Cookie consent tools that meet UK PECR

What PECR asks for

Regulation 6 of PECR covers storing information on, or reading it from, a visitor's device. Cookies, local storage and tracking pixels all count. You can do it without asking only when it is strictly necessary for a service the visitor requested, such as keeping a basket or remembering a login. Analytics and advertising are not strictly necessary, whatever the vendor says.

Consent here means UK GDPR consent: freely given, specific, informed and given by a clear action. Scrolling past a banner is not consent. A pre-ticked box is not consent. "By using this site you agree" is not consent. The ICO's cookies guidance spells each of these out.

The ICO on Reject all

In November 2023 the ICO wrote to the operators of the UK's most visited websites and told them that a banner which makes rejecting harder than accepting breaks the law. The test is simple: if there is an Accept all button on the first layer, there has to be a Reject all button of equal prominence on the same layer. Most of the enforcement activity since then has been about exactly this.

For a small business the practical consequence is that the consent tool has to offer Reject all on the first screen by default. If you have to go hunting through settings to switch it on, or pay for a higher tier to get it, treat that as a mark against the tool.

Consent Mode v2 and Google Analytics

Consent Mode is Google's way of letting its tags behave differently depending on what the visitor chose. Since March 2024 Google requires version 2 of the signals for anyone using Google Ads or GA4 with visitors from the UK or the European Economic Area. A banner that does not send them leaves your Google reporting for those visitors blank. The column marks the tools whose own documentation says they send Consent Mode v2 signals.