The Privacy and Electronic Communications Regulations 2003 (PECR) were rewritten in 2025 and 2026, and many UK cookie banners, marketing journeys and telecoms breach procedures still follow the old rules. PECR (SI 2003/2426) is the UK's implementation of the EU ePrivacy Directive and sits alongside the UK GDPR. It governs storage and access technologies such as cookies and pixels, electronic and telephone marketing, traffic and location data, and the security of public communications services, including personal data breach reporting by service providers. The Data (Use and Access) Act 2025 (DUAA) added new cookie exceptions, a charity soft opt-in, a 72-hour breach deadline and UK GDPR-scale penalties. This guide covers scope, obligations, status as of October 2026, enforcement and automated senders. It is for security leaders, privacy engineers, marketing operations and telecoms compliance teams.
Key takeaways
- PECR is a separate law from the UK GDPR. It applies whether or not personal data is involved for cookies and device access, and it applies to marketing messages to individuals and to some business contacts. The UK GDPR still governs the processing that follows.
- The cookie rule now has a schedule of exceptions. Regulation 6 and Schedule A1, in force since 5 February 2026, keep consent as the default but allow statistics and appearance or functionality cookies without consent if users get clear information and a simple, free way to object.
- Service provider breaches go to the regulator within 72 hours. Since 20 August 2025, regulation 5A requires notice without undue delay and, where feasible, within 72 hours, with reasons if late. Every personal data breach counts, there is no risk threshold for the regulator notice.
- Fines are no longer capped at £500,000. The DUAA applies the Data Protection Act 2018 penalty regime to PECR, which has a higher maximum of £17.5 million or 4% of worldwide turnover.
- You are liable for what you instigate. PECR catches the organisation that instigates a message or a tag, so marketing platforms, affiliates, tag managers and AI agents that send or track on your behalf are your compliance problem.
Scope: who and what is covered
PECR has four parts that touch different organisations. Most organisations are caught by the storage and access rules and the marketing rules; telecoms and internet providers are also caught by the security, traffic data and breach rules. For the wider UK regime, including lawful basis and data subject rights, see the UK GDPR and Data Protection Act 2018 Guide.
| Area | Regulations | Who is covered | What it governs |
|---|---|---|---|
| Security of services and breaches | 5, 5A, 5B, 5C | Providers of public electronic communications services (telecoms operators, ISPs), with network providers on request | Technical and organisational security measures, subscriber risk warnings, breach notification, breach inventory, audits |
| Storage and access technologies | 6, 6A, Schedule A1 | Anyone who stores or accesses information on a user's device, including websites and apps, wherever established, when targeting UK users | Cookies, local storage, SDKs, pixels, device fingerprinting and information automatically emitted by the device |
| Traffic, location and billing data | 7, 8, 9, 14 | Communications providers | Erasure or anonymisation of traffic data, consent for value-added services, itemised billing, location data |
| Marketing | 19 to 24, 26 | Anyone sending or instigating direct marketing by automated call, fax, live call, email, SMS or similar electronic mail | Consent and soft opt-in, screening against preference registers, sender identification, opt-out |
- Any device counts: regulation 6(2) extends the rule to instigating storage or access and to collecting information automatically emitted by the device.
- Individuals versus corporate subscribers: the email and SMS consent rule in regulation 22 protects individual subscribers. The ICO confirms that sole traders and some partnerships are treated as individuals, so their addresses need consent or a soft opt-in even in B2B campaigns.
- Calls and communications widened: the ICO's DUAA summary states that a "call" now includes an attempt to connect and that texts and emails that were sent but not necessarily received are in scope. Failed robocall attempts and undelivered campaign sends can now count.
- Solicited and service messages: most marketing rules apply only to unsolicited messages, and routine service messages are not marketing unless they carry significant promotional content.
Key obligations
Security of public communications services (regulation 5)
Regulation 5(1) requires a provider of a public electronic communications service to take appropriate technical and organisational measures to safeguard the security of the service. Regulation 5(1A) sets a minimum: personal data is accessible only to authorised staff for legally authorised purposes, stored or transmitted personal data is protected against accidental or unlawful destruction, loss, alteration and unauthorised access or disclosure, and a security policy for processing personal data is implemented. Where a significant risk remains, regulation 5(3) requires the provider to tell subscribers about the risk, what they can do about it and the likely cost, free of charge. For wider telecoms duties, see the UK Telecommunications Security Act Guide and the Telecom Network Security Guide.
