Cookie Consent Requirements (GDPR, PECR, and the 2026 UK Change)
ConsentProof is a cookie consent checker that scans any website with a real browser and records which cookies and third-party trackers fire before the visitor consents.
The rule, in one paragraph
Storing or reading information on a visitor's device requires their consent unless it is strictly necessary to provide the service they asked for. In the EU that comes from the ePrivacy Directive as implemented in each member state, with the GDPR supplying the standard of consent. In the UK it comes from PECR, alongside the UK GDPR.
Two words do the work: prior and choice. Consent has to be obtained before the storage happens, and refusing has to be as easy as accepting. Most enforcement in this area turns on one of those two points, not on the wording of a policy.
What changed for the UK in 2026
The Data (Use and Access) Act 2025 raised the maximum PECR penalty from £500,000 to the GDPR-level ceiling of £17.5 million or 4% of global turnover, with the relevant provisions taking effect on 5 February 2026.
That is a change in exposure rather than in the underlying rule: what was already required did not become more required, but the consequence of getting it wrong is now roughly thirty-five times larger.
The ICO had already been sampling at scale. In January 2025 it announced it was using automated detection to review cookie compliance across the UK's top 1,000 websites, and published its findings and follow-up correspondence.
Where sites actually fail
Rarely at the banner. The three recurring failures are: non-essential tags firing on page load before any interaction; a reject path that is harder than the accept path; and a consent choice that the tags never receive because they were added outside the consent-aware tag manager.
All three are visible from outside the site. Loading a page in a clean session and recording what happens before you touch anything answers the first and third directly, and a screenshot answers the second.
Frequently asked
- Do I need consent for analytics cookies?
- In the EU and UK, yes, unless the analytics genuinely fall within the strictly necessary exemption, which mainstream third-party analytics generally do not. Some regulators have published narrow conditions for exempt audience measurement; check your own regulator's guidance rather than assuming.
- How large can a UK cookie fine be in 2026?
- Up to £17.5 million or 4% of global annual turnover, following the Data (Use and Access) Act 2025 provisions that took effect on 5 February 2026. The previous PECR maximum was £500,000.
- Is an implied-consent banner still acceptable?
- No. Consent must be an affirmative action. A banner announcing that continued browsing implies consent has not obtained consent, and it also means the tags underneath it were almost certainly firing on load.
Related
Try ConsentProof
Free public scan, no account needed.