The UK’s data privacy framework is no longer a static set of rules inherited from EU membership. With the Data (Use and Access) Act 2025 receiving Royal Assent on 19 June 2025 and most of its data-protection changes taking effect on 5 February 2026, marketers operating in the UK face amended obligations layered on top of UK GDPR and the Privacy and Electronic Communications Regulations (PECR).
The adjustments are not a wholesale replacement of the existing regime, but they alter specific mechanics around cookies, penalties and data handling that feed directly into campaign planning.
Read also: Green marketing in the UK: Embracing sustainability in advertising strategies.
Data (Use and Access) Act 2025: what changed for digital marketers
Most competitor guides still frame UK compliance as a matter of following UK GDPR consent rules and adding a cookie banner. That framing misses the legislative shift that landed in February 2026.
The Act introduced a narrow exemption allowing certain analytics and appearance-related cookies to operate without prior consent, provided the organisation offers clear information and a simple, free way for users to object. This is not a blanket exemption for marketing measurement. Individual tracking, profiling and advertising-related cookies remain firmly outside the described statistical exception.
Read also: Marketing strategies in the UK: How big brands win the game
For marketing teams, the practical question is whether their analytics stack qualifies. A tool that aggregates page-view counts across a site with no cross-site tracking or user-level profiling sits closer to the exemption than a platform that builds audience segments for retargeting. The distinction matters because misclassifying a cookie could trigger enforcement under the updated PECR penalty regime.
PECR penalties after the 2026 amendments
Before the Act, PECR fines were capped at a level that many large businesses could absorb without material consequence. The amended rules raised the maximum to £17.5 million or 4% of worldwide annual turnover, whichever is higher, aligning PECR with the UK GDPR penalty ceiling.
This changes the risk calculus for email marketing, SMS campaigns and cookie deployments. A mid-size e-commerce brand running non-compliant cookie walls or pre-ticked email opt-ins now faces the same theoretical exposure as a company breaching core data-protection principles. The maximum penalty is not the likely penalty in any individual case, but its existence shifts internal conversations about compliance budgets.
Consent mechanics and UK GDPR legal bases for marketing
UK GDPR provides six legal bases for processing personal data. Marketers overwhelmingly rely on two: consent and legitimate interest. Choosing the wrong one does not just create a compliance gap; it shapes the entire customer journey.
- Consent requires an affirmative, unambiguous opt-in before any processing begins. Pre-ticked boxes, bundled consent and inactivity do not qualify. For email marketing under PECR, this means a clear, separate tick confirming the subscriber wants to receive commercial messages.
- Legitimate interest allows processing without explicit consent where the organisation can demonstrate a genuine need, show the processing is necessary for that purpose, and balance it against the individual’s rights. A B2B company emailing a prospect who downloaded a whitepaper may rely on legitimate interest, but the assessment must be documented and defensible.
- Soft opt-in, a PECR-specific mechanism, permits electronic marketing to existing customers who provided their details during a sale or negotiation, as long as each message offers a straightforward way to opt out. This applies only to similar products or services and only where the contact details were collected directly.
Getting these bases right determines whether a remarketing list, a newsletter database or a lead-generation form operates lawfully. Auditing each data-collection touchpoint against the correct legal basis is a more productive exercise than layering consent pop-ups across every page.
Cookie consent after the analytics exemption: where the line sits
The February 2026 cookie changes created a two-tier system that marketers need to map onto their actual technology stack, not just their consent banner settings.
Tier one covers cookies that fall within the new exemption: purely statistical measurement with no individual-level profiling and no data sharing with third-party advertising networks. If a cookie meets those conditions, the site must still inform users and provide an objection mechanism, but prior consent is no longer required for qualifying analytics cookies.
Tier two covers everything else: advertising pixels, retargeting tags, cross-site tracking scripts, personalisation engines that build individual profiles. These still require informed, freely given consent before deployment. Consent management platforms need reconfiguring to reflect the split, and the categorisation must be accurate. A cookie labelled “analytics” in a consent tool but used downstream for audience building would not qualify for the exemption.
Practical steps for reconfiguring consent tools
Marketing teams should start by exporting a full cookie audit from their consent management platform and cross-referencing each cookie’s actual data flow. The question is not what the cookie is called, but what happens to the data it collects. Any cookie whose data feeds into a platform that enables ad targeting, lookalike audiences or individual-level behavioural profiles belongs in the consent-required tier.
This audit also surfaces dormant tags, legacy pixels from past campaigns that still fire on every page load. Removing these reduces both compliance risk and page-load overhead.
Email marketing compliance under PECR and UK GDPR together
Email remains one of the highest-return channels for UK businesses, and it sits at the intersection of two regulatory instruments. UK GDPR governs how personal data (the email address) is collected and stored. PECR governs whether and how electronic marketing messages can be sent.
A compliant email programme needs both layers addressed. Collecting an address with valid UK GDPR consent but sending marketing emails without meeting PECR’s requirements (or vice versa) leaves the programme exposed. PECR and UK GDPR obligations operate in parallel, not as alternatives.
The soft opt-in under PECR offers a workable route for existing customer communications, but it requires discipline. The product or service being marketed must be similar to what the customer originally purchased. A fashion retailer emailing a past buyer about a new clothing line fits; the same retailer emailing that customer about an unrelated financial product does not.
Data storage and retention for marketing databases
UK GDPR’s storage limitation principle requires that personal data is kept only as long as necessary for the purpose it was collected. For marketing databases, this means inactive subscribers should be reviewed and removed on a defined schedule. Holding a contact list for years without engagement is difficult to justify under the principle, and it inflates costs on email platforms that charge by list size.
Setting automated suppression rules (for example, removing contacts with no opens or clicks over a defined period) serves both compliance and deliverability. Internet service providers penalise senders with high bounce and low-engagement rates, so pruning aligns legal and commercial interests.
Where gaps remain in the current framework
The Data (Use and Access) Act 2025 addressed specific pain points, but it left several areas without detailed guidance. The boundary between qualifying statistical cookies and non-qualifying marketing analytics is defined by conditions rather than a prescriptive list of approved tools. The Information Commissioner’s Office has not yet published tool-specific guidance, which means marketers are making classification decisions based on their own interpretation of the conditions.
Similarly, the interaction between the cookie exemption and emerging measurement approaches (server-side tagging, privacy-sandboxed APIs, aggregated conversion reporting) is not explicitly addressed. Whether server-side analytics that collect IP addresses but discard them before storage qualify for the exemption is a question that current published guidance does not resolve.
UK data privacy law has moved beyond a single regulation. Marketers who treat compliance as a one-off banner configuration rather than an ongoing audit of data flows, legal bases and retention schedules will find the gap between their practices and the law widening with each legislative update.
