ICO Guidance on the Use of Storage and Access Technologies
The ICO's definitive account of how UK law applies to cookies, tracking pixels, device fingerprinting and similar technologies — finalised 29 April 2026 and fully updated for the Data (Use and Access) Act 2025 changes to PECR, including the new consent exceptions and the enlarged penalty regime.
- Published by
- Information Commissioner's Office (ICO)
- Type
- Guidance — final (29 April 2026, following two consultations); supersedes the ICO's earlier detailed cookies guidance
- Jurisdiction
- UK — PECR (SI 2003/2426) regulation 6, as amended by the Data (Use and Access) Act 2025, and the UK GDPR where personal data is processed
- Primary audience
- UK DPOs, compliance teams and web/marketing operations
- Topic tags
- cookies & tracking · PECR · consent · DUAA · UK GDPR
- Availability
- Free, ico.org.uk
Why it matters
The UK rulebook moved twice in early 2026, and this guidance is the authoritative account of where it landed. From 5 February 2026 the Data (Use and Access) Act 2025 amended PECR: new exceptions to the consent requirement (including, subject to conditions, first-party statistical purposes and appearance/functionality preferences), a "simple means of objecting" concept, and PECR penalties raised to the UK GDPR scale — £17.5m or 4% of global annual turnover. The guidance works through how amended regulation 6 applies in practice: what counts as storage or access (pixels and fingerprinting included, not just cookies), when each exception is actually available, how to handle one technology used for multiple purposes, and where the UK GDPR takes over once personal data is in play. The so-what is direct: if you audit your estate with the EDPS Website Evidence Collector or the EDPB Website Auditing Tool, this is the UK yardstick to assess the findings against — and the reference for re-papering a consent position under the new exceptions before relying on them. With the ICO's cookie programme covering the UK's top 1,000 websites and the penalty ceiling now thirty-five times higher, guessing is no longer an economic strategy.