Compliance Radar · Privacy and consent
UK Data (Use and Access) Act adds cookie consent exceptions and raises PECR fines
The UK eased consent for some analytics cookies and raised fines to GDPR levels.
- Status
- In force
- Takes effect
- Exceptions and new fines: February 5, 2026. Complaint duties: June 19, 2026. ICO guidance: April 29, 2026.
- Announced
- Jun 19, 2025 (Royal Assent)
- Type
- law
What changed
Analytics that only improve your own site no longer need consent if users can easily object. Ads and most tracking still need opt-in. Fines reach £17.5 million or 4% of turnover.
Who it affects
Any organization that sets cookies or similar technologies on UK users' devices.
What to do
- Keep ads and cross-site tracking behind opt-in.
- Tell users about consent-free analytics and let them object.
- Serve UK-specific banner rules.
What ComplyMo already handles
Page audits and daily re-checks: Growth and up. Everything else: every plan, from $19 a month.
Sources
- Data (Use and Access) Act 2025 (c. 18) (opens in a new tab)
- Data (Use and Access) Act: Commencement No. 6 (2026) (opens in a new tab)
- ICO: storage and access technologies guidance (opens in a new tab)
Summary of public sources, not legal advice.