Privacy and Electronic Communications (EC Directive) Regulations 2003

PECR is the UK's implementation of the ePrivacy Directive and it survived Brexit intact, so the cookie-consent and electronic-marketing rules continue to apply independently of the UK GDPR. It covers consent for cookies and similar device storage, direct marketing by call, text, email and fax, security of public electronic communications services, and customer privacy for traffic and location data. Two practical points. The ICO enforces PECR under its own penalty regime, and historically the large majority of its monetary penalties have been PECR marketing fines rather than data protection fines — so for a business doing outbound marketing, PECR is often the higher-probability enforcement exposure of the two. And the Data (Use and Access) Act 2025 raised PECR's maximum penalties to UK GDPR levels, which removes the long-standing gap that made PECR the cheaper regime to breach. Marked 'verified' on the framework; confirm current commencement of the specific DUAA penalty and cookie-exemption changes before relying on them.