EdLaw
UK — PECR 2003 (cookies and electronic marketing)
The UK's ePrivacy rules (UKSI 2003/2426), substantially restructured by the Data (Use and Access) Act 2025: the cookie consent rule and its exceptions now live in Schedule A1, and PECR fines were raised to UK GDPR levels.
Applicability to EdTech
- Cookie rule (regulation 6 → Schedule A1): storing or accessing information on terminal equipment needs consent, with the DUAA's expanded exceptions — strictly necessary purposes, and now also statistical/service-improvement collection, appearance/functionality preferences, emergency assistance and security updates, each with their own conditions. A school platform's analytics may fit the new statistical exception if its conditions (information duty, objection right) are met — check Schedule A1's exact terms before relying on it.
- E-mail marketing (regulation 22): opt-in for unsolicited marketing e-mail to individual subscribers, soft opt-in for existing customers of similar products with per-message refusal; sender identity must not be concealed (regulation 23).
Contents
| Document | Covers |
|---|---|
| COOKIES-AND-MARKETING.md | regulations 6, 22, 23 |
| STORAGE-CONSENT.md | Schedule A1 in full (consent + the post-DUAA exception catalogue) |
Enforcement
ICO — since the DUAA 2025, PECR breaches carry UK-GDPR-level fines (up to £17.5m / 4% turnover).
Licence
The corpus reproduces the consolidated text of the Privacy and Electronic Communications (EC Directive) Regulations 2003 from legislation.gov.uk. The legislation.gov.uk footer (read 2026-10-01 on legislation.gov.uk) says: "All content is available under the Open Government Licence v3.0 except where otherwise stated." and "© Crown and database right". The text is Crown copyright, which is not an exclusion from copyright, so the label is open-licence.
The Open Government Licence v3.0 (read 2026-10-01) says: "You are free to: copy, publish, distribute and transmit the Information; adapt the Information; exploit the Information commercially and non-commercially". Its conditions: "acknowledge the source of the Information in your product or application by including or linking to any attribution statement specified by the Information Provider(s) and, where possible, provide a link to this licence", and, where no statement is specified, "Contains public sector information licensed under the Open Government Licence v3.0."; and, under Non-endorsement, the licence "does not grant you any right to use the Information in a way that suggests any official status or that the Information Provider and/or Licensor endorse you or your use of the Information."
Conditions, and how this corpus meets them:
- Acknowledge the source: each provision carries a
{.meta}provenance line naming legislation.gov.uk with the consolidation date, and Sources links the publication. Attribution statement: "Contains public sector information licensed under the Open Government Licence v3.0." (licence). - Non-endorsement: the corpus does not claim official status or endorsement by the Crown or The National Archives.
- Changes: the OGL does not require changes to be marked; the selection, layout and added anchors are described in Meta.
- Exemptions: no personal data, logos, crests or Royal Arms are reproduced.
The ICO guide listed in Sources is cited, not reproduced.
Related
- UK GDPR — consent standard incorporated by reference
- EU ePrivacy Directive — the origin instrument
- PT Lei 41/2004, PL PKE — EU siblings