ICO Storage and Access Guidance 2026: PECR Cookie Rules

Classify each technology by what it does, not its cookie category, since one script can serve exempt and non-exempt purposes.
Block consent-based activity until opt-in.
Give qualifying statistical and appearance uses a working objection control.
Test it all in a real browser, remembering that the UK GDPR applies wherever personal data is processed.

Which Technologies Are Covered?

PECR regulation 6 covers information stored on, or read from, terminal equipment: phones, computers and connected devices. Whether that information is personal data doesn’t matter. Your review should take in:

First- and third-party cookies that store or retrieve device information.
Web and local storage in the browser or on the device.
Tracking pixels measuring visits, interactions or conversions.
Link decoration and navigational tracking, where URL identifiers or other methods follow visits across pages or services.
Device fingerprinting, which tells devices apart using characteristics such as browser settings.
Scripts and tags that initiate storage or access, third-party code included.

Third-party integrations and certain information that devices emit automatically can fall within PECR too, so add embedded widgets, server-set identifiers and vendor code to the inventory.

PECR can also apply when your website causes a third party to store or access information on a visitor’s device. Being First-party earns a first-party identifier no exemption. And a tag manager may load an essential function and a non-exempt advertising pixel side by side.

A Cookie Scanner report is a place to start, not finish. No scan reveals every storage or access operation, so check what scripts and network requests actually do.

When Does PECR Require Consent?

Consent has to be in place before the tracker runs, not merely before the banner disappears: PECR regulation 6, read with Schedule A1, requires prior consent for any storage or access without an applicable exception. Your controls must:

Ask for freely given, specific, informed and unambiguous agreement through a positive action.
Explain the purposes and identify relevant third parties.
Offer choices by purpose, with refusal as easy as acceptance.
Stop non-exempt cookies, pixels, tags and scripts from operating before agreement.
Record consent and make withdrawal just as easy, so further non-exempt access stops.

Pre-ticked boxes, scrolling, silence and continued browsing are not affirmative consent, and visitors need each purpose explained before they decide. The ICO’s good-practice example places equally prominent accept all and reject all buttons alongside detailed choices.

Withdrawal affects more than future tracking. You must address technologies already stored on the visitor’s device, stop consent-dependent processing, inform relevant third parties and meet applicable UK GDPR erasure requirements. New purposes or parties may call for updated disclosures and fresh consent.

Which PECR Exceptions Allow Storage or Access Without Consent?

Schedule A1 sets out five conditional exceptions. Each turns on purpose, not technology:

Communication exception. Access solely to transmit communications over a network. Indispensable load-balancing session cookies may qualify.
Strictly necessary exception. The shopping basket is the classic example, alongside essential login, fraud prevention, fault resolution and necessary selections. Necessity is judged from the visitor’s side, not by business convenience. Storage or access needed to meet another legal obligation may also qualify, but only where it is the sole reasonable and proportionate way to comply.
Statistical purposes exception. Access solely to collect usage statistics with a view to improving your service, shared only with parties helping with those improvements. Visitors must be informed and offered a simple, free way to object; once someone objects, the exception stops applying to the relevant operations.
Appearance exception. Can cover language settings or responsive layouts, provided the access serves solely that appearance or functionality purpose. Clear information and a simple, free objection are required, and advertising profiling is excluded.
Emergency assistance exception. Location access solely to help someone in an emergency after an appropriate request or indication, as in vehicle emergency-call or personal safety systems.

How do these exceptions apply to common website technologies?

Technology or use	Likely PECR treatment	What to check
Shopping basket session cookie	May be strictly necessary	Does checkout need it, without unrelated tracking?
Language-preference cookie	May qualify for the appearance exception	Limited purpose? Persistence beyond the session? Information and objection controls?
Aggregate website analytics	May qualify for the statistical exception	Solely for service improvement, with permitted sharing and effective objection?
Meta Pixel for remarketing	Consent for non-exempt advertising access	Does it stay blocked before consent and after withdrawal?
Analytics identifier also creating ad audiences	Consent for the combined operation	Can statistical and advertising activities be separated technically?

