United KingdomPECR, Storage of and Access to Information on Terminal Equipment
PECR (S.I. 2003/2426), reg. 6 and Sch. A1, as substituted by the Data (Use and Access) Act 2025
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force 8 months, effective .
A device storage and tracking consent rule binding public and private bodies.
As of .
What it requires
- Do not store information on, or gain access to information already stored on, a subscriber's or user's terminal equipment (a phone, computer or other device, including through a browser or an app) unless they have been given clear and comprehensive information about the purpose of the storage or access and have given consent.
- You do not need consent where the storage or access is strictly technical for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or is strictly necessary for an information society service the subscriber or user requested, for example to protect the information they provided, keep their device secure, prevent or detect fraud or technical faults, authenticate them automatically, or remember what they selected or entered.
- You also do not need consent to collect information for statistical purposes about how your service or the website providing it is used, with a view to improving either, if you do not share the collected information with anyone except to help make those improvements, give the subscriber or user clear and comprehensive information about the purpose, and give them a simple, free means of objecting that they do not use.
- You also do not need consent to store or access information solely to adapt a website's appearance or functionality to the subscriber's or user's preferences, or otherwise enhance its appearance or functionality, on the same conditions of clear and comprehensive information and a simple, free means of objecting that they do not use.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
The PEC Regulations' own enforcement route (reg. 31 and Sch. 1) applies Data Protection Act 2018 s.157 with modifications. Schedule 1 paragraph 18(b)(ii), as substituted by the Data (Use and Access) Act 2025, Sch. 13 (in force under S.I. 2026/82, reg. 2(z14)), gives a failure to comply with regulation 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23, 24 or 32B(4) or (5) the higher maximum amount defined at Data Protection Act 2018 s.157(5): the greater of £17,500,000 or 4 percent of worldwide annual turnover for an undertaking, or £17,500,000 for anyone else. Every other PEC Regulations contravention keeps the lower, standard maximum amount under s.157(6) (the greater of £8,700,000 or 2 percent, or £8,700,000).
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 17,500,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information Commissioner's Office (ICO), exercising the enforcement powers Schedule 1 applies to it under regulation 31 of the Regulations.
What it reaches
Obligation class
Consent, Disclosure
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 bars a person from storing information, or gaining access to information already stored, in a subscriber's or user's terminal equipment, subject to the exceptions Schedule A1 lists.
Schedule A1, substituted with regulation 6 on by the Data (Use and Access) Act 2025, keeps the pre-existing consent exception, the exception for technical transmission, and the exception for storage or access strictly necessary for a requested information society service, and adds two new ones: collecting information for statistical purposes to improve a service or website, and adapting or enhancing a website's appearance or functionality, each conditioned on clear and comprehensive information to the subscriber or user and a simple, free means of objecting that they do not use.
When LexLint raises it
tracks_devices
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.