Cookie Consent and Tracking for UK Advertisers: Getting It Right Without Losing Your Data

What the rules require

Two sets of rules apply. PECR, the Privacy and Electronic Communications Regulations, covers cookies and similar technologies on devices. UK GDPR covers personal data more broadly.

Under PECR, non-essential cookies, including advertising pixels such as the Meta Pixel and Google Ads remarketing tags, need consent before they are set. The Data (Use and Access) Act 2025 introduced exceptions for some low-risk uses, such as certain analytics, with conditions attached. It did not remove the consent requirement for advertising cookies.

The Information Commissioner's Office has made cookie compliance an enforcement priority and has written to many major websites about their banners. Reject must be as easy as Accept.

This is not legal advice. Businesses with complex data processing should confirm their position with a UK data protection adviser.

How Google Consent Mode works

Consent Mode passes the visitor's consent choice to Google tags. When a visitor accepts, tags work normally. When a visitor refuses, tags send limited, cookieless signals, and Google models the conversions it cannot observe directly.

Google requires Consent Mode for advertisers using personalised advertising and remarketing features for UK and EEA users. Without it, audience building and some measurement features stop working for those visitors.

Advanced Consent Mode, which sends cookieless pings before consent, gives Google more data for modelling. Basic mode sends nothing until consent. Which you choose is a compliance decision as well as a measurement one.

Keeping measurement accurate

Server-side tracking. Moving tags to a server container you control, and sending conversions through Meta's Conversions API and Google's server-side options, improves reliability for consented users. Browser restrictions and ad blockers remove less of the data. It must still respect the visitor's consent choice.

Enhanced conversions. Hashed first-party data, such as the email from a form, can be sent with conversions where you have a lawful basis, improving match rates.

Offline conversion import. Sending CRM outcomes back to Google and Meta relies on data you hold as a business, with its own lawful basis, and is often the most reliable signal you have.

Honest banner design. A clear banner explaining what you use and why, with equal buttons, often achieves better consent rates than confusing designs, and it avoids regulatory risk.

The technical side is covered on our Conversion API and signal infrastructure page and in our server-side tracking guide.

Advertising standards alongside data rules

Separate from data protection, ad content in the UK is governed by the CAP Code and enforced by the Advertising Standards Authority. Claims must be substantiated, prices must be clear, and comparative claims must be fair. Financial promotions have their own rules under the Financial Conduct Authority, and healthcare has further restrictions.

These apply equally to ads written by people and to text generated by Google or Meta automation. Review what automated tools produce.

Differences across the UK

The rules are UK-wide. Markets differ. England, and London especially, has the most expensive auctions in financial and professional services. Scotland, with Edinburgh's financial services and Aberdeen's energy sector, has its own concentrations of high-value B2B buyers.

Wales has a strong public sector and manufacturing base, and Welsh-language content can help for some audiences, though it is not required for private businesses. Northern Ireland, with Belfast's technology and cybersecurity cluster, often shares audiences with the Republic of Ireland, where EU GDPR applies.

More on the wider UK market is in our UK guide and on the UK page. Our India afternoon is the UK morning, which makes working together straightforward.

Frequently asked questions