EU ministers have backed wider exceptions to cookie consent. The UK runs its own, separate cookie regime under PECR, already widened by the Data (Use and Access) Act 2025 – and that’s the rulebook that matters for British sites.
Key points
- On 21 October 2026, the Council of the EU agreed its negotiating position for new EU exceptions to cookie consent, as part of a wider “Digital Omnibus” package.
- This EU proposal does not apply in the UK, which left the EU’s ePrivacy framework behind at Brexit.
- The UK already has its own, separate cookie exemptions since the Data (Use and Access) Act 2025 amended the Privacy and Electronic Communications Regulations (PECR), with ICO guidance covering how they apply.
Brussels is debating fewer cookie banners – British sites already run under different rules: The EU Council has agreed its position on a legislative package covering cookies, online tracking and wider digital rules. Because the UK is not an EU member, that EU proposal has no direct effect here. UK sites are instead governed by PECR, recently updated by the UK’s own Data (Use and Access) Act 2025.
What the EU Council is proposing
The Council’s mandate covers the EU’s ePrivacy rules on cookies and similar tracking technologies. Under its position, the existing consent framework would stay in place, but additional purposes would be named for which no prior consent is required on a device – for example cookies necessary for a requested service, for audience measurement, or for device security. This is only the position of EU member states so far, not a final law. The Council’s statement of 21 October sets out the details.
What already applies in the UK
The UK left the EU’s ePrivacy Directive framework behind, but kept its own version of the cookie rules in the Privacy and Electronic Communications Regulations (PECR), enforced by the Information Commissioner’s Office (ICO). The Data (Use and Access) Act 2025 (Schedule 12) widened the exemptions in PECR regulation 6, adding new cases – including some analytics and service-improvement purposes – where cookies can be set without prior consent, subject to safeguards such as a clear opt-out. The ICO has published updated guidance on the use of storage and access technologies explaining how organisations should apply the new exemptions.
How the UK and EU approaches differ
Both reforms move in a similar direction – narrower consent requirements for low-risk or necessary cookies – but they are legally separate. The EU’s change is still only a Council negotiating position, requiring agreement with the European Parliament before it becomes law across the EU. The UK’s change is already law, enacted through the Data (Use and Access) Act 2025 and reflected in the ICO’s guidance. A UK business selling into the EU, or an EU business targeting UK users, needs to watch both rulebooks separately rather than assume one covers the other.
What happens next in Brussels
For an EU law, the Council and the European Parliament must agree a joint text. The European Parliament’s procedure file currently lists the dossier as “Awaiting committee decision”. Until EU lawmakers reach agreement, the current EU ePrivacy rules remain in force for EU member states – a separate question from the UK’s own PECR regime, which already reflects its 2025 reform.
Frequently asked questions
Does the EU Council’s cookie proposal change anything for UK websites?
No. It is an EU legislative proposal that does not apply in the UK. UK sites are governed by PECR as amended by the Data (Use and Access) Act 2025.
Has the UK already loosened its cookie consent rules?
Yes. The Data (Use and Access) Act 2025 widened the exemptions in PECR regulation 6, and the ICO has published guidance on how businesses should apply them.
Do I still need a cookie banner on a UK site?
In most cases yes, for cookies outside the new exemptions (such as advertising cookies). The exemptions cover specific, lower-risk purposes under safeguards set out in ICO guidance.
Your view
Which cookie prompts do you think should require consent, and which shouldn’t? Share specific examples in the comments.
Sources and status
- Council of the European Union: negotiating position on the digital rulebook, 21 October 2026
- European Parliament: procedure file 2025/0360(COD)
- Data (Use and Access) Act 2025, Schedule 12 (PECR amendments)
- ICO: guidance on the use of cookies and similar technologies
Research and data as of: 3 November 2026.
Transparency note: AI-assisted tools were used in researching, structuring and writing this article. The sources used are listed in the article. Publication takes place only after manual editorial approval. Country edition based on an article from Net Trends, researched for the UK. Featured image: own digital illustration, design by Net Trends.
Share this article
