PECR fines after the Data (Use and Access) Act: up to £17.5m

What PECR covers

The Privacy and Electronic Communications Regulations 2003 (PECR) sit alongside the UK GDPR. For most small businesses, the parts that matter are:

Cookies and similar technologies (regulation 6): consent is needed unless an exception applies.
Marketing emails and texts to individuals (regulation 22): you need consent, unless the “soft opt-in” applies. That means you got the details when selling, or negotiating to sell, to that person; you only market your own similar products and services; and you offered a simple way to opt out when you collected the details and in every message.
Marketing calls (regulation 21): you must not call numbers registered with the Telephone Preference Service, or people who have told you not to call, and you must show your number.

The ICO’s guidance on electronic mail marketing covers the email rules in detail.

What the Data (Use and Access) Act changed

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. The ICO’s statement on commencement confirms that most of its provisions came into force on 5 February 2026. The changes most relevant here:

Higher maximum fines. PECR breaches can now attract the higher UK GDPR maximum in section 157 of the Data Protection Act 2018: £17.5 million or 4% of total worldwide annual turnover, whichever is higher. The amendments are in Schedule 13 to the Act. The higher maximum applies to the main PECR rules, including regulations 5 (security), 6 (cookies), 21 (calls) and 22 (emails and texts). See PECR Schedule 1.
Timing. Under the commencement regulations (SI 2026/82), conduct before 5 February 2026 is dealt with under the old regime, where the previous maximum was £500,000. Conduct on or after that date falls under the new one.
New exceptions for cookies. Some low-risk uses no longer need consent, including analytics to improve your own site (with clear information and an easy way to object) and remembering appearance preferences. Advertising tags still need consent. See our cookie banner guide.
Charity soft opt-in. Charities can now use a version of the soft opt-in for supporters who have shown an interest in, or supported, their charitable purposes.
Stronger investigation powers. The ICO can now require people to attend interviews and can require technical reports.

GOV.UK has published a factsheet on the PEC Regulations changes.

Does this mean small businesses face multi-million-pound fines?

£17.5 million is a ceiling, not a starting point. The ICO decides each case on its circumstances. We can’t predict what any particular breach would cost, and you should be wary of anyone who claims to. What has changed is the range. A serious or repeated breach is no longer capped at £500,000, and the 4% of worldwide turnover limit means the maximum scales with large businesses.

The ICO publishes its decisions on its enforcement page. Reading a few recent cookie or marketing cases is a useful way to see what triggers action.

Where small businesses usually slip up

Advertising pixels (social media, search ads, retargeting) firing before the visitor chooses.
A cookie banner that doesn’t actually block anything when someone clicks “Reject”.
Emailing a bought-in list or scraped addresses without valid consent.
Relying on the soft opt-in for people who never bought or asked about buying anything.
No unsubscribe link, or one that doesn’t work.
Marketing calls to TPS-registered numbers without screening.
Consent records you can’t produce: who agreed, when, and to what.

A practical response

You don’t need a compliance department. Most PECR risk on a small business website comes from a few tags and one sign-up form. Check what loads before consent, fix the banner, review where your email list came from, and keep a record of consent. Then re-check whenever you add a plugin, change your theme or start a new ad campaign, because those are the moments sites tend to drift.

Quick checklist

List every tag and pixel your site loads, and check none fire before consent unless exempt
Make sure “Reject” actually blocks tags
Check that every marketing email recipient gave consent or fits the soft opt-in
Put a working unsubscribe link in every email and text
Screen call lists against the TPS
Keep consent records (who, when, what wording)
Re-check after site changes or new campaigns

FAQ

What is the maximum PECR fine now?

For breaches on or after 5 February 2026, the maximum for the main PECR rules is the higher UK GDPR level: £17.5 million or 4% of total worldwide annual turnover, whichever is higher. The previous maximum was £500,000.

Does the new maximum apply to things that happened before February 2026?

No. Under the commencement regulations, conduct before 5 February 2026 is dealt with under the old regime.

Which PECR rules carry the higher fines?

The higher maximum applies to the main rules, including security (regulation 5), cookies (regulation 6), marketing calls (regulation 21) and marketing emails and texts (regulation 22), among others listed in PECR Schedule 1.

Can I email people who gave me their business card?

PECR regulation 22 protects individual subscribers, including sole traders and some partnerships. Emails to corporate subscribers (such as limited companies) aren’t covered by regulation 22 in the same way, but UK GDPR still applies to the person’s data. Check the ICO’s electronic mail marketing guidance for your situation.

Is this legal advice?

No. It’s a general summary of the rules with links to official sources.

Official sources

Laws and guidance change. Check the sources above for the latest position. For advice on your own circumstances, consult a solicitor.