ePrivacy & MarketingUpdated June 4, 2026; refreshed July 8, 202614 min read

PECR and ePrivacy Requirements for Cookies and Electronic Marketing in Ireland and the UK

AAcompli Research

Cookies and electronic marketing are governed by ePrivacy rules that sit alongside the GDPR: in the UK by PECR (enforced by the ICO) and in Ireland by S.I. 336/2011 (enforced by the DPC). This guide compares the two regimes, sets out the consent and soft opt-in conditions, and flags the 2026 reforms.

Illustration comparing PECR and ePrivacy cookie and marketing consent rules in Ireland and the UK
On this page
1 / 9

01ePrivacy & Marketing

What are PECR and the ePrivacy rules, and where do they apply?

Cookies and direct electronic marketing are governed by ePrivacy rules that apply on top of the GDPR: in the UK by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR, S.I. 2003/2426), enforced by the Information Commissioner's Office (ICO), and in Ireland by the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. 336/2011), enforced by the Data Protection Commission (DPC). Both transpose the EU ePrivacy Directive (2002/58/EC, as amended) and both borrow the GDPR or UK GDPR definition of consent.

The practical point for any organisation marketing into Ireland and the UK is that the GDPR is necessary but not sufficient. You can have a lawful basis under the GDPR and still breach the ePrivacy rules if you set non-essential cookies without valid consent, or send marketing emails, texts or automated calls without the right permission. ePrivacy is the more specific regime (lex specialis) for cookies and electronic communications, so where it applies, it governs.

This guide compares the two regimes side by side: when cookie consent is required, when the existing-customer soft opt-in lets you market without prior consent, who enforces and how hard, and what the 2026 reforms (the UK Data (Use and Access) Act 2025 and the EU Digital Omnibus proposal) change.

04ePrivacy & Marketing

Electronic marketing: Regulation 22 (UK) and Regulation 13 (Ireland)

Direct electronic marketing to individuals generally requires prior consent in both jurisdictions. In the UK, Regulation 22 of PECR governs marketing by electronic mail (which includes email and SMS); in Ireland, Regulation 13 of S.I. 336/2011 governs unsolicited communications by email, SMS, automated calling and fax. The default rule is opt-in.

The major exception is the existing-customer 'soft opt-in'. It lets an organisation market to people who are already customers without prior consent, provided strict conditions are met. The conditions are closely aligned across the two regimes, but Ireland sets an explicit 12-month time limit (Regulation 13(11)) and the UK does not.

  • You obtained the contact details directly from the person in the course of a sale or negotiations for a sale of a product or service.
  • You are marketing your own similar products or services only (not unrelated lines, and not third-party marketing).
  • The person was given a simple, free means to opt out when their details were collected, and is given that opportunity in every subsequent message.
  • Ireland (Regulation 13(11)) sets a 12-month limit: the soft opt-in applies only where the sale, or the last compliant marketing message the person did not opt out of, occurred within the previous 12 months, after which fresh consent is needed.
  • Corporate subscribers: marketing to individual employees at named corporate email addresses still attracts opt-out and identification duties; the soft opt-in is designed for individual-subscriber relationships, and most B2B email instead relies on documented legitimate interests under the GDPR or UK GDPR.

05ePrivacy & Marketing

DPC (Ireland) vs ICO (UK): a side-by-side comparison

The two regimes are closely aligned on substance but diverge sharply on enforcement mechanics and, since 5 February 2026, on cookie consent exemptions. The table below summarises the differences that matter most when you operate across both.

