United KingdomPECR, Storage of and Access to Information on Terminal Equipment
PECR (S.I. 2003/2426), reg. 6 and Sch. A1, as substituted by the Data (Use and Access) Act 2025
In force since .
A device storage and tracking consent rule binding public and private bodies.
- Obligation class
- Consent, Disclosure
What it requires
- Do not store information on, or gain access to information already stored on, a subscriber's or user's terminal equipment (a phone, computer or other device, including through a browser or an app) unless they have been given clear and comprehensive information about the purpose of the storage or access and have given consent.
- You do not need consent where the storage or access is strictly technical for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or is strictly necessary for an information society service the subscriber or user requested, for example to protect the information they provided, keep their device secure, prevent or detect fraud or technical faults, authenticate them automatically, or remember what they selected or entered.
- You also do not need consent to collect information for statistical purposes about how your service or the website providing it is used, with a view to improving either, if you do not share the collected information with anyone except to help make those improvements, give the subscriber or user clear and comprehensive information about the purpose, and give them a simple, free means of objecting that they do not use.
- You also do not need consent to store or access information solely to adapt a website's appearance or functionality to the subscriber's or user's preferences, or otherwise enhance its appearance or functionality, on the same conditions of clear and comprehensive information and a simple, free means of objecting that they do not use.
These lines are LexLint's reading of the law's text. Also read by: Information Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
The PEC Regulations' own enforcement route (reg. 31 and Sch. 1) applies Data Protection Act 2018 s.157 with modifications. Schedule 1 paragraph 18(b)(ii), as substituted by the Data (Use and Access) Act 2025, Sch. 13 (in force under S.I. 2026/82, reg. 2(z14)), gives a failure to comply with regulation 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23, 24 or 32B(4) or (5) the higher maximum amount defined at Data Protection Act 2018 s.157(5): the greater of £17,500,000 or 4 percent of worldwide annual turnover for an undertaking, or £17,500,000 for anyone else. Every other PEC Regulations contravention keeps the lower, standard maximum amount under s.157(6) (the greater of £8,700,000 or 2 percent, or £8,700,000).
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 17,500,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information Commission, exercising the enforcement powers Schedule 1 applies to it under regulation 31 of the Regulations.
Enforcement record
The Information Commissioner's Annual Report and Financial Statements 2025/26, covering to , states that the regulator issued 10 monetary penalty notices totalling £1,445,000 and 10 enforcement notices for breaches of PECR. The count of 20 adds the penalty notices and the enforcement notices, and it covers every regulation of PECR rather than only the regulations this row carries.
- As of
- Currency
- GBP
- Source link
- https://ico.org.uk/media2/ybsi5n0j/ico-annual-report-202527.pdf
- Fines per year
- 1,445,000
- Actions per year
- 20
Settledness
- As of
- Guidance link
- https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/
- Guidance body
- Information Commission
- Open questions
- Does 'statistical purposes' in paragraph 5 of Schedule A1 to PECR carry the meaning of statistical purposes in the UK GDPR, which the Information Commission's guidance says it 'can be taken to mean' in practice although PECR does not define the term?
What this law does
Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 bars a person from storing information, or gaining access to information already stored, in a subscriber's or user's terminal equipment, subject to the exceptions Schedule A1 lists.
Schedule A1, substituted with regulation 6 on by the Data (Use and Access) Act 2025, keeps the pre-existing consent exception, the exception for technical transmission, and the exception for storage or access strictly necessary for a requested information society service, and adds two new ones: collecting information for statistical purposes to improve a service or website, and adapting or enhancing a website's appearance or functionality, each conditioned on clear and comprehensive information to the subscriber or user and a simple, free means of objecting that they do not use.
When LexLint raises it
When your app profile says your app tracks devices.
Back to the example · Lint your app
Page updated .