Personal data breach notification (regulation 5A)
| Duty | PECR regulation 5A | UK GDPR Article 33 and 34, for comparison |
|---|---|---|
| Who | Public electronic communications service providers | All controllers |
| Threshold for regulator notice | Every personal data breach | Unless unlikely to result in a risk to individuals |
| Deadline | Without undue delay and, where feasible, not later than 72 hours after becoming aware (24 hours before 20 August 2025) | Without undue delay and, where feasible, within 72 hours |
| Late notice | Reasons for the delay must accompany the notice (5A(3A)) | Reasons for the delay |
| Individuals | Notify subscribers or users without undue delay if the breach is likely to adversely affect their personal data or privacy | Notify data subjects where high risk |
| Encryption exception | No subscriber notice if the provider shows the regulator the data was rendered unintelligible by measures applied to it (5A(6)) | Similar, Article 34(3)(a) |
| Records | Inventory of all breaches with facts, effects and remedial action (5A(8)); the ICO asks for the log monthly | Internal record of all breaches (Article 33(5)) |
| Sanction for not notifying | £1,000 fixed monetary penalty, per ICO guidance; Schedule 1 excludes regulation 5A from ordinary penalty notices | Administrative fine up to the standard maximum |
The ICO's online form asks for the breach and detection times, the type of breach and the data involved. For a joint GDPR and US view of notification clocks, see the Data Breach Notification Checklist.
Storage and access technologies (regulation 6 and Schedule A1)
Regulation 6(1) says a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user, subject to Schedule A1. The exceptions are:
| Schedule A1 paragraph | Purpose | Conditions | Typical examples |
|---|---|---|---|
| 2: Consent | Any purpose | Clear and comprehensive information and consent; consent can be signalled through browser settings or another application | Advertising, cross-site tracking, social media pixels |
| 3: Transmission | Sole purpose of transmitting a communication | None stated | Load balancing cookies |
| 4: Strictly necessary | Providing a service the user requested | None stated; listed examples include protecting information, terminal security, preventing or detecting fraud or technical faults, automatic authentication and recording selections | Session cookies, CSRF tokens, bot and fraud detection, shopping baskets |
| 5: Statistics | Collecting statistics on use of the service to improve it | Clear information, a simple free means to object, the user has not objected; sharing only to help make the improvements; does not cover information automatically emitted by the device | First-party analytics |
| 6: Appearance or functionality | Adapting the website to user preferences or enhancing appearance or functionality | Clear information, a simple free means to object, the user has not objected | Language, theme, accessibility preferences |
| 7: Emergency assistance | Locating a user who requests or needs emergency help | Sole purpose of determining geographical position | Emergency location services |
The statistics and appearance exceptions are opt-out, not consent-free: the objection route must exist before the cookie is set and must be honoured. "Website" in Schedule A1 includes apps. Banner design, CMP configuration and Global Privacy Control are covered in the Consent Management Guide: Cookies, CMPs and GPC; this guide does not repeat them.
Electronic and telephone marketing (regulations 19 to 24)
- Email and SMS to individuals (reg 22): prior consent is required unless the commercial soft opt-in in 22(3) applies (details obtained during a sale or negotiation, marketing of your own similar products and services, a simple free refusal offered at collection and in every message), or the charity soft opt-in in 22(3A) applies from 5 February 2026 (details obtained when the person expressed interest in or supported the charity's purposes, marketing solely to further those purposes, refusal at collection and in every message).
- Identity and opt-out (reg 23): marketing email must not disguise or conceal the sender and must give a valid address for opt-out requests.
- Live calls (reg 21): screen against the Telephone Preference Service and Corporate TPS registers and your own suppression list, identify yourself and present a number.
- Automated calls (reg 19): need specific prior consent to receive automated marketing calls.
- Consent quality: the ICO requires consent to be knowingly and freely given, clear and specific, naming your organisation and the channel, with a positive action. Pre-ticked boxes are not valid.
Email authentication (SPF, DKIM, DMARC) is not a PECR requirement, but it is the practical control against spoofed campaigns sent in your name; see the DMARC, SPF and DKIM Guide. For US marketing law, see the CAN-SPAM and TCPA Guide.
