What are PECR, and what do they require for UK website tracking?

PECR are the UK’s Privacy and Electronic Communications Regulations. They set rules for activities including electronic marketing and storing or accessing information on a person’s device.

The original regulations took effect on 11 December 2003 and have since been amended. Website operators must follow the current requirements, rather than relying only on the original text.

For cookies and similar technologies, consent is generally required unless the activity meets a specific exception. These include communications-related and strictly necessary uses, alongside conditional exceptions such as certain statistical-purpose activities.

The ICO’s current guidance on storage and access exceptions explains the conditions.

For example, the statistical-purpose exception is limited to improving the service using aggregate statistics. It requires clear information and a simple, free way to object. It does not cover advertising tracking, and individual-level information must not be retained beyond what is needed for aggregation.

A privacy-preserving analytics label does not establish eligibility. Website operators should assess the actual configuration and implement UK cookie consent controls wherever an exception does not apply.