Cookie Consent
The requirement under the Privacy and Electronic Communications Regulations 2003 (PECR) to tell users about cookies and obtain their freely given, specific and informed consent before storing or accessing non-essential cookies on their device.
Independent editorial summary — not the official statute text. Read the official version on legislation.gov.uk.
The rules on cookies are set out in regulation 6 of PECR, enforced by the Information Commissioner's Office. You must tell people if you set cookies, and clearly explain what the cookies do and why; you must also get the user's consent, and a cookie is a small text file that is downloaded onto 'terminal equipment' (eg a computer or smartphone) when the user accesses a website. The same requirement extends beyond cookies to any similar technology used to store or access information on a device, such as local shared objects or app-based tracking, though there is an exemption for cookies strictly necessary to deliver a service the user has requested, such as a shopping basket or online banking security.
To be valid, consent must be freely given, specific and informed, involving a clear positive action such as ticking a box, and organisations cannot set non-essential cookies on your website's homepage before the user has consented to them. Continuing to browse a site is not sufficient to demonstrate consent, and organisations must give users an easy way to accept or reject non-essential cookies and to change their choice later. Because PECR applies even where cookie data is anonymised, most UK websites display a cookie banner or consent management tool on first visit, and any site that also processes personal data through cookies must separately comply with the UK GDPR.
Official sources
This explanation is drawn from the official sources below; every substantive statement is verified against them. For advice on a specific matter, see our find help page.