These are purpose-based assessments, not product exemptions. The ICO says settings-based preferences, such as a language cookie, need consent if they serve additional purposes or persist beyond the current session.

What Does a “Simple Means of Objecting” Require?

Qualifying statistical and appearance access doesn’t need opt-in. It does need to be visible: visitors must understand it and be able to object simply and without charge. PECR prescribes no design, and the ICO says you could use an existing consent interface. The visitor must be able to:

See which statistical or appearance activity is running.
Object, and have the related storage or access stop.
Change their mind later; withdrawing an objection lets the exempt activity resume.
Rely on the technology to enforce the preference, not just the interface to save it.

That one interface carries two different defaults. Advertising and other consent-required controls must start off until the visitor opts in. Qualifying statistical or appearance controls may start on, but only where every exception condition is met and switching them off is straightforward.

Then check that an objection sticks. If statistics resume on the next page, the control has failed. Keep a labelled preferences link and honour choices across pages and return visits. Browser settings alone don’t establish that someone hasn’t objected.

Can One Cookie or Script Have Several Purposes?

Picture an analytics identifier that measures site use and also builds remarketing audiences. The measurement alone might have qualified for the statistical exception, but the statistical and appearance exceptions both carry a sole-purpose condition, so the combined storage or access needs consent.

Mixed purposes aren’t always a problem. A session cookie that maintains a login and protects authentication may be strictly necessary on both counts. Where an exception demands a sole purpose, though, there are two routes:

Obtain consent for the combined operation.
Separate the identifiers, triggers or data flows so qualifying statistics run without advertising access.

Either way, check the live vendor configuration. Switching off an advertising option in a dashboard doesn’t necessarily stop the collection underneath.

What Does This Mean for Website Analytics?

An “analytics” label proves nothing; the information must be collected solely to improve your website or service, with every condition met. Examples include:

Aggregate visitor counts and page views.
Scrolling and page engagement measurements used to improve content.
Loading-time and performance statistics.
Broad device data, where it helps compatibility.
Certain tests of alternative page designs or functions, such as A/B tests.

The exception cannot support:

Profiling identifiable visitors or following them across websites.
Advertising attribution or building behavioural audiences.
Keeping individual-level information once aggregation no longer needs it.
Decisions about identifiable visitors based on the statistics.
Collecting or monitoring automatically emitted device information; Wi-Fi probe requests are one example.

Be wary of the dashboard. Aggregated figures may conceal individual-level collection, so look at what is collected, shared and retained. A third-party provider helping with improvements cannot combine your data with other datasets or reuse it for profiling or advertising, and where personal data is involved, the ICO says the provider must be a processor, not a joint controller. Read the provider’s agreement and confirm that individual records are aggregated, then deleted when no longer needed.

What Does the Guidance Mean for Online Advertising?

Showing an advert doesn’t have to involve device access. Once access serves advertising, though, PECR requires consent, and advertising revenue doesn’t make that tracking strictly necessary:

Behavioural advertising picks personalised adverts from profiles or inferred interests.
Contextual advertising works from the page someone is reading and can involve less personal-data processing. Any device storage or access for advertising still requires consent.
Advertising measurement closely tied to an advertising purpose already covered by valid consent may fall under that consent, provided the purpose was properly explained.
New or unrelated profiling needs its own assessment, and additional consent where required.

Depending on configuration, the same conversion tag can measure outcomes, remarket or build audiences, so check which functions are active, what triggers it, what it shares with vendors and how it handles withdrawal. Frequency capping that stores or accesses device information for advertising also requires consent.

Compulsory cookie walls usually undermine freely given consent. Consent-or-pay isn’t automatically prohibited, but needs an assessment of genuine choice, fees, equivalence and presentation under the ICO’s consent-or-pay guidance, which remains under review.

The ICO’s 18 May 2026 advice on possible lower-risk advertising exceptions discussed potential reforms but did not change the existing PECR consent rules.

How Do PECR and the UK GDPR Work Together?

