UK PECR Fines Now £17.5M: SaaS Analytics Consent Risk

On 5 February 2026, the maximum fine for breaking the UK's cookie rules rose from £500,000 to £17.5 million or 4% of global annual turnover — a 35-fold jump that puts tracking penalties on the same footing as UK GDPR. Most coverage of the Data (Use and Access) Act 2025 focused on the good news for analytics teams: a new consent exemption for low-risk statistical cookies. The penalty escalation is the other half of the same reform, and it is the half that should reset how every SaaS team prices the risk of the tracking it still runs on consent.

What changed on 5 February 2026

The Data (Use and Access) Act 2025 amended PECR — the Privacy and Electronic Communications Regulations, the UK law that governs cookies and similar tracking — and brought the changes into force on 5 February 2026. The headline for compliance teams is the penalty ceiling. As Policy Pros summarised it, the Act now brings maximum fines under PECR to UK GDPR levels — £17.5 million or 4% of global annual turnover — where previously PECR breaches were capped at £500,000. For the cookie consent rule in regulation 6 specifically, the higher maximum applies.

The mechanics matter as much as the number. From the same date, the ICO enforces PECR using the Data Protection Act 2018 toolkit — information notices, assessment notices, enforcement notices and penalty notices — the same machinery it already uses for UK GDPR. In practice that means the regulator can now investigate and penalise a cookie-consent failure with the same instruments and the same financial firepower it brings to a data-breach case. A £500,000 cap was, for a funded scale-up, close to a cost of doing business. £17.5 million or 4% of turnover is a board-level number, and that is the shift.

Why the exemption and the fine hike land together

These two changes are usually reported separately, but reading them together is what makes the strategy clear. The same reform that raised the ceiling also removed consent requirements for genuinely low-risk first-party analytics — cookies used solely to gather aggregate statistics about how a site or product is used. We covered that side in detail in the UK DUAA analytics consent exemption. The net effect is a widening fork: privacy-first, aggregate analytics moved out of the consent regime entirely, while consent-dependent ad tracking became dramatically more expensive to get wrong.

This is deliberate policy design, not an accident of drafting. The regulator is steering organisations toward measurement that does not profile individuals or feed advertising, and away from the tracking that has driven most cookie enforcement. For a SaaS team, the implication is concrete: the value of running measurement on first-party, aggregate infrastructure is no longer only about a cleaner banner or faster pages — it now directly reduces the maximum financial penalty you could ever face for your analytics stack. The exemption and the fine hike are two ends of the same incentive.

Which SaaS tracking now carries GDPR-tier exposure

The first job is to sort your trackers into two buckets: those that qualify for the analytics exemption and those that still require consent and therefore sit inside the £17.5M penalty scope. Aggregate, first-party analytics — pageviews, session counts, funnel completion, error rates, with no individual profiling and no advertising use — generally falls in the exempt bucket. Ad retargeting pixels, cross-site identity graphs, and any analytics wired to advertising personalisation fall in the consent-required bucket, and that bucket is where the new exposure concentrates.

The trap is assuming a tool's category settles the question. GA4 is the clearest example: in its default configuration it routes data to Google's advertising infrastructure and can enable cross-device tracking through Google Signals, both of which require consent. A hardened GA4 with Signals off and no Ads export may qualify for the exemption, but the exposure is a function of configuration, not the product name. The same logic applies to session-replay tools, tag managers loading third-party pixels, and CDPs — anything that can identify an individual or serve advertising needs consent, and a broken consent flow around it is now a GDPR-tier liability. This is the same configuration-first thinking behind GA4 privacy and server-side tracking.

Where ICO enforcement is actually landing

A higher ceiling only matters if the regulator uses it, and 2026 enforcement signals that it intends to. Two behaviours are drawing attention. The first is consent-gating: regulators increasingly deploy automated scans that load a site and check whether non-essential trackers fire before consent is given. A banner that displays choices but drops advertising cookies on page load — a surprisingly common misconfiguration — is exactly the failure mode the reg 6 penalty now targets. The consent string has to actually gate the tags, not merely appear to.

The second is browser-level opt-out signals. The ICO treats an ignored universal opt-out as a wilful disregard of user choice, mirroring the direction of US state law we track in the California GPC instrumentation guide and the US state privacy law roundup. If your site collects consent through a banner but silently overrides a Global Privacy Control header, you have built the precise fact pattern enforcement teams look for. The practical rule: honour the machine- readable signal, and make sure your reject path withholds tags rather than hiding the banner.

How to re-price the risk

Under the old £500,000 cap, many teams treated cookie compliance as a low-priority backlog item — the expected cost of an enforcement action was small relative to the effort of fixing a consent flow. The 35-fold increase inverts that maths. Expected cost is roughly probability times magnitude, and while the probability of a maximum fine remains low, the magnitude is now large enough that even a modest probability produces a risk-adjusted number worth a quarter of engineering time. For a company raising or being acquired, unresolved consent liability is also now a diligence line item rather than a footnote.

The most durable response is not a tighter banner — it is a smaller surface. Every tracker you can move onto first-party, aggregate, exemption-qualifying analytics is a tracker that drops out of the reg 6 penalty scope entirely. That reframes the privacy-first analytics decision from a values choice into a risk-reduction one, the same architectural argument we make in the case for cookieless, first-party acquisition data. You cannot be fined £17.5M for a tracker that never needed consent in the first place.

The checklist to run this quarter

Start with an inventory. Enumerate every cookie and tracker your product and marketing site set, and label each as exemption-qualifying (aggregate, first-party, no advertising, no individual profiling) or consent-required. This single artefact is what converts the abstract £17.5M number into a concrete list of the specific tags that carry it. Most teams are surprised by how few trackers actually need consent once analytics is separated from advertising — and by how many consent-required tags are loading through a tag manager nobody has audited in a year.

Then verify behaviour, not configuration screens. Load the site in a clean session and confirm no consent-required tag fires before consent. Click reject and confirm those tags genuinely stay off. Send a Global Privacy Control signal and confirm it is honoured. Finally, review your transparency layer: the exemption removes the consent requirement for qualifying analytics but not the duty to inform users and offer an opt-out, a distinction we unpack in the CNIL consent-exempt analytics self-assessment. Document the results — a demonstrable, tested consent posture is the best evidence of good faith if the ICO ever asks.

The strategic read for SaaS teams

The UK reform is a preview of where consent regulation is heading across markets: narrow, clearly-defined exemptions for privacy-respecting analytics, paired with GDPR-tier penalties for everything that profiles or advertises. The EU is moving the same direction with its cookie-rule proposals, covered in the EU Digital Omnibus analysis, though on a different timeline. A SaaS operating in both markets should assume the trend, not the specific number, is the durable signal.

The teams that will spend the least time on this are the ones that already separated measurement from advertising. If your core analytics is first-party and aggregate, the fine increase barely touches you — you have almost nothing in the consent-required bucket to get wrong. If your measurement is entangled with ad infrastructure, the 5 February 2026 change quietly raised your worst-case liability by a factor of 35, and the work to contain it is the same work that makes your numbers more honest: know what you track, gate what needs gating, and move everything you can onto analytics that never needed permission to run.