# UK Cookie Consent: UK GDPR & PECR Compliant Banners

> Serve UK GDPR and PECR-compliant cookie consent with prior opt-in for tracking, an equally prominent Reject all, the analytics exemption and audit-ready logs.

Canonical page: https://cookiechimp.com/uk-gdpr

> This page describes how CookieChimp is configured for UK visitors. It is not legal
> advice.

## What UK law expects

PECR requires prior consent for non-essential cookies; the UK GDPR defines what valid
consent looks like — and the ICO enforces both.

- **Prior consent.** Third-party tracking and advertising cookies stay blocked until
  the visitor agrees. Strictly necessary, security and load-balancing cookies are exempt.
- **Analytics exemption (DUAA 2025).** Under the Data (Use and Access) Act 2025, some
  first-party analytics cookies used only to improve your own site may run without
  consent — configure them separately from tracking.
- **Reject as easy as Accept.** "Reject all" sits alongside "Accept all" with equal
  prominence — no buried or pre-selected decline.
- **Granular purposes.** Visitors control cookies purpose by purpose, with nothing
  pre-ticked and no dark patterns.
- **Children's Code.** Services likely to be accessed by children need high-privacy
  defaults and no behavioural advertising cookies without clear necessity.
- **Proof of consent.** Every choice is logged with a timestamp, the purposes chosen
  and the policy version — exportable whenever the ICO asks.

## How it works

1. Detect UK visitors.
2. Show a PECR banner.
3. Capture granular choices.
4. Log and prove consent.

## What CookieChimp provides

- **UK targeting** — serve a dedicated UK banner and route UK visitors to it
  automatically.
- **Prior blocking** — keep third-party tracking cookies blocked until the visitor
  consents.
- **Analytics-aware** — separate first-party, site-improvement analytics from tracking
  to reflect the 2025 exemption.
- **Equal Reject/Accept** — give "Reject all" the same prominence as "Accept all".
- **Children's Code ready** — apply high-privacy defaults for services likely to be
  accessed by children.
- **Audit-ready records** — export consent choices and policy version as CSV for the ICO.
- **Signals to your stack** — forward consent to Google Consent Mode, Meta and
  Microsoft.
- **Persistent withdrawal** — let visitors change or withdraw consent at any time.

## FAQ

**Do UK websites still need a cookie banner after Brexit?**
Yes. The UK kept its own regime — PECR governs cookies and the UK GDPR governs personal
data. Non-essential cookies still need prior consent, and the ICO enforces it.

**What changed under the Data (Use and Access) Act 2025?**
Some first-party analytics cookies used solely to improve your own website may now be
exempt from consent. Third-party tracking and advertising cookies still require opt-in.
CookieChimp lets the two be configured separately.

**Does my banner need a "Reject all" button?**
Yes — the ICO expects "Reject all" to be as prominent and easy to use as "Accept all".
CookieChimp gives reject and accept equal weight on the first layer.

**How big are the fines under PECR now?**
Penalties rose under the 2025 reforms, bringing PECR closer to UK GDPR levels — up to
£17.5M or 4% of global turnover for serious breaches.

**What about children?**
The ICO's Age Appropriate Design Code (the Children's Code) requires high-privacy
defaults for services likely to be accessed by under-18s, with no behavioural
advertising cookies without clear necessity.

**Is UK consent the same as EU GDPR consent?**
Closely aligned but not identical — the UK has its own PECR, the 2025 analytics
exemption and ICO guidance. If serving both, target a dedicated UK banner alongside the
EU one.

## Related pages

- Full page: https://cookiechimp.com/uk-gdpr
- EU GDPR: https://cookiechimp.com/eu-gdpr.md
- Consent banners: https://cookiechimp.com/features/consent-banners.md
- Index of all markdown pages: https://cookiechimp.com/llms.txt