PECR applies whether or not the information is personal data; the UK GDPR comes in once personal data is processed. A tracker handling personal data therefore faces two separate tests:

PECR: is the storage or access permitted, by consent or an exception?
UK GDPR: is the processing that follows lawful?

Passing one doesn’t settle the other. Legitimate interests can’t stand in for consent that PECR requires, and where PECR consent is needed and personal data is involved, the ICO says you should generally rely on consent as the UK GDPR lawful basis too, rather than switching to legitimate interests once consent proves invalid.

In reverse, a PECR exception still leaves you needing a UK GDPR lawful basis and compliance with transparency, minimisation, security, retention and individual rights. And PECR consent never authorises undisclosed profiling or indefinite retention.

What Should You Review on Your Website?

Catalogue cookies, pixels, scripts, local storage, embedded tools, server-set identifiers and network calls.
For each, note its provider, purpose, information collected, lifetime and any sharing with third parties.
Decide which PECR exception, if any, fits each storage or access purpose, and record where consent is required.
Hold consent-required activities until opt-in. Give qualifying statistical or appearance uses a simple, free objection mechanism.
Split exempt uses from advertising or other non-exempt uses, or require consent before the combined operation starts.
Check what happens before a choice and after acceptance, rejection, objection or withdrawal.
Correct cookie and privacy notices, vendor details, consent records and retention settings.
Recheck after changing campaigns, plugins, scripts or tag-manager triggers. Document the result and schedule rescans.

Record the outcome for each technology: provider, purpose, PECR classification, control, storage duration, enforcement, result, reviewer, date and corrective actions.

How Can You Test Whether Tracking Is Actually Blocked?

Use a fresh browser profile, so nothing stored skews the result. Open Chrome DevTools’ Network panel before the page loads and switch on Preserve log to capture requests fired while the banner is showing. Use the Application panel to inspect cookies and local storage, then examine relevant request payloads and Set-Cookie headers.

Then run four checks:

Before any choice: nothing non-exempt should have been stored or accessed yet.
After rejection: non-exempt operations stay inactive.
After acceptance: look for anything running outside the purposes the visitor agreed to.
After withdrawal or objection: subsequent relevant activity should stop. Also examine stored identifiers and whether relevant vendors receive the withdrawal.

Run them on more than one page, after a refresh and on a return visit, and in other browsers or devices where relevant. Saved preferences should hold throughout.

A request in the Network panel doesn’t, on its own, prove unlawful access. Nor does a missing cookie prove that tracking has stopped: local storage, fingerprinting and server-side integrations need checking too. When something unexpected turns up, trace it to the script, tag-manager trigger or vendor behind it.

How Can a CMP Help Implement These Rules?

A Consent Management Platform (CMP) can help turn the ICO's requirements into working website controls. This includes obtaining consent before non-exempt tracking, managing visitor preferences, recording consent decisions and controlling scripts that store or access device information.

Features particularly relevant to the updated PECR requirements include:

Cookie Scanner: identifies cookies and related technologies, helping you build and maintain the inventory needed to assess each storage or access purpose.
User consents recording: records visitors' consent choices and supports documentation of the decisions they have made.
Third-party cookie blocking: helps prevent non-exempt third-party technologies from operating before the required consent is obtained.
Geo targeting: allows different banner configurations to be displayed according to visitors' locations. Location detection alone does not establish their legal residency or which rules apply.

Most CMPs also offer these additoinal privacy-management features and resources:

Google Consent Mode v2 also requires particular attention. In Basic Consent Mode, Google tags remain blocked until consent. Advanced Consent Mode allows tags to load earlier and send cookieless pings while consent is denied.

As Google's documentation explains, the two implementations behave differently. A denied consent signal does not necessarily mean all requests have stopped, although a cookieless request does not automatically establish a PECR violation. You must assess the actual storage or access involved.

CookieScript is a CMP that Google includes among its partners available for Consent Mode setup. It is also a Google-certified CMP and received Gold tier status in Google's CMP tiering system.

A 14-day free trial of the Plus plan is available without requiring a credit card.

Privacy laws

Menu