Timeline and current status
The DUAA received Royal Assent on 19 June 2025 and was commenced by regulations. The dates below are those shown in the legislation.gov.uk amendment notes for each PECR provision, checked on 25 October 2026. The ICO's own Guide to PECR states that the guidance is under review following the DUAA, so check for updated ICO guidance before relying on older examples.
| Date | Change | Source provision | Status |
|---|---|---|---|
| 11 December 2003 | PECR in force, replacing the 1999 telecoms regulations | SI 2003/2426 | In force |
| 26 May 2011 | Cookie consent rule and service provider breach notification (regs 5A to 5C) added | SI 2011/1208 | In force, since amended |
| 20 August 2025 | Breach notice moves from 24 hours to 72 hours where feasible, with reasons for delay | DUAA s.111, SI 2025/904 | In force |
| 5 February 2026 | New regulation 6 and Schedule A1 exceptions; charity soft opt-in; regulation 31 and Schedule 1 substituted, applying DPA 2018 enforcement and penalties | DUAA ss.112 to 115, Schedules 12 and 13, SI 2026/82 | In force |
| 19 June 2026 | ICO confirms all data protection provisions of the DUAA are in force | ICO DUAA guidance | Confirmed |
| 30 September 2026 | References to the Commissioner replaced by the Information Commission | SI 2026/386, SI 2026/1015 | In force |
Watch for approved PECR codes of conduct, which the regulator must now encourage and which can evidence compliance. EU cookie rules have not relaxed, so organisations serving both UK and EU users still need consent under the ePrivacy Directive Guide rules for EU traffic.
Enforcement and penalties
The Information Commission (formerly the ICO) enforces PECR. Since 5 February 2026, regulation 31 and Schedule 1 apply Parts 5 to 7 of the Data Protection Act 2018 to PECR, including information notices, assessment notices, enforcement notices and penalty notices under sections 155 to 159.
| Tool | What it does | Notes for PECR |
|---|---|---|
| Penalty notice | Monetary penalty for failing to comply with listed regulations (5, 6, 7, 8, 14, 19 to 24) | The previous £500,000 cap has gone; Mayer Brown's analysis of the DUAA reads the new maximum as aligned with UK GDPR at £17.5 million or 4% of worldwide annual turnover. DPA 2018 s.157 defines the higher maximum (£17.5 million or 4%) and standard maximum (£8.7 million or 2%) |
| Fixed monetary penalty | Fixed sum for failing to notify a service provider breach | £1,000 per ICO guidance; amount can be varied by regulations |
| Officer liability | Penalties on directors and officers for marketing failures under regs 19 to 24 committed with their consent, connivance or neglect | Targets phoenix companies in nuisance call and spam cases |
| Enforcement notice | Requires steps to be taken or processing to stop | Commonly used for cookie and marketing non-compliance |
| Information, assessment and interview notices | Compel information, allow audits and compel interviews | Failure to comply attracts the higher maximum; regulation 5B also allows audits of service provider breach compliance |
Check the consolidated Schedule 1 text and current regulator penalty guidance before quoting a maximum for a specific PECR failure.
What it means for AI agents and non-human identities
PECR is technology-neutral, and it attaches liability to the person who sends or instigates. That matters when software, not staff, does the sending and the tracking.
- AI marketing and outreach agents: an agent that drafts and sends sales emails or texts is sending electronic mail for direct marketing. It must check consent or soft opt-in status and the suppression list before every send, include a valid opt-out address, and never disguise the sender.
- Voice agents and automated calls: a synthetic voice agent that delivers recorded or generated marketing content may be treated as an automated calling system under regulation 19, which needs specific prior consent. Live call rules, including TPS screening, apply where a person is on the call. Take advice on your specific design before launch.
- Sending credentials are marketing credentials: API keys for email and SMS platforms are machine identities. If stolen, attackers send spam or phishing in your name, which is both a security incident and potential PECR exposure. The TruffleNet campaign abused stolen AWS keys to send mail through Amazon SES, and the Gravity SMTP exposure handed email API keys to scanners. Store them in a vault, scope them to one sending domain, and rotate them. See the Secrets Management Guide.
- Service provider operations: telecoms automation accounts and integrations that reach subscriber, traffic or location data fall under regulation 5(1A). Inventory and log them: a misused integration is a notifiable breach.
