United Kingdom. ePrivacy / marketing. Statutory instrument (SI 2003/2426)
PECRPrivacy and Electronic Communications (EC Directive) Regulations 2003
§1Summary
- Synopsis
The UK's ePrivacy rules covering electronic direct marketing (email, SMS, calls), cookies and similar storage/access technologies, and the security and confidentiality of public electronic communications services. Since February 2026 the ICO can fine PECR breaches at UK GDPR levels.
- Key themes
- Unique features
DUAA 2025 added consent exemptions for analytics/statistical cookies, website appearance and functionality, and emergency location, extended the soft opt-in to charities, and lifted the old £500,000 cap to £17.5m/4% turnover.
- SaaS relevance
Any SaaS website or app that sets cookies or SDK trackers on UK users' devices, or sends marketing emails/SMS to UK recipients, is caught regardless of where the provider is based.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Service providers: ICO within 72h (aligned with UK GDPR from 2025-08-20)
- DPO
- No
- Cross-border transfers
- None specific
- Maximum penalty
- £17.5m or 4% worldwide turnover (post-DUAA)
§3Dates
- Key dates
- Adopted
- In force
- Amended 2011 (cookie consent), 2018, 2021 (Brexit); DUAA 2025 s.111 aligned breach notification 2025-08-20; DUAA ss.112–116 (cookie exemptions, soft opt-in for charities, PECR fines raised to UK GDPR level) commenced 2026-02-05
§4Text and authority
- Text
- Authoritative text legislation.gov.uk
- Authority
- Information Commissioner's Office (ICO)
§5Where it applies
- Domestic law of
- United Kingdom
§6Sources and verification
- Sources consulted
- Verification
High confidence.
ICO states all DUAA provisions affecting PECR are now in force.