Ireland — DPC (S.I. 336/2011)UK — ICO (PECR 2003)
Regulator: Data Protection Commission (DPC).Regulator: Information Commissioner's Office (ICO).
Cookies: Regulation 5 — consent required for non-essential cookies; only the strictly-necessary exemption applies and it is read narrowly.Cookies: Regulation 6 — consent required, but with new statutory exemptions (e.g. first-party aggregate analytics, security, functionality, software updates) from 5 Feb 2026 under the DUA Act 2025.
Marketing: Regulation 13 — opt-in default; soft opt-in capped at 12 months from the sale or last compliant marketing message (Reg 13(11)).Marketing: Regulation 22 — opt-in default; soft opt-in with no fixed statutory time limit (the ICO advises a reasonable period).
Consent standard: EU GDPR (Regulation (EU) 2016/679) definition.Consent standard: UK GDPR definition.
Penalties: primarily criminal prosecution — a class A fine (up to €5,000) per offence on summary conviction, and on indictment up to €250,000 for a body corporate or up to €50,000 for an individual; each message can be a separate offence.Penalties: administrative fines up to £17.5m or 4% of global turnover, whichever is higher (raised from £500,000 by the DUA Act 2025, in force 5 Feb 2026).
Soft opt-in scope: commercial existing-customer relationships; no general charity/non-commercial soft opt-in.Soft opt-in scope: extended by the DUA Act 2025 (from 5 Feb 2026) to allow charities to use a soft opt-in for charitable purposes.
Wider relevance: DPC is lead authority for major platforms established in Ireland, so its positions carry EU-wide weight.Wider relevance: ICO guidance is the reference point post-Brexit and is now diverging from the EU on cookies.

06ePrivacy & Marketing

Penalties and enforcement: how the two regimes bite differently

The biggest practical divergence is in penalties. In the UK, the Data (Use and Access) Act 2025 lifted the old £500,000 PECR cap and aligned it with the UK GDPR regime: from 5 February 2026 the ICO can impose administrative fines of up to £17.5 million or 4% of global annual turnover, whichever is higher, for the most serious PECR breaches. That materially raises the stakes for cookie and marketing failures in the UK.

In Ireland, the DPC does not levy administrative fines for ePrivacy breaches under S.I. 336/2011 in the way it does for GDPR breaches. Instead, breaches are criminal offences that the DPC prosecutes through the courts. On summary conviction the penalty is a class A fine, which under the Fines Act 2010 is a fine of up to €5,000 per offence. On conviction on indictment the fine can be up to €250,000 for a body corporate, or up to €50,000 for a natural person, per offence. Because each non-compliant message can be charged as a separate offence, a single bulk send can multiply quickly, and a prosecution carries reputational and director-level consequences beyond the headline figure.

In both countries, complaints and regulator sweeps are the usual trigger. The point is that 'we used the GDPR lawful basis of legitimate interests' is not a defence to an ePrivacy marketing or cookie breach: the specific consent and soft opt-in conditions still have to be met.

07ePrivacy & Marketing

Common pitfalls when complying across both jurisdictions

Most ePrivacy failures are operational rather than conceptual. The rules are well known; the gaps appear in implementation and in assuming the two regimes are identical. Acompli's ePrivacy and PECR review is built to surface exactly these gaps: it helps inventory cookies and trackers, flags configurations that look misaligned with the UK or Irish regime, and routes each finding to a reviewer to resolve.

  • Cookies firing before consent: tags load on page render, so non-essential cookies are set before the banner is answered.
  • Asymmetric banners: 'Accept all' is one click but 'Reject' takes several, which fails the 'as easy to refuse as to accept' standard.
  • Treating the GDPR lawful basis as sufficient: relying on legitimate interests for marketing emails or analytics cookies without meeting the ePrivacy consent or soft opt-in conditions.
  • Stretching the soft opt-in: marketing unrelated products, to non-customers, or in Ireland beyond the 12-month window.
  • No unsubscribe in every message, or an unsubscribe that is not simple and free.
  • Applying one cookie configuration globally: assuming the UK's post-February-2026 analytics exemption also applies to Irish or wider EU users, where consent is still required.
  • Failing to keep evidence: no consent records, no banner version history, and no audit trail of who approved the marketing list and on what basis.

08ePrivacy & Marketing

2026 regulatory developments: divergence on both sides

The UK and the EU are reforming ePrivacy at the same time but in different directions, so cross-border organisations should expect the two cookie regimes to drift apart rather than converge.

United Kingdom — Data (Use and Access) Act 2025: the Act received Royal Assent on 19 June 2025, and its main data protection and PECR provisions were commenced on 5 February 2026 (by SI 2026/82), with further obligations (such as the new data protection complaints procedure) following from 19 June 2026. From 5 February 2026 it introduced new statutory exemptions to PECR cookie consent, so that certain low-risk uses (for example first-party aggregate statistical analytics, and security, functionality and software-update purposes) no longer require consent, provided users are given clear information and, where relevant, a simple, free way to object. Advertising and cross-site tracking cookies remain outside the exemptions and still need consent. The same day, the Act extended the soft opt-in so that charities can use it for charitable purposes, and raised the PECR fine ceiling to UK GDPR levels. The ICO published updated guidance on the use of storage and access technologies to reflect these changes.

