Open workspace

Guide · British regulation

UK GDPR and cookies in the United Kingdom, without legalese

After Brexit, the United Kingdom ended up with its own privacy and cookie rules. In 2026 they changed again: exceptions to consent appeared, cookie fines went up and the regulator got a new name. This guide explains what applies today to a site with AdSense or Ad Manager that receives British visitors.

Audit my UK trafficRead the guide
  • ✓Based on British legislation and the regulator's official guidance
  • ✓Examples of sites with ads, including Brazilian ones
  • ✓Read-only scan, no changes to the site
£17.5Mceiling for the most serious UK GDPR fines
4%of annual worldwide turnover, when that amount is higher than the fixed ceiling
5exceptions to cookie consent provided in the 2026 official guidance
72 hdeadline to notify the regulator of a data breach that creates risk to people

What it is

Three rules that work together

When the United Kingdom left the European Union, it copied the European GDPR into its own legislation. This copy, in force since January 1, 2021, is called the UK GDPR. It works together with the Data Protection Act 2018, the British law that completes and adapts the text, and with PECR, the 2003 regulation that covers cookies, email marketing and electronic communications.

In practice, the UK GDPR defines what personal data is, when it can be used and what rights people have. PECR answers a more specific question: when a site can store or read information on the visitor's device. Cookies, pixels, browser local storage, device fingerprinting and tracking scripts all fall under this rule.

The law applies to companies established in the United Kingdom and also to companies abroad that offer goods or services to people in the country or that monitor their behavior. A Brazilian site that uses ad cookies to build profiles of British visitors is monitoring behavior, even without an office in London.

In 2025, the Data (Use and Access) Act 2025 changed all three rules. Most of the changes took effect on February 5, 2026. And on September 30, 2026, the ICO regulator gave way to the Information Commission, which took over the same functions and powers.

Checklist

What you need to meet

These are the points that the British regulator and Google require from a site with ads that receives visitors from the United Kingdom.

  1. Use a Google-certified CMP

    Since January 16, 2024, Google requires a certified CMP integrated with the IAB TCF to show personalized ads in the United Kingdom. Without one, that traffic can only receive non-personalized or limited ads.

    Example

    In Privacy & messaging, create the European regulations message, which covers the EEA, the United Kingdom and Switzerland.

  2. Ask for consent for every ad cookie

    The official guidance says online advertising has never been exempt from the consent requirement. Ad cookies and pixels can only be stored after valid consent.

    Example

    The remarketing pixel only loads after the click on Consent.

  3. Make refusing as easy as accepting

    The regulator expects refusing to take the same effort as accepting. Silence or no response does not count as consent.

    Example

    Consent and Do not consent appear together on the first screen, at the same size.

  4. Start with everything off

    Options for technologies that depend on consent must be off by default. Only the visitor's active choice can turn them on.

    Example

    On the preferences screen, the advertising and ad measurement buttons start in the off position.

  5. Say who the third parties are

    For consent to be valid, the site must say who the third parties receiving the data are.

    Example

    The banner has a link to the list of partners, with Google and every ad network on the site.

  6. Allow consent to be withdrawn at any time

    The law requires that visitors can withdraw consent whenever they want. Google's policy also asks for clear instructions for this.

    Example

    A fixed link in the footer, Privacy preferences, opens the banner again.

  7. Use the exceptions only with a notice and a simple way to refuse

    Statistics and appearance cookies may not need consent, but the site must explain the purpose and offer a simple, free way to refuse. These exceptions do not cover advertising.

    Example

    On the cookies page: we use statistics cookies to improve the site, and you can turn them off with this button.

  8. Check whether you need to pay the regulator's fee

    Organizations that use personal data must pay the data protection fee, unless they are exempt. Check the regulator's website to see if this applies to you.

In practice

Right and wrong

Official tools

Certified CMPs and official links

For personalized ads in the United Kingdom, Google requires a certified CMP, and these are the official pages to choose and set one up.

Definitions

The words that appear everywhere

These are the same concepts as the European GDPR, with a few new names brought by the 2025 reform.

Personal data

Any information linked to an identified or identifiable person. Online identifiers, such as cookies, advertising IDs and IP addresses, normally count as personal data.

Controller and processor

The controller decides why and how data is used, like the site owner. The processor handles the data on its behalf, like a hosting or email company.

Storage and access technologies

This is the name the regulator now uses for cookies and everything that plays the same role: pixels, web storage, fingerprinting and scripts that read data from the device.

Consent

A choice that is free, specific, informed and made with a clear action, such as clicking accept. Silence, pre-ticked boxes or continuing to browse do not count as consent.

