What Are the UK GDPR Cookie Consent Requirements?
Everything you need to know about UK GDPR cookie consent compliance in 2026. Complete guide covering opt-in consent requirements, cookie banner elements, consent records, and technical implementation for United Kingdom.
Summary
This guide provides comprehensive technical implementation requirements for UK (UK GDPR + PECR). PECR governs cookies; UK GDPR governs personal data.
This jurisdiction requires an opt-in consent model (prior consent), meaning websites must obtain explicit user consent before placing non-essential cookies or similar tracking technologies. Users must actively accept cookies through clear consent mechanisms.
Additional requirements for this jurisdiction include: providing consent banners and privacy information in all required languages, and special protections and consent mechanisms for children's personal data.
Website owners and operators subject to these regulations must implement compliant cookie consent banners, maintain proper consent records, and ensure their tracking technologies respect user privacy choices. This guide outlines all technical requirements needed to achieve compliance.
Key Requirements Overview
Technical Requirements
Required Banner Elements
First Layer (Cookie Banner)
- Concise Purpose Summary
- Accept All Button
- Reject All Button Or Link
- Manage Preferences Button
- Link Privacy Policy
Second Layer (Preferences Modal)
- Granular Purpose Toggles
- Vendor List If Applicable
- Retention Periods If Known
Implementation Guidance
The Data (Use and Access) Act 2025 cookie changes took effect on February 5, 2026 (new PECR Schedule A1). Storage used for statistical purposes (first-party analytics to improve your site) and for remembering appearance or functionality choices no longer needs consent, provided users get clear information and a simple, free way to object — for example a toggle that is on by default — and objections are honored. Analytics data may only be shared with a third party helping you improve the service; the exemption does not cover advertising measurement, sharing conversions with ad partners, or profiling. Security and fraud-prevention storage counts as strictly necessary. Advertising, cross-site tracking, and other non-essential cookies still require prior opt-in consent. The ICO's final storage and access technologies guidance (April 2026) requires a "Reject All" option as prominent and easy to use as "Accept All", granular choices by purpose, third parties named on the first layer or a clearly signposted second layer, and withdrawal as easy as giving consent. It sets no fixed consent lifespan but recommends waiting about six months before asking again after a refusal. PECR fines now match UK GDPR levels: up to £17.5M or 4% of global turnover for infringements on or after February 5, 2026.
Special Protections
Children's Privacy
Age Appropriate Design Code (Children's Code) requires heightened protections for services likely to be accessed by children. No behavioral advertising cookies without clear necessity. Parental consent required for under-13. High privacy settings by default for child users.
Sensitive Data
Consent or other lawful basis as applicable
Record Keeping Requirements
Required Consent Record Fields
For each consent action, you must maintain records containing:
- Timestamp ISO
- User Choices By Purpose
- Policy Version
- Jurisdiction Detected
CookieChimp handles all of this automatically. Our platform maintains comprehensive consent records including all required fields, timestamps, consent strings, IP addresses, user agents, and more. Records are securely stored and easily exportable for compliance audits. Learn more about our consent management
Exempt Cookie Types
The following types of cookies are typically exempt from consent requirements:
Legal References & Resources
Official legal documents and regulatory guidance for this jurisdiction:
Frequently Asked Questions About UK GDPR Cookie Consent
UK (UK GDPR + PECR) is a privacy regulation applicable in United Kingdom. PECR governs cookies; UK GDPR governs personal data. It requires websites to obtain explicit user consent before placing non-essential cookies (opt-in model).
Yes. Under UK GDPR, websites must display a cookie consent banner that includes: concise purpose summary, accept all button, reject all button or link, manage preferences button, and more. The banner must be shown before any non-essential cookies are set.
UK GDPR follows an opt-in consent model. This means websites must obtain explicit user consent BEFORE placing any non-essential cookies or tracking technologies.
UK GDPR does not set a fixed lifespan for cookie consent. As best practice, ask visitors for consent again at least every 6 months, and sooner if you add new purposes or vendors. Regulators also recommend waiting about 6 months before asking again after a visitor refuses.
Age Appropriate Design Code (Children's Code) requires heightened protections for services likely to be accessed by children. No behavioral advertising cookies without clear necessity. Parental consent required for under-13. High privacy settings by default for child users.
UK GDPR requires maintaining consent records that include: timestamp iso, user choices by purpose, policy version, jurisdiction detected. No fixed retention period is set in law; keeping records for at least 18 months is recommended so you can demonstrate consent if challenged.
Legal Disclaimer
For engineering implementation guidance only. Not legal advice. This guide provides technical implementation guidance only and should not be considered legal advice. Privacy laws are complex and frequently updated. We recommend consulting with qualified legal counsel to ensure full compliance with applicable regulations.
Found an issue or have feedback on this page?
Explore Other Jurisdictions
View All
EU (GDPR + ePrivacy Directive Art. 5(3))
EU/EEA
ePrivacy governs cookies; GDPR governs personal data.
Switzerland (FADP + TCA)
Switzerland
Hybrid model: some cookies allowed under legitimate interest; profiling/marketing require consent. Opt-out always required.
Netherlands (Telecommunicatiewet + GDPR)
Netherlands
The Dutch Telecommunications Act (Telecommunicatiewet) Art. 11.7a implements the EU ePrivacy Directive. Consent required before placing non-essential cookies. GDPR applies in parallel for personal data processing. Enforced by Autoriteit Persoonsgegevens (Dutch DPA) and ACM.