Guidance on the use of storage and access technologies

29 April 2026 -  we have finalised this guidance following two consultations on the draft guidance: the significant update to the previous detailed cookies guidance in December 2024, and the consultation on the changes to PECR following the Data (Use and Access) Act in July 2025. We have summarised the responses to both consultations.

We have added two new sub-chapters: “what does a ‘a simple means of objecting’ mean?” and “can we use the same storage and access technology for multiple purposes?”

There are minor changes to the content where we have sought to provide further clarity where requested in the consultation.

07 July 2025

• We have updated this draft guidance to reflect changes to PECR following the Data (Use and Access) Act.
• We have added a new chapter “what are the exceptions?” to explain the exceptions to the prohibition on storing or accessing information on people’s devices.
• There are other minor changes throughout the guidance to reflect the updated rules.  
• Outside of the indicated updates, this guidance is still in draft form as per the December 2024 update. We will finalise it following the second consultation on the new chapter. 

20 December 2024 - this guidance was published