Ashurst Data Bytes 4: How the UK's Data (Use and Access) Act will change marketing practices, cookie use and the PECR fining regime

In this episode, we explain how the Data (Use and Access) Act changes marketing practices and the use of cookies in the UK. Host Rhiannon Webster is joined by Ashurst colleagues Nicolas Quoy and Shehana Cameron-Perera to discuss how the Data (Use and Access) Act 2025 amends Privacy and Electronic Communications Regulations (PECR) and changes marketing practices and uses of cookies. Shehana provides a snapshot of the amendments to PECR and what these mean for marketing practices. She also runs through the list of what cookies are categorised in PECR as being "strictly necessary cookies” and explains that, for analytics and appearance cookies, there are additional exceptions from obtaining consent. Nicolas draws some constructive comparisons between French and UK marketing and cookies practices and regulatory approaches and describes the EU’s enforcement approach which attracts substantially higher fines. Whilst the Data (Use and Access) Act appears to bring the UK in line with France from a cookie perspective, there are probably still differentiations across Europe which will require a country-by-country approach when looking at cookie compliance. Rhiannon explains how the Data (Use and Access) Act has aligned enforcement powers under PECR to the UK GDPR, and how this might inform compliance efforts and impact the ICO's approach to fining, particularly for marketing infringements. To listen to this and subscribe to future Data Bytes episodes, search for “Ashurst Legal Outlook” on Apple Podcasts, Spotify, or your favourite podcast player. To explore more from Ashurst’s podcast library, visit ashurst.com/podcasts. The information provided is not intended to be a comprehensive review of all developments in the law and practice, or to cover all aspects of those referred to. Listeners should take legal advice before applying it to specific issues or transactions.See omnystudio.com/listener for privacy information.