The technical and legal configuration that ensures a website’s use of cookies and tracking technologies complies with UK PECR (Privacy and Electronic Communications Regulations) and UK GDPR — including correct categorisation of cookies, a compliant consent mechanism and accurate documentation of all cookies in use.
Strictly necessary cookies (session management, login, CSRF protection — no consent required), functionality cookies (remembering preferences), analytics cookies (Google Analytics, Hotjar), marketing cookies (Google Ads, Meta Pixel, LinkedIn Insight Tag) and third-party cookies from embedded content (YouTube, social sharing widgets).
Strictly necessary cookies are required for the website to function — they cannot be opted out of without breaking core functionality. Non-essential cookies (analytics, marketing, personalisation) provide additional features or track behaviour beyond basic operation and require explicit user consent before being set under PECR.
A systematic scan of all cookies and tracking scripts active on the website, documenting each one by name, category, purpose, the third party that sets it, data it collects and its retention period. An accurate cookie audit is required before a compliant cookie policy and consent mechanism can be built.
This constitutes a breach of PECR. The ICO has issued fines and enforcement notices for non-compliant cookie practices. Beyond legal risk, non-consensual tracking also undermines visitor trust and may result in skewed analytics data if visitors later withdraw consent or block cookies themselves.
Whenever a new third-party tool, script or embed is added to the website (each may introduce new cookies), when a major platform updates its cookie behaviour (e.g., a Google Analytics version change) and at minimum annually as a comprehensive compliance check. Cookie environments change frequently.
A published cookie policy listing all cookies by category, a record of the cookie audit, documentation of the consent mechanism configuration and evidence of consent (where technically feasible to record). This documentation demonstrates compliance to a regulator if the site’s practices are challenged.
PECR governs when cookies can be set (requiring prior consent for non-essential cookies). UK GDPR governs what happens with personal data that cookies may collect (requiring a lawful basis, typically consent, for processing). Both apply simultaneously; a fully compliant implementation must satisfy both frameworks.
No. Analytics cookies (including Google Analytics) are classified as non-essential under PECR because they are not required for the website to function. They require explicit opt-in consent before being set. Configuring analytics without a compliant consent gate is a common compliance error.
Analytics approaches that measure website performance without setting persistent cookies — using aggregate statistical modelling, first-party data and privacy-preserving measurement methodologies. Google’s GA4 includes consent mode as a partial solution. Cookie-less analytics is increasingly relevant as browser privacy restrictions and user opt-out rates increase.