Home / PECR penalties have changed – are your email, SMS and cookie practices exposed?

PECR penalties have changed – are your email, SMS and cookie practices exposed?

25th September 2026

Laura Crowe, Senior Associate

PECR risk now carries much greater financial impact. Consent journeys, suppression lists, cookie settings, analytics tags, and campaign governance all need to work in practice, not just in policy.

Organisations relying on email, SMS, cookies, analytics, or tracking should revisit these processes before a problem emerges.

Such issues are often operational issues spread across marketing, digital, sales, fundraising, compliance, and IT.

I have drafted a piece looking at where organisations may be more exposed than they think and the practical checks worth making before campaign planning moves any further into autumn and year-end activity.

Would your current campaign and tracking processes stand up to proper scrutiny if you had to defend them?

Changes introduced by the Data Use and Access Act 2025 (DUAA)

Change	Impact and action
Increased maximum fines (Section 115 and Schedule 13): potential penalties have increased from £500,000 to mirror the much larger penalties under UK GDPR i.e. up to £17.5 million or 4% of global annual turnover, whichever is the greater. Easier enforcement: there is no longer a requirement to prove that a PECR breach caused “substantial damage and distress” before a claim can be brought. This condition has been removed completely.	Businesses should review their marketing activities and approaches considering this heightened risk. Cookie banners and emails lists should be reviewed carefully, as breaches now carry the same financial penalties and exposure as major cyber security incidents.
Relaxed cookie consent requirements (Section 112 and Schedule 12): DUAA has inserted a new “Schedule A1” into PECR which introduces exceptions to the strict cookie consent rules. User consent is unnecessary where a specific Schedule A1 exception applies.	Businesses can transition away from complex cookie banners for basic website analytics, streamlining customer experience. However, prior affirmative consent is still strictly required for high-risk tracking such as cross-site behavioural advertising, profiling, and third-party marketing pixels.
Direct marketing consistency (Section 110): the legal definition of direct marketing as set out in the Data Protection Act 2018 is now officially part of PECR. The definition of communications has also been widened with the effect that blocked or failed to deliver messages will be caught by the legislation.	Marketing teams cannot absolve the business of liability by claiming that certain messages were filtered out or never opened / received by a recipient. It is sufficient for liability that a business initiates non-compliant marketing that causes systematic nuisance or disruption.
Direct marketing relief for charities (Section 114, especially section 114(3)–(4)): the soft opt-in has been extended to charities and non-profit organisations.	Charities are now permitted to send fundraising and marketing emails/texts to existing supporters who have previously engaged with them or donate, without needing to secure an explicit, specific opt-in first, if they offer a clear way to opt out.
Aligned data breach reporting timeframes (Section 111): For public telecommunications and electronic communications service providers, the timeframe to report a personal data breach has moved from a strict 24 hours to without undue delay , and, where feasible, no later than 72 hours.	This changes directly aligns with Article 33 of UK GDPR and eliminates operational confusion by provided for a uniform response timeline in the event of a data emergency incident.

Organisations should now review their cookies and tracking technologies, consent and soft opt-in records, suppression controls, and breach-response procedures. Marketing, digital, fundraising, sales, IT, and compliance teams should agree clear ownership for addressing any gaps before campaigns launch.

The question is no longer whether you are compliant, but whether you can prove it.

If you have any queries or need advice, please contact our commercial team at [email protected] or 0161 832 3434.