European Union — Digital Omnibus proposal: in November 2025 the European Commission published the Digital Omnibus, a proposal to simplify the EU digital rulebook. As proposed, it would move core cookie rules out of the ePrivacy Directive and into the GDPR (via a new Article 88a) and provide for machine-readable consent, refusal and objection signals (Article 88b), alongside broader exemptions for purposes such as first-party audience measurement, security and user-requested services. This is only a proposal and is not in force; it is expected to move through the Parliament and Council during 2026 and could change substantially. Until it is adopted and any resulting changes take effect, Ireland's S.I. 336/2011 and the existing consent standard continue to apply unchanged.

The net effect for 2026: a UK organisation may lawfully run certain first-party analytics cookies without consent, while the same cookies for Irish or EU users still require consent until any EU reform takes effect. Geo-aware cookie configuration is becoming a practical necessity rather than a refinement. In Acompli, the cookie inventory records the consent basis or exemption each configuration relies on per regime, so a UK-only exemption applied to Irish users is flagged for human review.

09ePrivacy & Marketing

Building an audit-ready ePrivacy programme across Ireland and the UK

Audit readiness for ePrivacy is about producing evidence on demand: that non-essential cookies fire only after consent (or fall within an applicable exemption), that consent and soft opt-in conditions were met, and that your configuration reflects each jurisdiction's current rules. A defensible programme ties the cookie inventory, consent records, marketing-list provenance and banner configuration together so they can be shown to the DPC or the ICO without a scramble.

Acompli's ePrivacy and PECR review supports this work in an assistive role. The software helps inventory cookies and trackers, drafts and classifies consent and marketing records, flags where a configuration looks misaligned with the relevant regime, and routes findings for review. It surfaces and organises evidence so a person can check it; it does not make autonomous legal determinations. A DPO, privacy lead or lawyer reviews and approves the output, and Acompli does not replace that human judgement. Where the GDPR record-keeping side overlaps, the same source evidence can feed your record of processing activities.

  • Maintain a current cookie and tracker inventory mapped to purpose, provider and the consent basis or exemption relied on.
  • Keep consent and soft opt-in evidence: what was shown, when, what the user chose, and the source of each marketing contact.
  • Run geo-aware banner configuration so UK exemptions are not applied to Irish or wider EU users.
  • Version-control your banner and preference centre so you can show what a user saw at any point in time.
  • Build a human review and approval step into every marketing campaign and cookie-configuration change.

Where Acompli fits for PECR and ePrivacy

Best for teams operating across Ireland and the UK where cookie and marketing rules now diverge: Acompli keeps the cookie inventory, consent basis or exemption, soft opt-in evidence, banner version and reviewer decision in one audit-ready record. It flags configurations that look misaligned with the UK or Irish regime and routes them for human review, so a UK-only analytics exemption is not accidentally applied to Irish or wider EU users.

See Acompli PECR and ePrivacy review

Primary sources

PECR and ePrivacy FAQ for Ireland and the UK

Do I need consent for cookies in both Ireland and the UK?

For non-essential cookies, yes, with one growing difference. In the UK, Regulation 6 of PECR requires consent before storing or accessing information on a user's device, and in Ireland Regulation 5 of S.I. 336/2011 imposes the same core requirement. Both exempt cookies that are strictly necessary to transmit a communication or to provide a service the user has explicitly requested, such as login or shopping-cart cookies. From 5 February 2026 the UK added further statutory exemptions for certain low-risk uses, including first-party aggregate analytics, so those cookies no longer need consent in the UK if you give clear information and a simple way to object. Those new exemptions do not apply in Ireland, where analytics, advertising and personalisation cookies still require consent.

What is the difference between PECR consent and GDPR consent?

They use the same standard. PECR in the UK and S.I. 336/2011 in Ireland both borrow the GDPR or UK GDPR definition of consent, which means a freely given, specific, informed and unambiguous indication given by a clear affirmative action. Pre-ticked boxes, implied consent from continued browsing, and notices that say using the site means you agree do not meet that standard. The difference is scope: the ePrivacy rules govern the act of setting cookies or sending a marketing message, while the GDPR governs the personal data processed afterwards. You generally need to satisfy both.

