Cookie Compliance & PECR — Are Your Cookies Actually Legal? Most Websites Get This Wrong

Cookie compliance is one of the most widely misunderstood areas of data protection law, and the number of websites that are genuinely PECR-compliant — as opposed to having a cookie banner that looks compliant — is far smaller than most organisations realise. The Privacy and Electronic Communications Regulations 2003 require informed, specific, and freely given consent before any non-essential cookies are set, and the ICO has been increasingly active in enforcing this requirement against organisations of all sizes. I advise businesses on achieving genuine PECR compliance, including a full audit of their cookie landscape and the implementation of a properly functioning consent management platform. The first step in any cookie compliance exercise is a technical audit — identifying every cookie and tracker set by the website, categorising them as strictly necessary, functional, analytical, or marketing, and mapping each to the third-party services that use them. Most organisations are surprised by how many cookies their website sets, particularly through embedded third-party content, advertising networks, and marketing platforms that add their own trackers invisibly. I work with your development team to ensure that the cookie audit is comprehensive and that non-essential cookies are genuinely not set until consent is obtained. Beyond the cookie banner itself, I advise on the consent mechanism in detail: whether the banner design is PECR-compliant (pre-ticked boxes are not sufficient; "accept" and "reject" must be equally prominent), whether the consent records are being stored correctly for audit purposes, and whether the website handles consent withdrawal properly. I also advise on the interaction between PECR consent for analytics cookies and the lawful basis required under the UK GDPR for the same processing activity, which affects the terms of your privacy notice. How It Works 1. Technical cookie audit of your website conducted 2. Cookie categories mapped and non-essential cookies identified 3. Consent mechanism design reviewed against ICO guidance 4. Cookie policy and privacy notice updated to reflect findings 5. Consent Management Platform configuration reviewed What You Get - Full cookie audit identifying all trackers and categorising by type - Consent mechanism PECR compliance review - Cookie policy drafted or updated - CMP configuration guidance and consent record advice FAQ Q: Does Google Analytics require consent under PECR? A: Yes — analytics cookies that track individual behaviour across sessions require PECR consent. Consent-mode configurations do not exempt you from the consent requirement. Q: Can I use legitimate interests as the basis for analytics cookies? A: No — PECR requires consent for non-essential cookies regardless of the UK GDPR lawful basis. Legitimate interests is not an alternative to consent for cookies. Q: What is the ICO's enforcement approach to cookie compliance? A: The ICO investigates complaints from individuals and conducts own-initiative sweeps of high-traffic websites. Fines have been issued for persistent non-compliance after warning.