The UK left the EU.Your cookie rules did not get easier.
ConsentCenter applies UK rules to UK visitors: PECR for cookies and marketing, the UK GDPR for what consent means, with one record behind both.
- 01 Detect
- 02 Classify
- 03 Record
Click a provision to read what it says.
UK GDPR and EU GDPR read alike. They are not the same law.
And cookies sit in a third one.
In the UK, cookie consent is governed by PECR, consent quality by the UK GDPR, and the Data (Use and Access) Act 2025 has changed parts of both. A setup copied from an EU template may now ask for consent the UK no longer requires, or miss a change it does.
Where this goes wrong first.
One banner for the EU and the UK
The regimes have started to diverge. A single global rule set cannot reflect a UK exception that the EU does not have.
Analytics treated as all-or-nothing
The DUAA adds conditional exceptions for some low-risk purposes. Using them means knowing which tags qualify, and blocking the rest.
Marketing permission lives in the CRM only
PECR governs electronic marketing as well as cookies. A permission recorded in one system and not checked by the sender is not much of a permission.
What changes for you.
Apply UK-specific cookie rules to UK visitors, separate from the EU.
Keep cookie choices and marketing permissions in one auditable record.
Handle UK GDPR rights requests with a deadline and an owner.
How it works
Detect
Recognise UK visitors and apply the UK rule set, not the EU one.
Classify
Separate exempt purposes from those that still need consent.
Record
Keep cookie and marketing choices in one record you can produce for the ICO.
How the banner should look.
A ConsentCenter banner set up for the UK GDPR. Click it: accept, reject or open the preferences.
Allowed to run: Strictly Necessary
What it is doing
- Optional cookies stay off until the visitor accepts.
- “Reject All” is on the first layer, as easy as “Accept All”.
- Purposes exempted by the DUAA can be explained here instead of asked for.
- A link stays on the page afterwards to change or withdraw consent.
What the text actually says.
- PECR Regulation 6
- Storing or accessing information on a user’s device requires clear and comprehensive information and the user’s consent, unless an exception applies.
- Data (Use and Access) Act 2025
- Amends PECR to add exceptions to the cookie consent requirement for certain purposes, such as some statistical and appearance purposes, subject to conditions, and aligns PECR fines with UK GDPR levels.
- UK GDPR Article 7(3)
- The data subject may withdraw consent at any time, and withdrawing must be as easy as giving it.
- UK GDPR Article 83(5)
- Infringements of the basic principles, including conditions for consent, can attract fines of up to £17.5 million or 4% of worldwide annual turnover, whichever is higher.
Paraphrased for brevity and provided for orientation, not as legal advice. Which obligations apply to your organisation is a question for your own counsel, and ConsentCenter does not determine it for you.
Frequently asked questions
Possibly for some analytics, once the relevant DUAA provisions are in force and only if the conditions are met, such as clear information and an easy way to object. Third-party advertising tags are not covered. Check the current ICO guidance and commencement status before you change anything.
Not separate products, but separate rules. ConsentCenter is designed to apply rule sets by visitor region, so UK and EU visitors can be handled differently from one configuration.
No product can do that. ConsentCenter provides the consent, record and request machinery; what your obligations are is a question for your counsel.
Bring us your UK GDPR question.
Show us the consent question you cannot currently answer — the choice that did not propagate, the record you could not reproduce — and we will walk through exactly how ConsentCenter handles it.