{"page":"/blog/gdpr-eprivacy-bidstream-tcf","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Topic","EU","UK (from 5 February 2026)","Source"],"rows":[["Cookie rule","ePrivacy Article 5(3): consent unless strictly necessary","PECR regulation 6, substituted on 5 February 2026; new Schedule A1 lists exceptions","legislation.gov.uk, reg. 6; SI 2026/82"],["Consent exceptions","Strictly necessary; transmission","Adds statistical purposes, appearance, emergency assistance, with a simple means of objecting","ICO guidance, updated 29 April 2026"],["Who is liable","The party storing or accessing","Includes anyone \"instigating\" storage or access, so a publisher answers for third-party tags it embeds","legislation.gov.uk, reg. 6(2)"],["Maximum fine","GDPR: €20 million or 4%","PECR aligned with UK GDPR: £17.5 million or 4% of global turnover (previously £500,000)","Mayer Brown, July 2025"],["Guidance","EDPB Guidelines 2/2023","ICO storage and access technologies guidance (published 20 December 2024, finalized 29 April 2026) covering cookies, pixels, link decoration, fingerprinting, web storage and scripts","ICO"]],"sourceUrls":[["https://www.legislation.gov.uk/uksi/2003/2426/regulation/6","https://www.legislation.gov.uk/uksi/2026/82/made"],["https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/"],["https://www.legislation.gov.uk/uksi/2003/2426/regulation/6"],["https://www.mayerbrown.com/en/insights/publications/2025/06/the-data-use-and-access-act-pecr-reform-rules-relating-to-electronic-marketing-and-cookies-in-the-uk"],["https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/"]]}