PECR fines went up to £17.5m in February — and the cookie rules got easier the same day

The short version

• The maximum penalty for a marketing or cookie breach is now £17,500,000 or 4% of worldwide turnover, whichever is higher. That is the top band, not the lower one.
• It has been in force since 5 February 2026, courtesy of the Data (Use and Access) Act 2025 and a commencement order. This is not something to prepare for.
• If you are not an “undertaking”, there is no turnover alternative — the figure is simply £17,500,000.
• Cookie consent got genuinely easier at the same moment. Analytics about your own site, and adapting how your site looks, now sit in standing statutory exceptions with an opt-out rather than consent up front.
• Two things we could not verify and will not pretend to: what the ICO actually fines in practice, and what the previous cap was. Both are explained below.

What the rules are, and where they live

The rules on marketing emails, texts, calls and cookies are in the Privacy and Electronic Communications (EC Directive) Regulations 2003 — PECR, if you have met them before. They sit alongside data protection law rather than inside it, which is why they have their own penalties and their own quirks.

The Data (Use and Access) Act 2025 rewrote a substantial part of them. Chapter 2 of Part 5 of that Act is given over to it, and among other things it inserted a definition of direct marketing into PECR for the first time: the communication (by whatever means) of advertising or marketing material which is directed to particular individuals. Plain enough, and broad enough to cover the channels people forget about.

The number

PECR now carries its own Schedule 1, headed the Commissioner’s enforcement powers, which borrows machinery from the Data Protection Act 2018 and modifies it. Paragraph 18 of that Schedule deals with the maximum penalty. It makes section 157 of the 2018 Act apply as if the higher-penalty limb covered a failure to comply with:

“regulation 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23 , 24 or 32B(4) or (5)”

(The stray space before the comma is in the legislation as published; we have left it exactly as it appears.)

Two of those matter to almost every small business. Regulation 22 is unsolicited marketing by electronic mail. Regulation 6 is storing information on, or reading information from, somebody’s device — the cookie rule.

And here is what the higher limb means, in the words of section 157 itself:

“The ‘higher maximum amount’ is— a in the case of an undertaking, £17,500,000 or 4% of the undertaking’s total annual worldwide turnover in the preceding financial year, whichever is higher, or b in any other case, £17,500,000.”

The same section defines a lower tier, the “standard maximum amount”, as “£8,700,000 or 2% of the undertaking’s total annual worldwide turnover… whichever is higher, or in any other case, £8,700,000”. Marketing email and cookies are not in that tier. They are in the top one.

The detail in limb (b)

Read limb (b) again: in any other case, £17,500,000.

The 4% alternative only exists for an undertaking, and it exists to make the figure bigger for large companies — it is “whichever is higher”, not whichever is lower. There is no version of this provision in which a small turnover produces a small ceiling. If you are not an undertaking at all, the number is the flat £17,500,000 with no percentage to scale it down.

We are not going to tell you whether you personally count as an undertaking, because that is a real legal question and it depends on what you do rather than what you are called. The point worth taking away is structural: nothing in the drafting makes the ceiling proportionate to how small you are.

When it started

5 February 2026. Legislation.gov.uk records the commencement on the face of section 157, noting that Parts 5 to 7 were “applied in part (with modifications) (5.2.2026)” by PECR’s new Schedule 1, as substituted by the Data (Use and Access) Act 2025, brought into force by S.I. 2026/82.

So this is seven months old. If you were waiting to be told, that is the answer to when.

The half that got easier

The same rewrite replaced regulation 6 entirely. It now reads: “Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user.” The prohibition is blunter than before, and all the give is in the new Schedule A1 — which is where things improved.

Consent is still one route. But Schedule A1 also sets out standing exceptions that do not need it. Two are worth knowing about.

Statistics about your own site. Paragraph 5 disapplies the prohibition where “the sole purpose of the storage or access is to enable the person— i to collect information for statistical purposes about how the service is used with a view to making improvements to the service” (and the equivalent for a website), provided two further things are true: the user gets “clear and comprehensive information about the purpose”, and “the subscriber or user is given a simple means of objecting, free of charge, to the storage or access and does not object”.

Read that last condition carefully, because it is the change. It is an opt-out. You tell people, you give them an easy way to say no, and unless they say no you may proceed.

Making the site work nicely. Paragraph 6 does the same for storage whose sole purpose is “to enable the way the website appears or functions when displayed on, or accessed by, the terminal equipment to adapt to the preferences of the subscriber or user”, on the same information-and-objection terms.

And separately, things strictly necessary to provide the service somebody asked for were already outside the rule, with the Schedule now giving examples including “maintaining a record of selections made on a website, or information put into a website, by the subscriber or user”. A basket that remembers what you put in it was never the problem.

One definitional note that catches people out: in this Schedule the word website “includes a mobile application and any other platform by means of which an information society service is provided”. If you have an app, you are in scope.

The catch in the analytics exception

It is the sharing condition, and it is easy to miss. Paragraph 5 applies only if “any information that the storage or access enables the person to collect is not shared with any other person except for the purpose of enabling that other person to assist with making improvements to the service or website”.

Plus the word sole in “the sole purpose”. If the same collection also feeds advertising, or audience building, or anything the provider does for its own ends, the exception is not doing you any good.

So the useful question to put to whoever supplies your analytics is not whether the product is popular. It is what happens to the data afterwards, and what else it gets used for. We are deliberately not naming products that do or do not qualify, because that turns on their contracts and data flows rather than on the statute, and we have not read those contracts.

What argues the other way — and two things we could not check

A statutory maximum is a ceiling, not a price list. Regulators reach the top of a range for the worst cases, and a small business sending an ill-advised newsletter is not the worst case. It would be dishonest to leave you with the impression that £17.5 million is a likely outcome, and we are not trying to.

What we could not read. We tried to look at the ICO’s own enforcement record to tell you what fines are actually issued under these regulations. Its enforcement pages returned about a kilobyte of readable text because the content is loaded by script, so we could not read the list. Rather than characterise the regulator’s practice from memory, we are telling you we could not check it. That is a gap in this article and you should treat it as one.

What we could not source. We also wanted to give you the previous ceiling, to show the size of the jump. The instrument that set it has been revoked, and legislation.gov.uk now serves its operative provisions as rows of dots rather than text. We are not going to quote a figure we cannot read, and we are certainly not going to compute a multiple from it. If you want the comparison, you will have to get it somewhere we could not.

Finally, the honest counterweight to the scary number: the same reform made the day-to-day compliance job lighter for most small sites. If you have been running a consent banner over your own analytics because you were told you had to, that may no longer be necessary. The risk went up at the top end and the friction came down at the bottom, which is an unusual combination and worth understanding rather than fearing.

What to do this week

1. Look at how your marketing list was built. Regulation 22 is the one in the top penalty band. The question is not whether people like your emails; it is whether you can show how each address got there.
2. Ask your analytics provider the sharing question. Is the data shared with anyone, and if so is it only to help improve your site? That single answer decides whether the new exception is available to you.
3. Check your objection route actually works. Both new exceptions require a simple, free way to object. A buried link in a policy page is not that.
4. Do not assume your banner is still the right shape. Some of what it asks permission for may now be exempt, and some of what it quietly does may never have been covered.
5. Take advice if any of this is load-bearing for you. This is a description of what the legislation says, not legal advice, and the question of whether you are an “undertaking” genuinely matters here.

If you want the wider picture on how we approach this sort of thing — reading the rule rather than the commentary about the rule — it is the same method we used on what the AI Act actually asks you to disclose, where the interesting part also turned out to be a few words most summaries skipped.