Legal bases and consent

When you need to ask for permission

The UK GDPR requires a legal basis for each use of personal data. The most common are consent, performance of a contract, legal obligation and legitimate interests. The 2025 reform created a list of recognized legitimate interests, such as crime prevention and emergency situations, which do not need the balancing test. Advertising is not on that list.

For cookies, PECR is in charge. The general rule stays the same: storing or reading something on the visitor's device requires consent, unless the use fits an exception. The consent standard is that of the UK GDPR, and the regulator expects refusing to be as easy as accepting.

Since February 5, 2026 there are five exceptions: transmission of the communication, strictly necessary service, statistics to improve the service itself, appearance or functionality chosen by the user and emergency assistance. For the statistics and appearance exceptions, the site must give clear notice and offer a simple, free way to refuse.

The official guidance is direct: none of the exceptions covers online advertising. Cookies and pixels for personalized ads, ad measurement and remarketing still depend on consent. In May 2026 the regulator suggested that the government study an exception for low-risk advertising, but nothing in the law has changed so far.

People's rights

What the visitor can ask of your site

Anyone in the United Kingdom can exercise these rights. The site must have a channel to receive requests and respond on time.

Know and access

Receive clear information about the use of the data and a copy of what the site holds about them, as a rule within one month.

Correct and delete

Ask for wrong data to be corrected and for deletion when there is no longer a reason to keep it, for example after consent is withdrawn.

Object to marketing

Refuse the use of data for direct marketing at any time. In this case the objection is absolute and the site must stop.

Withdraw consent

Change their mind about cookies as easily as they accepted. A permanent link to reopen the preferences solves it.

Automated decisions

Be informed, challenge and ask for human review when an important decision is made only by a system.

Complain to the controller

Since June 19, 2026, those who process data must have a complaints process and confirm receipt within 30 days.

Obligations

What a site with British visitors needs to do

  1. Publish a complete privacy noticeSay who is responsible for the site, what data it collects, for what, on what legal basis, who it shares it with, how long it keeps it and how the person exercises their rights. Mention ad partners and the transfer of data outside the country.
  2. Show a banner with a real choiceBefore any ad cookie or ad measurement cookie, ask for consent. Accept and refuse must have the same visual weight and be on the same screen.
  3. Block what depends on consentPixels, remarketing and personalized ads can only fire after acceptance. With no response, the site treats it as a refusal.
  4. Use the exceptions transparentlyIf you use statistics or preference cookies without consent, explain this on the cookies page and give a simple way to turn them off.
  5. Take care of security and breachesProtect the data and notify the regulator within 72 hours when a breach could bring risk to people. If the risk is high, also notify those affected.
  6. Keep your house in orderHave contracts with the vendors that process data, do an impact assessment for high-risk uses and check whether the company must pay the regulator's annual fee.

Enforcement and fines

How much a mistake costs

The regulator usually starts with warnings and orders to fix things, but the maximum fines are high, and the 2025 reform also strengthened powers over cookies.

Higher UK GDPR ceiling

Up to 17.5 million pounds or 4% of annual worldwide turnover, whichever is higher, for the most serious infringements, such as processing data without a legal basis.

Standard ceiling

Up to 8.7 million pounds or 2% of annual worldwide turnover for failures such as incomplete records or inadequate security.

Greater powers over cookies

The 2025 reform expanded the regulator's enforcement and fining powers over PECR. The new rules apply to conduct from February 5, 2026.

Active enforcement

In January 2025 the regulator announced a review of the banners of the country's thousand most visited sites. In April 2026, it reported that 99% of them already met the standards.

Timeline

How the rules got here

The dates that weigh most for those with visitors from the United Kingdom.

  1. 2003

    PECR is born

    The British electronic communications regulation starts to cover cookies and electronic marketing.

  2. May 25, 2018

    GDPR and Data Protection Act 2018

    The European GDPR takes effect in the United Kingdom, along with the new British data protection law.

  3. January 1, 2021

    The UK GDPR begins

    With the end of the Brexit transition, the country has its own version of the GDPR.

  4. January 16, 2024

    Certified CMP for Google ads

    For personalized ads in the United Kingdom, AdSense and Ad Manager start requiring a certified CMP integrated with the IAB TCF.

  5. June 19, 2025

    Data (Use and Access) Act 2025

    The law that reforms the UK GDPR, the Data Protection Act and PECR receives royal assent.

  6. February 5, 2026

    New exceptions and more powers

    The new cookie exceptions, the recognized legitimate interests and the regulator's new enforcement powers over PECR take effect.

  7. April 29, 2026

    Final guidance on cookies

    The regulator publishes the final version of the guidance on storage and access technologies.

  8. September 30, 2026

    Information Commission

    The ICO is replaced by the Information Commission, a board-led body with the same functions and powers.

