PECR

PECR, or the Privacy and Electronic Communications Regulations, is a UK statutory instrument enacted in 2003 and amended since to reflect the evolving privacy framework. It implements aspects of the EU ePrivacy Directive and regulates privacy rights in relation to electronic communications, including telephone, email, text messages, cookies, and similar technologies. PECR operates alongside the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Scope and core provisions: PECR applies to organizations that provide publicly available electronic communications services or process personal data in connection with those services. It covers the contents of communications, traffic data, location data, and related metadata. The Regulations set rules for consent for storing or accessing information on users’ devices (cookies and similar technologies) and for direct marketing by electronic means.

Cookies and tracking: Non-essential cookies and other tracking technologies generally require user consent before being placed or read, unless they are strictly necessary for providing the service requested by the user. Consent must be informed, freely given, specific, and verifiable. There are exceptions and provisions for “soft opt‑in” marketing in certain circumstances.

Direct marketing: PECR restricts unsolicited marketing by electronic mail, text message, or automated calling methods. Communications may be allowed with consent or with certain opt-out rights in place for existing customer relationships (soft opt-in). Marketers must provide easy ways to withdraw consent.

Enforcement and impact: The Information Commissioner’s Office (ICO) enforces PECR in the UK and can issue enforcement notices, penalties, and other corrective measures for non-compliance. The requirements are complemented by GDPR obligations; when personal data is involved, GDPR governs the lawfulness of processing, while PECR covers electronic communications-specific rules.