The Data (Use and Access) Act 2025 (“DUAA”), which received Royal Assent at the end of June reforms certain parts of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), including providing for fines for non-compliance to be raised in line with the GDPR.
The DUAA increases maximum fines under PECR from £500,000 to £17.5 million or 4% of annual global turnover, a substantial increase, making it clear that the Information Commissioner’s Office (ICO) is cracking down on cookie non-compliance.
Companies must now also notify the ICO of PECR breaches (where personal data is accidentally lost, corrupted or disclosed) within 72 hours of becoming aware of the breach – again an alignment with the GDPR. Every breach must be reported, no matter how serious it is.
The ICO has previously made it clear they are actively reviewing websites, looking for non-compliance, and are in the process of developing an AI solution to assist in their efforts. We therefore urge businesses to ensure their practices are aligned with PECR and the DUAA.
Here is a reminder of what cookies are and how to make your use of them compliant…
What is a cookie?
A cookie is a small text file implanted by an online provider on the device of visitors to its website. Cookies collect information about internet users, such as their names, contact details, passwords and user preferences.
You may use/come across the following types of cookies:
- Strictly necessary cookies: those required to operate a website;
- Analytical/performance cookies: those that allow a website to recognise and count its visitors and their movement within the site, such as Google Analytics;
- Functionality cookies: those that recognise users and remember their preferences when they return to a website; and
- Targeting cookies: those that record a user’s visit to a website, its specific pages and links followed.
When can you use cookies?
Cookies may only be used on a website if the site user has been provided with clear and comprehensive information about the cookie’s existence and reason for use and has given his or her consent to the use.
The exception to the rule is where the cookie is strictly necessary for the operation of the website (note that a cookie that is helpful or convenient but not essential is not strictly necessary). The DUAA also exempts certain non-essential cookies from the consent requirements, including where the cookie is used to collect statistical data to improve services, functionality and personalization cookies (for repeat website visitors), or cookies used for emergency assistance.
How do you obtain valid consent?
Prior consent (via an unambiguous positive action) can be obtained, where required, in the following ways:
- Via a pop-up window, header bar or static information banner flagging the site’s use of cookies immediately when the user first lands on the site. Consent to such use is sought at that point.
- This should include a link to the site’s cookie or privacy policy where information including the types of cookies used, the purpose for which they are used, whether the information obtained is shared with third parties and how consent is withdrawn, should be provided.
- A tick box (not pre-ticked) could be used for acceptance of the cookie, or a clickable “accept” option may be utilised. This must also work well when viewed on a mobile device as well as on a desktop.
- A website user must be able to reject non-essential cookies as easily as they can accept them, meaning the simple options of “Accept” or “Reject” are likely to comply but options of “Accept” or “Manage Preferences”, without the “Reject” option, as we see so often on websites, will not suffice.
- You must additionally be able to demonstrate that you have obtained valid consent and maintain a record of this.
It is important to bear in mind that these rules apply to all cookies, whether the cookie processes personal data relating to individuals or not.
Please get in touch if you would like assistance in bringing your data protection compliance up to date.
Madeleine Rhodes email: Mrhodes@redfernlegal.com