For people with AdSense or Ad Manager

What changes in practice for revenue

Google treats the United Kingdom the same way as the European Economic Area. To show personalized ads to British visitors, the site needs a CMP certified by Google and integrated with the IAB TCF. Without it, this traffic only receives non-personalized or limited ads, which usually earn much less.

The CMP records the visitor's choice in a TC string and passes the Consent Mode signals to Google tags. If the site also uses Google Analytics or Google Ads, the four Consent Mode signals must reflect what the person chose in the banner.

Think of a Brazilian recipe portal that receives a small share of visitors from the United Kingdom, many of them Brazilians who live there. For the Brazilian audience the LGPD applies; for the British one, the UK GDPR with PECR applies. The right setup shows the TCF message only to those in the United Kingdom, the EEA and Switzerland, without bothering the Brazilian audience.

The Privacy message from AdSense and Ad Manager itself is certified and already covers the United Kingdom. Those who use another CMP must confirm that it is on Google's list and that the United Kingdom is among the configured regions.

In practice

What is and is not allowed in the United Kingdom

Common examples on news, recipe, finance and job sites that receive British visitors.

Allowed

  • Using statistics cookies to improve the site itself without consent, as long as you give notice and offer a simple way to refuse
  • Saving the visitor's language or dark theme preference based on the appearance exception
  • Showing the TCF message only to visitors from the United Kingdom, the EEA and Switzerland
  • Show non-personalized ads to people who refused
  • Use the AdSense or Ad Manager Privacy & messaging tool, which is already certified

Not allowed

  • Loading remarketing pixels or ad cookies before the click on accept
  • Fitting ad measurement into the statistics exception
  • Putting only the accept button on the first screen and hiding the refusal in a menu
  • Using an ordinary cookie plugin, outside Google's list, for British traffic
  • Treating continued browsing as if it were consent

Common errors

Where sites slip up most

These are failures that often appear in audits of sites with UK traffic.

Thinking Brexit took the United Kingdom out of the rule

Many set up the CMP only for the European Union. The British visitor gets no message and Google starts delivering limited ads.

Reading the 2025 reform as a general release

The new exceptions are for statistics, preferences and emergency. Ads still need consent.

Banner that is just decoration

The banner appears, but the ad cookies have already been set before the response. For the regulator, this is the same as not asking for consent.

Refusal harder than acceptance

Accepting with one click and refusing with five is the kind of design the regulator has been going after on large sites.

Generic privacy policy

Text copied from another site, without mentioning Google, ad partners, international transfers or the channel for requests.

Exception without an option to refuse

Using statistics or appearance cookies without consent and not offering a simple way to turn them off breaks the condition of the exception itself.

In ConsentMode

What the audit checks for the United Kingdom

  • Opens the site as a visitor from the United Kingdom and from outside it and records where the banner appears and which buttons it offers.
  • Identifies the CMP from the page code and says whether it is on Google's list of certified CMPs.
  • Reads the TC string and the Consent Mode signals and compares them with what the visitor chose.
  • Lists the cookies and network requests before and after acceptance and points out what fires too early.
  • Checks whether the privacy page mentions ad partners, legal bases, rights and a contact channel.
Run an auditSee everything that is checked

Frequently asked questions

My site is Brazilian and has no company in the United Kingdom. Does the law apply to me?

It applies to visitors who are in the United Kingdom when the site monitors their behavior, as happens with personalized ad cookies. And, even without looking at the law, Google requires a certified CMP to show personalized ads to this audience.

Do Google Analytics cookies still need consent?

It depends on the use. The statistics exception applies when the data is used only to measure and improve the site itself, with clear notice and a simple option to refuse. If the tool uses the data for ads or for the vendor's own purposes, the exception does not apply.

Is the ICO gone? Who enforces now?

Since September 30, 2026, the ICO's functions have passed to the Information Commission. The regulator's role and powers have not changed and the day-to-day work continues; what changes is the governance model, which is now board-led.

Did the 2025 reform make the United Kingdom more flexible than the European Union?

In some points, yes, such as the new exceptions for statistics and preferences. For personalized ads, the practical result is the same: consent before storing or reading anything on the device.

Can I use one CMP only for the United Kingdom and another for Europe?

You can, but it is rarely worth it. Most certified CMPs cover the EEA, the United Kingdom and Switzerland with the same setup, by region.

What happens to revenue if the visitor declines?

Google can still show non-personalized or limited ads to that person. Revenue per visit is usually lower, but the site keeps monetizing without breaking the rule.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See how your site appears to a British visitor

The audit opens the site from the United Kingdom, records the banner and cookies and shows what to fix, without changing anything.

Start the audit