What is the UK Cookie Law?
The United Kingdom has two laws regulating the use of cookies: the Privacy and Electronic Communications Regulations (PECR), the UK Data Protection Act (DPA), and the UK GDPR.
The PECR regulates electronic communications. The UK DPA and the UK GDPR regulate data protection.
UK PECR: The UK Cookie Law Explained
The UK PECR (Privacy and Electronic Communications Regulations) is the law governing the use of personal data in electronic communications. Among other things, it regulates the use of cookies.
PECR covers the handling of marketing calls, emails, texts, and cookies. The use of cookies and similar technologies requires specific consent, unless they are strictly necessary for a service that the user has requested. To protect individual privacy, the UK GDPR enforces these regulations, which emphasize consent and privacy rights in electronic communication contexts.
Cookie Consent Requirements Under the UK PECR
Under the UK's Privacy and Electronic Communications Regulations (PECR), the requirements for cookie consent are quite specific. Organizations must:
- Inform users. Make sure to clearly explain the purpose and function of cookies. This information must be easily accessible and understandable.
- Obtain consent. Before placing any cookies on a user's device, we must obtain consent, except for those that are strictly necessary for the service the user has explicitly requested (e.g., cookie used to remember what's in a shopping cart).
- Ensure that consent is freely given. Consent must be a freely given choice, meaning users should be able to refuse non-essential cookies without detriment.
- Provide a clear opt-in. The method of obtaining consent must involve some form of clear affirmative action (e.g., ticking a box or clicking a button). Pre-ticked boxes, or any implied consent that interprets inaction as acceptance, are insufficient.
- Allow an easy withdrawal of consent. Users should be able to withdraw their consent as easily as they gave it. This means providing an accessible way to change their cookie settings at any time.
- Keep records of consent. In audits, organizations should keep records of consents as proof that they have complied with the PECR requirements.
The UK Data Protection Act and the Use of Cookies
The UK Data Protection Act of 2018 (UK DPA) was the first UK effort to align with the EU data protection law.
Any online service that sets cookies must obtain explicit consent before doing so. The consent must be:
- Freely given
- Specific to each processing purpose
- Being informed means that you have to provide users with clear and comprehensive information about the use of cookies, usually through a privacy policy or a cookie policy.
- Unambihuous, meaning the user shall take action to grant valid consent
- The user should have the ability to easily withdraw their consent, typically through the cookie preferences center.
Businesses must obtain valid consent before setting non-essential cookies, but they are free to use tags that are essential for the website's functionality. You do not need consent for such cookies to comply with the law.
The UK GDPR and the Use of Cookies and Similar Technologies
The UK GDPR (General Data Protection Regulation) is the UK's response to Brexit. Although the country had aligned its national legislation with the EU GDPR and the UK DPA, leaving the EU made it necessary to pass one more law that is the same as the EU General Data Protection Regulation.
It sets out principles for the lawful processing of personal data and grants individuals various rights concerning their data, such as the right to access, rectify, delete, and restrict the processing of their data. It also imposes strict obligations on organizations that process personal data, requiring them to ensure data security, transparency, and accountability. The Information Commissioner's Office (ICO) enforces the UK GDPR and has the authority to impose fines and sanctions for non-compliance.
One of the requirements for businesses is having a lawful basis for data processing, which leads to the requirement to obtain cookie consent for the use of cookies. Operating there means that you need to present users with a cookie banner and obtain consent.