Compliance steps
- Map your exposure. Record which PECR parts apply to each website, app, marketing channel and communications service, and which also serve EU users.
- Inventory storage and access technologies. Scan every site and app build for cookies, local storage, SDK calls, pixels and fingerprinting scripts. Assign each a Schedule A1 paragraph. Anything without a clear paragraph 3, 4, 5, 6 or 7 basis needs consent.
- Implement the opt-out exceptions properly. For statistics and appearance cookies, publish clear information, provide a simple free objection control that works before the first tag fires, and test that objecting stops the storage. Keep EU users on consent.
- Rebuild the marketing permission model. Store, per contact and channel, the basis (consent, commercial soft opt-in, charity soft opt-in), source, timestamp and wording. Enforce suppression and TPS screening in the sending platform, not in spreadsheets.
- Update breach procedures for service providers. Move the PECR clock to 72 hours, train the incident team on the "every breach" threshold, prepare the ICO form fields in the runbook, and keep the breach inventory ready for monthly submission.
- Test before go-live. Scan a staging property in objection mode, send marketing changes to a seeded list, and tabletop a breach against the 72-hour clock.
- Plan rollback. Keep the previous CMP configuration and tag rules so you can revert to full consent within a day if a new exception is challenged or new ICO guidance narrows it.
Decision guidance
- Use the statistics exception when: analytics are first party, used only to improve your own service, and any processor shares data only to help you make those improvements. Use consent when the analytics vendor reuses data for its own purposes or for advertising.
- Small versus large: small organisations need a tag inventory, a working objection control and a clean suppression list; large organisations and providers add change control on tags and automated scanning.
Detection and measurement
- Unclassified tags: number of storage or access technologies found by scans with no Schedule A1 basis (target zero).
- Pre-choice firing: percentage of page loads where a non-exempt tag fires before consent or after an objection (target zero).
- Suppression integrity: marketing messages sent to suppressed or TPS-registered contacts per campaign (target zero).
- Breach timeliness: median hours from awareness to ICO notice for service provider breaches, against the 72-hour limit.
- Sending key hygiene: share of email and SMS API keys vaulted with an owner.
Framework mapping
| PECR duty | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Know your obligations | GV.OC-03 | PT-2 | 5.31, 5.34 |
| Cookie consent and information | GV.OC-03 | PT-4, PT-5 | 5.34 |
| Security of services (reg 5) | PR.DS-01, PR.DS-02 | SC-8, SC-13 | 8.24 |
| Breach notification and inventory (reg 5A) | RS.CO-02, RS.CO-03 | IR-6 | 5.24, 5.26 |
| Tag and data inventory | ID.AM-07 | SA-9 | 5.9 |
Practitioner checklist
- Confirm which PECR parts apply to each legal entity, website, app and marketing channel.
- Scan every property and app build and map each storage or access technology to a Schedule A1 paragraph.
- Make the statistics and appearance objection control work before any tag fires, and test it.
- Keep consent for advertising and cross-site tracking, and for all EU users.
- Record the marketing basis per contact and channel, including the new charity soft opt-in where relevant.
- Enforce suppression, TPS and opt-out in every sending system, including AI agents and third parties.
- Vault, scope and rotate email and SMS sending keys, and alert on unusual sending volumes.
- For service providers, move the breach clock to 72 hours and keep the inventory ready for monthly submission.
Standards and references
- legislation.gov.uk: The Privacy and Electronic Communications (EC Directive) Regulations 2003
- legislation.gov.uk: PECR Schedule A1, Exceptions to regulation 6
- legislation.gov.uk: PECR regulation 5A, Personal data breach
- legislation.gov.uk: Data Protection Act 2018 section 157, Maximum amount of penalty
- ICO: The Data (Use and Access) Act 2025, summary of changes, privacy and electronic communications
- ICO: Guide to PECR, security breaches
- ICO: Guide to PECR, electronic and telephone marketing
- Mayer Brown: The Data (Use and Access) Act, PECR reform
Related NHI Mgmt Group resources: UK GDPR and Data Protection Act 2018 Guide · Consent Management Guide: Cookies, CMPs and GPC · ePrivacy Directive Guide · CAN-SPAM and TCPA Guide · Email Security Guide. This guide summarises the Privacy and Electronic Communications Regulations 2003 as amended by the Data (Use and Access) Act 2025 and is not legal advice.