Can I email existing customers without consent under the soft opt-in?

Sometimes, if strict conditions are met. The existing-customer soft opt-in (Regulation 22 in the UK, Regulation 13 in Ireland) lets you market to people who are already customers without prior consent, but only if you obtained their details directly during a sale or negotiations, you are marketing your own similar products or services, and they were given a simple, free way to opt out both at collection and in every message. Ireland sets a 12-month limit under Regulation 13(11), measured from the sale or the last compliant message the person did not opt out of, after which you need fresh consent. The UK has no fixed statutory time limit, though the ICO advises a reasonable period.

Who enforces ePrivacy rules in Ireland and the UK, and how hard?

In the UK the Information Commissioner's Office (ICO) enforces PECR and, since the Data (Use and Access) Act 2025 took effect on 5 February 2026, can impose administrative fines of up to £17.5 million or 4% of global annual turnover, up from the previous £500,000 cap. In Ireland the Data Protection Commission (DPC) enforces S.I. 336/2011, but ePrivacy breaches are prosecuted as criminal offences through the courts rather than fined administratively. On summary conviction the penalty is a class A fine of up to €5,000 per offence; on conviction on indictment it is up to €250,000 for a company or up to €50,000 for an individual, per offence. Because each non-compliant message can be a separate offence in Ireland, a single bulk send can multiply quickly.

Does the GDPR replace PECR or the Irish ePrivacy Regulations?

No. The ePrivacy rules sit on top of the GDPR and are the more specific regime for cookies and electronic marketing. You can have a valid GDPR lawful basis, such as legitimate interests, and still breach PECR or S.I. 336/2011 if you set non-essential cookies without consent or send marketing without the right permission. For cookies and direct electronic marketing, the ePrivacy consent and soft opt-in conditions apply in addition to the GDPR, not instead of it.

If I comply with UK PECR, am I automatically compliant in Ireland?

No, and the gap is widening. The two regimes share the same core consent standard, but they diverge on cookie exemptions, soft opt-in time limits and penalties. Since 5 February 2026 the UK exempts certain low-risk cookies, such as first-party aggregate analytics, from consent, while Ireland still requires consent for the same cookies. Ireland also caps the soft opt-in at 12 months from the sale or last compliant message, which the UK does not. Organisations marketing into both should run geo-aware cookie configuration and treat the two regimes as separate.

What records should we keep to be audit-ready for the DPC or the ICO?

Keep a current cookie and tracker inventory mapped to purpose, provider and the consent basis or exemption relied on; consent records showing what each user was shown, when and what they chose; the provenance of each marketing contact, including how and when details were collected; and version history of your cookie banner and preference centre so you can show what a user saw at any point. For soft opt-in marketing, retain evidence that the person was an existing customer, that the products are similar, that an opt-out was offered at collection and in every message, and in Ireland that the contact falls within the 12-month window. These records let you respond to a DPC or ICO query without reconstructing the position after the fact.

What changes in 2026 for cookies and marketing in the UK and EU?

In the UK, the main provisions of the Data (Use and Access) Act 2025 took effect on 5 February 2026, introducing new PECR cookie-consent exemptions for low-risk uses such as first-party aggregate analytics, security, functionality and software updates, allowing charities to use a soft opt-in for charitable purposes, and raising PECR fines to UK GDPR levels. In the EU, the Commission published the Digital Omnibus proposal in November 2025, which would move cookie rules into the GDPR and allow browser-level consent signals, but it is only a proposal and not in force. Until any EU reform is adopted and takes effect, Ireland's S.I. 336/2011 and the existing consent standard continue to apply unchanged.

Are analytics cookies allowed without consent in Ireland and the UK?

It now depends on the jurisdiction. In the UK, from 5 February 2026 certain first-party analytics cookies used solely to collect aggregate statistics to improve your own service can fall within a new PECR exemption and no longer require consent, provided you give clear information and a simple, free way to object, and provided the data is not shared for other purposes such as advertising. In Ireland, analytics cookies still require consent under Regulation 5 of S.I. 336/2011 because they are not strictly necessary. The same analytics tag may therefore need consent for Irish users but not for UK users, which is why geo-aware configuration matters.

