UK Data (Use and Access) Act 2025 and Marketing: What Changed for Consent, Cookies and Automated Decisions

The Data (Use and Access) Act 2025 (DUAA) changed UK marketing rules mainly on 5 February 2026: PECR fines now follow UK GDPR levels (up to £17.5 million or 4% of worldwide turnover), some analytics and functionality cookies no longer need consent, significant automated decisions have wider lawful bases, and recognised legitimate interests arrived. Advertising cookies still need consent, and direct marketing is not a recognised legitimate interest 134.

Who this is for: marketing, privacy and martech leads running consent, cookies, email or profiling for UK customers. You get dates, a before-and-after table, design notes for a customer data platform (CDP) and a checklist. See also the regulation hub.

What commenced and when

The Act received Royal Assent on 19 June 2025 15. The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82) brought most data protection and PECR provisions into force on 5 February 2026 and the complaints provisions on 19 June 2026 2.

Cookies and similar technologies: what no longer needs consent

Schedule 12 inserts a new Schedule A1 into PECR listing exceptions to the consent rule for storing or accessing information on a user's device; "website" includes mobile apps 3. The ICO finalised its updated guidance on 29 April 2026 8.

The ICO suggests a "simple means of objecting" could be a toggle, on by default, that users can switch off; browser settings alone are not enough 8. Advertising purposes need consent: the ICO says neither exception applies, including to frequency capping, ad measurement, click-fraud detection and fingerprinting for advertising 8. Our Google Analytics article covers the analytics side in the EU.

What changed, before and after

| Analytics and functionality cookies | Consent unless strictly necessary | Exempt if sole-purpose, notice and objection conditions are met 3 | Aggregate analytics can run without a banner; profile-level tracking cannot | | Advertising cookies | Consent | Consent 8 | No change | | Legitimate interests | Assessed case by case | Direct marketing named as an example that may be necessary for a legitimate interest 6 | Helps UK GDPR basis; PECR still governs email and SMS | | Recognised legitimate interests | Not available | New basis for five listed purposes, no balancing test; marketing not listed 414 | Do not use it for marketing | | Significant automated decisions | Narrow set of bases | Wider bases with safeguards; special category data restricted 59 | Review profiling that decides eligibility or price | | Complaints | No equivalent organisational requirement (the ICO calls it new) | Complaints route, 30-day acknowledgement 911 | Link complaints to customer records |

Automated decision-making under the DUAA

Section 80 replaces Article 22 UK GDPR with Articles 22A to 22D. A decision is solely automated where there is no meaningful human involvement, and significant where it has a legal or similarly significant effect 5. The ICO says the Act opens up the full range of lawful bases for significant automated decisions, with safeguards, but not for special category data 9.

Restrictions remain. A significant decision based on special category data cannot be solely automated unless the person gave explicit consent, or it is necessary for a contract or required or authorised by law and an Article 9(2)(g) condition applies. It also cannot be solely automated if it relies on a recognised legitimate interest 5. Safeguards must give information about such decisions, a way to make representations, human intervention and a way to contest 5.

Recognised legitimate interests and direct marketing

Schedule 4 adds Annex 1 to UK GDPR with five recognised legitimate interests: disclosure to a body requesting data for a public task; national security, public security and defence; emergencies; crime; and safeguarding vulnerable individuals 4. According to the European Commission's reading, processing under Article 6(1)(ea) does not need the case-by-case balancing of Article 6(1)(f) 14. Marketing is not listed 4.

Direct marketing instead appears as an example of processing that "may be" necessary for a legitimate interest under Article 6(1)(f), alongside intra-group transmission for internal administration and network security 6. The usual legitimate interests assessment therefore still applies, and PECR consent or soft opt-in rules still govern email and text marketing whatever the UK GDPR basis. Charities gained a soft opt-in for supporters who offered support or expressed interest, provided an opt-out is given each time 10.

PECR enforcement: fines of £17.5 million or 4%

Schedule 13 replaces Schedule 1 to PECR and applies Data Protection Act 2018 enforcement provisions with modifications, so PECR penalties follow UK GDPR-style rules 710. The ICO says PECR fines can reach £17.5 million or 4% of global turnover, and that it can now compel witnesses to attend interviews and request technical reports 1. Officers can be penalised with the company for breaches of the direct marketing regulations (19 to 24) that happened with their consent or connivance or through neglect 7. The ICO says it reserves monetary penalties for the most serious infringements 8. Cookie banners, pixels and email consent are now a board-level risk.

Complaints procedure from 19 June 2026

Section 103 and Schedule 10 commenced on 19 June 2026 2. ICO guidance says every organisation needs a way for people to complain, must acknowledge within 30 days, respond without undue delay and tell the complainant the outcome, with no exemptions 11. For a customer data platform, that means linking each complaint to the profile and the processing activity it concerns.

What this means for consent capture and a customer data platform

• Model three states, not two. Consent (advertising, interest-based personalisation), exempt with objection (statistics, functionality) and strictly necessary. The exempt categories need an objection state that is honoured: if a user objects you must stop storing or accessing information 8. Store objections as events, not as missing consent.
• Gate collection at source. The statistical exception excludes profiling individuals and logs of individual actions 8. In our reading, a first-party event stream tied to a known profile for audience building falls outside it and needs consent. Our suppression architecture note shows how to propagate withdrawal.
• Keep decision evidence. Record inputs, model version, outcome and the human-review path so you can support representations and contests 5. An append-only audit ledger, as in PrivyCDP, is one way to hold that evidence.
• Make requests searchable. The ICO says organisations need only make reasonable and proportionate searches for access requests 9; a queryable data map still helps.
• Location is not the rule. PECR and UK GDPR duties apply wherever the platform runs. A customer-owned deployment mainly simplifies evidence, deletion and key custody.

EU adequacy. On 19 December 2025 the Commission adopted a decision renewing the UK adequacy finding, valid until 27 December 2031 unless extended; it assessed the DUAA, including the move to an Information Commission whose functions remain unchanged 14. It keeps EU-to-UK customer data flows simpler, though adequacy can be reviewed. Related: GDPR transfers after Latombe and our deadline tracker.

DUAA marketing checklist

• Inventory every cookie, SDK, pixel and storage use; classify each as strictly necessary, statistical, functionality or advertising.
• Use the statistical exception only for aggregate analytics, with processor terms, notice and an objection toggle.
• Keep consent for advertising, ad measurement, frequency capping and interest-based personalisation.
• Store consent and objection per purpose with timestamp and source.
• Re-check email and SMS marketing against PECR, including soft opt-in logic.
• Refresh legitimate interests assessments for direct marketing; never rely on recognised legitimate interests for it.
• List automated decisions with legal or similarly significant effects; add safeguards; exclude special category data unless an exception applies.
• Publish a complaints route; acknowledge within 30 days; record outcomes.
• Brief the board on PECR exposure of up to £17.5 million or 4%.
• Re-check final ICO automated decision-making guidance and Information Commission notices each quarter.

To map these UK and EU consent duties onto a customer-owned platform, start with our compliance guide; the regulation hub lists related playbooks, and the GDPR overview covers the EU side.