By country

Cookie Policy Generator UK

UK GDPR, the Data Protection Act 2018 and PECR - drafted for the ICO, not for a generic "GDPR" audience.

Generate your cookie policy Read the cookie policy guide

UK cookie rules live in PECR, not in UK GDPR, and since the Data (Use and Access) Act 2025 they carry UK GDPR-level penalties. That makes the per-cookie table and the consent log the two documents an ICO complaint will actually turn on.

Since Brexit the UK runs its own data protection regime. UK GDPR sits alongside the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) govern cookies and marketing separately, and the Information Commissioner’s Office is the regulator you name in your policy - not the EDPB, and not "your local supervisory authority".

The Data (Use and Access) Act 2025 changed the enforcement arithmetic. PECR penalties, previously capped at £500,000, now run to UK GDPR levels - £17.5 million or 4% of global turnover. Cookie banners and marketing consent, historically the cheapest rules to ignore in the UK, became the most expensive.

A UK-facing policy also has to handle transfers in the opposite direction from an EU one. The UK issues its own adequacy decisions, uses the International Data Transfer Agreement or the Addendum to the EU SCCs rather than the SCCs alone, and has its own UK-US Data Bridge for certified American importers.

What a cookie policy in the UK has to cover

A table of every cookie and similar technology with name, provider, purpose, category and duration
The PECR distinction between strictly necessary storage, which needs no consent, and everything else, which does - before it is set
How consent was captured, how long it is stored, and the permanent link that reopens preferences
Third-party tags including embedded video, maps, chat widgets and server-side tagging
A statement that rejecting is as easy as accepting, matching what the banner actually does

The ICO wrote to the operators of the UK’s most-visited websites about banners that made rejection harder than acceptance. If your banner has "Accept all" as a button and "Reject" behind a settings link, the policy describing it is describing a breach.

How the UK actually moves personal data

UK-resident customer and account records

Names, addresses, order history and support tickets held by a UK business are almost always processed under contract or legitimate interests - but the basis has to be stated per purpose, and marketing is a separate purpose with a separate basis.

Analytics and advertising identifiers

GA4, Meta and TikTok pixels and any server-side tagging all read or write to the device. Under PECR that needs consent before the tag fires, which is a stricter test than "we have a legitimate interest in analytics".

Payments through UK and EEA processors

Stripe, GoCardless, Worldpay and PayPal each act as independent controllers for fraud prevention, so the policy has to describe a hand-off, not just a sub-processor.

Transfers to US SaaS vendors

Most UK businesses send data to American hosting, email and support tools. Each destination needs a named mechanism: the UK-US Data Bridge for certified importers, otherwise the IDTA or the UK Addendum plus a transfer risk assessment.

Employee and applicant data

The ICO’s employment practices guidance treats recruitment records, monitoring and reference checks as high-scrutiny processing, and expects a separate privacy notice for staff rather than a line in the customer policy.

Cookie consent records

PECR compliance is proved by the consent log - timestamp, version of the banner, and the categories accepted. Without it, an ICO complaint is your word against the complainant’s.

Third parties the draft will ask you about

Stripe · GoCardless · Worldpay · Royal Mail and DPD · Google Analytics 4 · Mailchimp · HubSpot · AWS eu-west-2 (London) · Microsoft 365 · Xero

The rules that apply

UK GDPR + Data Protection Act 2018

The transparency duties in Articles 13 and 14, the lawful basis requirement in Article 6, and the DPA 2018 schedules that carry the UK-specific conditions for criminal-offence and special-category data.

PECR (as amended by the Data (Use and Access) Act 2025)

Consent before any non-essential storage or access on a device, and opt-in for electronic marketing outside the narrow soft opt-in. Penalties now match UK GDPR levels.

The ICO

Your named supervisory authority. Users must be told they can complain to the ICO, and the ICO expects a working contact route for you before that escalation.

Consumer Rights Act 2015 + Consumer Contracts Regulations 2013

Fourteen-day cancellation on distance sales, statutory quality rights that no policy can exclude, and the unfair-terms test that voids overreaching liability caps.

Online Safety Act 2023

If users can post or message each other, Ofcom-regulated duties on illegal content and children’s access apply, and your published rules and reporting route are part of the compliance record.

What the generated cookie policy contains

What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.

Making a UK policy operational

Check whether you need to pay the ICO data protection fee
Most UK controllers must register and pay an annual fee of £52, £78 or £2,900 depending on size and turnover. It is a separate legal duty from publishing a policy and is enforced independently.
Decide whether you need an EU representative
If you also target EU customers, Article 27 of the EU GDPR may require an EU-based representative even though you are UK-established. Name them in the policy if so.
Record your lawful basis before you publish
The ICO expects the decision to predate the notice. Keep the legitimate interests assessment for each LI-based purpose on file.
Run a cookie scan and reconcile it against the banner
Compare what actually fires before consent against what the banner claims. Any tag firing pre-consent is the finding an ICO complaint will start from.
Set the breach clock
Seventy-two hours to the ICO from awareness, and without undue delay to individuals where the risk is high. The escalation path has to exist before the incident.

Where this usually goes wrong

Naming the EDPB or "the supervisory authority" instead of the ICO

A UK policy that never names the ICO reads as a copied EU document. It also fails the practical test of Article 13(2)(d): the person has to know where to complain.

Treating the EU SCCs as sufficient for UK transfers

The EU clauses alone do not cover a UK export. You need the UK Addendum bolted on, or the standalone IDTA. This is the single most common defect in UK policies copied from EU templates.

Relying on legitimate interests for analytics cookies

PECR requires consent for storage and access regardless of the GDPR basis for the processing that follows. The ICO wrote to the UK’s largest websites about exactly this pattern.

A cookie banner with no equally prominent reject

The ICO’s published position is that accept and reject must take the same number of clicks. A banner with "Accept all" and a buried "Manage settings" is the version that draws the letter.

Missing the soft opt-in conditions for email marketing

The B2C soft opt-in only applies to your own similar products, sold to someone who bought from you, with an opt-out offered at collection and in every message. Businesses routinely claim it for purchased lists, where it does not apply.

Frequently asked questions

Does UK GDPR still apply after Brexit?

Yes. UK GDPR was retained in domestic law and then amended by the Data Protection Act 2018 and the Data (Use and Access) Act 2025. It is a live UK statute enforced by the ICO, not a transitional arrangement.

Do I need both UK and EU GDPR compliance?

If you have customers in both, yes. They are separate laws with separate regulators. In practice one policy can serve both provided it names both regimes, both regulators and the correct transfer mechanism in each direction.

Do I have to register with the ICO?

Most organisations processing personal data by automated means must pay the annual data protection fee unless an exemption applies. Publishing a policy does not discharge that duty.

How much can the ICO fine a small business?

Up to £17.5 million or 4% of global annual turnover under UK GDPR, and since the Data (Use and Access) Act 2025 the same ceiling applies to PECR breaches such as cookie and marketing failures. In practice the ICO’s small-business enforcement is dominated by nuisance-marketing penalties in the tens of thousands.

Is a UK privacy policy different from an EU one?

Structurally no, substantively yes in three places: the regulator named, the transfer mechanism used, and the cookie rules cited - PECR rather than the ePrivacy Directive as implemented locally.

Do I need a cookie policy as well as a privacy policy?

In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.

Do analytics cookies need consent?

In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.

Does a cookie policy need updating when I add a tool?

Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.

What about cookies set by embedded video and maps?

They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.