Opt in for UK visitors
Velo reads the visitor's country at the edge. Visitors in the United Kingdom get opt in defaults, with every Consent Mode v2 signal denied until they choose.
UK cookie consent,
under PECR and the UK GDPR.
In the UK, the cookie rule sits in PECR and the consent standard in the UK GDPR. Velo treats UK visitors as opt in: every consent signal starts denied until they choose.
The rule,
at a glance.
General information, checked September 2026. Not legal advice.
- Applies to
- Websites with visitors in the United Kingdom.
- The rules
- Regulations 6 and 6A of PECR for cookies, and the UK GDPR for what consent means.
- Consent model
- Opt in, with a few narrow exemptions in force since February 2026.
- Enforced by
- The Information Commissioner's Office (ICO).
- Maximum fine
- 17.5 million pounds or 4% of worldwide annual turnover, whichever is higher. Since February 2026 the same ceiling applies to PECR.
- Velo default
- Every Consent Mode v2 signal starts denied for visitors in the United Kingdom.
What UK rules ask.
What Velo does.
Choices by purpose
Consent has to be specific. Visitors choose analytics, ads, functional and personalisation separately, and your tags follow each choice.
A record for every decision
The UK GDPR expects you to show that consent was given. Each decision is stored with a receipt id, the region and the banner version it answered.
Easy to change later
Visitors can reopen their preferences from a small floating button, so withdrawing is as simple as agreeing.
What the law
actually says.
PECR is the UK's cookie law. It says you need consent before storing or reading anything on a visitor's device, unless it is strictly necessary for a service they requested. The UK GDPR sets the bar for that consent, and it is the same bar as in the EU: a clear, specific and informed action.
Since February 2026 the Data (Use and Access) Act 2025 allows a few exemptions, such as statistics that improve a site or service and adapting how a site looks or works, provided visitors get clear information and a free, simple way to object. Advertising and cross site tracking are not on that list, so a site that runs ads still has to ask first.
Up and running
in four steps.
From the first script tag to the first recorded choice.
-
Add Velo to your site
Install it with the Google Tag Manager template or paste one script tag. Guides cover WordPress, Shopify, Webflow and other platforms.
-
Scan and sort your cookies
Velo scans your pages, lists the cookies and scripts it finds and suggests a category for each one. You confirm or change them.
-
Design the banner
Pick colours, wording and languages. Reject sits next to accept on the first layer.
-
Publish and check
Visitors in the United Kingdom get opt in defaults, with every consent signal denied until they choose. Each choice lands in your consent log with its receipt id.
Before you
go live.
Velo handles the banner, the regional defaults and the records. These parts stay with you.
- Your privacy or cookie notice names each purpose and each third party that sets cookies.
- Tags in Google Tag Manager wait for the matching consent signal before they fire.
- You tested from the region itself: nothing optional loads before a visitor chooses.
- Someone on the team reviews new scripts when a scan finds them.
- If you rely on one of the new exemptions, your notice explains it and gives visitors a simple way to object.
In every plan, from €0
Consent Mode v2 advancedRegional defaults by countryGlobal Privacy Control honouredReceipt for every choiceReject as easy as acceptFloating preferences button
Nine banner languagesCookie and tracker scanChoices by categoryConsent log and dashboardWorks with Google Tag ManagerInstallation help
Questions,
answered.
What teams ask about UK cookie rules.
Which UK law covers cookies?
The Privacy and Electronic Communications Regulations (PECR) require consent before storing or reading non essential cookies. The UK GDPR defines what valid consent is. The Information Commissioner's Office enforces both.
Did the Data (Use and Access) Act 2025 remove the need for a banner?
It adds some narrow exemptions for low risk purposes, such as certain analytics, as its provisions come into force. Advertising and cross site tracking still need consent, so most sites that run ads still need a banner.
Does Velo treat the UK like the EU?
Yes. Velo applies the same opt in defaults to the United Kingdom as to the EU, the EEA and Switzerland.
Is this legal advice?
No. This page is general information about how the rules work and how Velo behaves. Check your own setup with your adviser.
Website privacy, in one place.
Scan your site →
Regulations
GDPR
UK GDPR
CCPA / CPRA
US state laws
LGPD
Ley 1581 (Colombia)
Ley 25.326 (Argentina)
Ley 29733 (Peru)
