PECR: Privacy and Electronic Communications Regulations (United Kingdom)
What PECR covers, and what it means for your website analytics
Official name: Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). In force since 11 December 2003, they set UK rules on cookies, electronic marketing and the privacy of communications.
See all privacy lawsAt a glance
The UK's cookie and marketing rules
PECR works alongside the UK GDPR. For websites, the key rule is Regulation 6: you need consent to store or access information on a visitor's device, unless it's strictly necessary.
The Data (Use and Access) Act 2025 updated PECR. It added new exceptions, including for some analytics, as long as visitors are told and can object, and it raised the maximum fines to UK GDPR levels.
Who it covers
Organizations using cookies on websites, or sending electronic marketing, in the UK
What it means for websites
Non-essential cookies need consent, unless one of the new exceptions applies
Who enforces it
The Information Commissioner's Office (ICO)
Maximum fines
Up to £17.5 million or 4% of global annual turnover, whichever is higher
Further reading
Everything you need on this law
PECR
The current text of the UK’s 2003 Regulations, including Regulation 6 on cookies and device access.
Read the official textICO guidance on cookies
The UK regulator’s 2026 guidance on cookies, pixels and similar tech, and when consent is needed.
Read the ICO guidanceData (Use and Access) Act 2025
The 2025 law that updated PECR, including new exceptions to cookie consent.
Read the official textThe ePrivacy Directive
The EU directive PECR was based on, which still sets the cookie rules across the EU.
Read our ePrivacy guideThe Data Protection Act 2018
The UK’s main data protection law, which works with PECR to cover what happens to personal data once it’s collected.
Read our DPA guideMore privacy laws
Guides to 14 more laws, from the GDPR to the CCPA, and what each one asks of your website.
See all privacy lawsTWIPLA and PECR
UK analytics without a cookie banner
PECR's cookie rule mirrors the EU's ePrivacy Directive, so the same reasoning applies: in Maximum Privacy Mode, TWIPLA neither stores nor reads anything on the visitor's device.
- Nothing is stored on the visitor's device, and nothing is read from it
- No fingerprinting, in a mode that's on by default
- Visitors who decline your banner for other tools can still be counted with our second tracking code
PECR covers access to the device, and the UK GDPR covers the data afterward, which TWIPLA processes on the basis of legitimate interest. Our data is hosted in Germany, and the UK recognizes the EU as offering adequate protection, so no extra transfer safeguards are needed.
Proof, not promises
How TWIPLA meets PECR
Cookieless tracking
How all four privacy modes measure your visitors without setting a single cookie.
See how it worksDual setup options
Already running a cookie banner for other tools? Count the visitors who decline it too.
Compare the optionsConsentless analytics, explained
The legal reasoning for banner-free analytics under the EU cookie rule that PECR brought into UK law.
Read the legal caseVirgin Atlantic
How the UK airline counts visitors who reject cookies too, and now records four times more visitors.
Read the success storyLegal disclaimer
Helpful guidance, not legal advice
This page explains the law in general terms. Laws change, and how they apply depends on your business, your visitors and how you configure TWIPLA.
Unless another mode is named, statements about compliance refer to Maximum Privacy Mode, our default setting. For advice on your situation, please consult a qualified legal professional.
Questions about how TWIPLA fits this law? Email our team at consentless@twipla.com.
