guidance is clear and aligns with the EU approach on most points:
Prior consent: Cookies must not be set before the user has consented. No pre-loaded analytics that fires on page load.
Freely given: The option to reject cookies must be as easy as accepting them. A single "Accept all" button with no equivalent "Reject all" is not freely given consent. Cookie banners that make rejection burdensome — multiple clicks vs. one click to accept — are non-compliant.
Specific: Consent must be for specific categories of cookies, not a blanket "we use cookies" statement.
Informed: Users must know what they are consenting to — what cookies are set, for what purposes, by whom.
Unambiguous: Pre-ticked boxes are not valid consent. The user must take an active step to consent.
Withdrawable: Users must be able to withdraw consent as easily as they gave it. A clear "manage cookies" link in the site footer is the minimum.
The Cookie Banner in Practice
A compliant UK cookie banner:
- Appears before any non-essential cookies are set
- Offers at minimum: "Accept all" and "Reject all" (or equivalent)
- Does not use dark patterns — reject must be as prominent and easy as accept
- Allows granular choice (analytics vs marketing categories) — optional but best practice
- Records consent with timestamp and consent string for audit purposes
Non-compliant banners (common failures):
- "By using this site you agree to our cookie policy" — not valid consent
- An "Accept" button with no equivalent reject option
- Google Analytics loading on every page regardless of consent status
- Pre-ticked checkboxes for analytics or marketing cookies
- "I agree" text in the footer that counts as implied consent
Google Analytics and UK Cookie Compliance
Google Analytics sets third-party persistent cookies. It is not strictly necessary. It requires consent.
Implementation options:
- Consent management platform (CMP): Use a CMP (Cookiebot, CookieYes, OneTrust, Usercentrics) that blocks the GA script until consent is received. This is the most straightforward approach.
- Cookieless analytics: Consider privacy-preserving analytics (Plausible, Fathom, Simple Analytics) that do not set persistent cookies and do not require consent.
- GA4 with consent mode: Google's Consent Mode V2 adjusts GA4 behaviour based on consent signals. When configured correctly, GA4 does not set advertising cookies without consent. This requires proper CMP integration.
PECR and the DPDI Act
The Data Protection and Digital Information Act (DPDI Act) included changes to PECR. Key changes in effect:
Analytics cookies — modified consent requirements: Certain analytics cookies that meet specific criteria may be deployed under a "legitimate interest" basis rather than requiring consent — but this applies to a narrow category of analytics that are solely for improving the service for the user, not for cross-site tracking or advertising.
In practice: The practical cookie consent requirements for most websites have not changed significantly. Advertising, marketing, and cross-site tracking cookies still require consent. The DPDI changes primarily affect a narrow category of first-party analytics.
Cookie Policy Requirements
In addition to the banner, UK users should have access to a detailed cookie policy covering:
- A list of cookies set on the site
- For each cookie: name, purpose, duration, first-party or third-party, consent requirement
- How to manage or delete cookies (browser settings)
- How to withdraw consent