Does Acompli make the legal decision about which cookies or messages are compliant?

No. Acompli's ePrivacy and PECR review is assistive. The software helps inventory cookies and trackers, drafts and classifies consent and marketing records, flags where a configuration looks misaligned with the UK or Irish regime, and routes findings for review. It surfaces and organises the evidence so a person can assess it, but it does not make autonomous legal determinations and does not replace a DPO or lawyer. A human reviews and approves the output, and the final compliance judgement rests with that person.

Market-specific questions (Deutschland / France / Nederland)

Benötigen wir für Marketing-E-Mails in Deutschland eine Einwilligung?

Ja. In Deutschland setzt Werbung per E-Mail nach § 7 UWG eine vorherige ausdrückliche Einwilligung des Empfängers voraus, gegenüber Verbrauchern und Unternehmen gleichermaßen; für E-Mail gibt es keinen weicheren B2B-Standard (die Unterscheidung betrifft nur die Telefonwerbung). Eine enge Bestandskunden-Ausnahme erlaubt E-Mail-Werbung für eigene ähnliche Produkte ohne neue Einwilligung nur, wenn die Adresse im Rahmen eines Verkaufs erlangt wurde, der Kunde nicht widersprochen hat und in jeder Nachricht eine einfache, kostenlose Abmeldemöglichkeit besteht. Durchgesetzt wird § 7 UWG vor allem zivilrechtlich durch Wettbewerber und Verbände, nicht durch eine einzelne Behörde.

Wer reguliert Cookies und Tracking in Deutschland?

Nicht notwendige Cookies und ähnliche Technologien auf Endeinrichtungen erfordern nach § 25 TDDDG eine vorherige informierte Einwilligung. Das TDDDG ist das im Mai 2024 umbenannte frühere TTDSG; die materielle Cookie-Regel des § 25 ist dabei unverändert geblieben. Durchgesetzt wird sie von den Datenschutz-Aufsichtsbehörden der Länder.

Avons-nous besoin d'un consentement pour la prospection par e-mail en France ?

Oui. En France, la prospection par e-mail auprès des personnes physiques exige leur consentement préalable (opt-in) en vertu de l'article L.34-5 du Code des postes et des communications électroniques (CPCE), dont la CNIL assure le respect. Vous pouvez démarcher vos clients existants pour des produits ou services analogues sans nouveau consentement si l'adresse a été recueillie lors d'une vente et qu'une option de désinscription simple et gratuite est offerte à chaque envoi. Pour le B2B, la doctrine de la CNIL admet, sur le fondement de l'intérêt légitime, la prospection d'un professionnel à son adresse professionnelle si le message est lié à sa fonction, l'expéditeur est clairement identifié et un droit d'opposition est offert à chaque message.

Qui régule les cookies en France ?

Les cookies et traceurs non essentiels nécessitent un consentement préalable au titre de l'article 82 de la loi Informatique et Libertés et des lignes directrices de la CNIL, qui en assure le contrôle.

Hebben wij toestemming nodig voor e-mailmarketing in Nederland?

Ja. In Nederland vereist marketing via e-mail of andere elektronische berichten voorafgaande toestemming (opt-in) van de ontvanger op grond van artikel 11.7 van de Telecommunicatiewet (het spamverbod). U mag bestaande klanten zonder nieuwe toestemming benaderen voor eigen, soortgelijke producten als u hun adres bij een verkoop heeft verkregen en zowel bij het verkrijgen als in elk bericht een gratis, eenvoudige afmeldmogelijkheid biedt; voor zakelijke ontvangers gelden de regels iets soepeler. Het toezicht op het spamverbod ligt bij de Autoriteit Consument en Markt (ACM).

Wie houdt toezicht op cookies in Nederland?

Niet-noodzakelijke cookies vereisen voorafgaande toestemming op grond van artikel 11.7a van de Telecommunicatiewet (de cookiewet). Het toezicht ligt momenteel bij de Autoriteit Consument en Markt (ACM), terwijl de Autoriteit Persoonsgegevens (AP) bevoegd is waar cookies persoonsgegevens betreffen onder de AVG. De AP heeft in maart 2025 voorgesteld het cookietoezicht over te nemen, maar die wijziging is nog niet in werking getreden.

Related Research

Related Tools