The Data (Use and Access) Act 2025 (DUAA) updates, but doesn't replace, the UK GDPR, the Data Protection Act 2018 and PECR. For marketers, the big changes are: some analytics and functionality cookies no longer need consent, charities get their own soft opt-in for email and texts, messages that never arrived can still break the rules, and PECR enforcement now matches UK GDPR.
The ICO's own summary is that most of the changes give you an opportunity to do things differently rather than forcing you to change. A couple of them do need action, though, and one makes nuisance marketing easier to punish.
The changes at a glance
| Change | What it means for you |
|---|---|
| New cookie exceptions | Cookies for statistical purposes and to improve your website's functionality can be set without consent |
| Charity soft opt-in | Charities can email, text and message supporters without prior consent if strict conditions are met (in force 5 February 2026) |
| Wider definition of a communication | Emails and texts sent but not received, and calls that never connect, still count |
| Direct marketing defined in PECR | Advertising or marketing material directed to particular individuals, by whatever means |
| PECR enforcement aligned with UK GDPR | The same enforcement tools and penalty regime in most cases |
| Complaints process | Every organisation needed a data protection complaints process by 19 June 2026 |
The ICO said the changes would be phased in between June 2025 and June 2026, so they're now all in play.
Cookie rules: what you can set without consent
The basic rule hasn't flipped. Storing or reading information on someone's device is still prohibited unless an exception applies. The DUAA keeps the old exceptions (consent, and storage that's strictly necessary for a service the user asked for) and adds new ones in a new schedule to PECR.
The headline new exception, in the government's factsheet, covers cookies and similar technologies used to collect statistical information about how your online service is used, with the aim of improving it. The ICO also lists cookies that improve the functionality of your website. The Secretary of State can add or change exceptions later, after consulting the ICO.
Nothing in the new exceptions mentions advertising, so ad pixels and cross-site tracking still need consent unless another exception applies. A basic analytics setup used only to improve your site may be able to run before consent. If you use GA4, our guide on whether Google Analytics uses cookies is a good place to check what your setup stores. The ICO has published updated guidance on storage and access technologies, and that's what to follow on the detail.
Email and text marketing: the soft opt-in for charities
Businesses have long had a soft opt-in for existing customers, as long as the messages are about similar products or services. The DUAA adds a version for charities. A charity can now send electronic mail marketing that furthers its charitable purposes when it:
- got the contact details when the person offered support or expressed an interest in its charitable purposes,
- gave the person a chance to opt out when it first collected their details, and
- gives the same chance to opt out in every message.
The ICO says this came into force on 5 February 2026 and covers emails, texts and direct messages on social media.
The change that bites: messages that never arrived
This is the one to tell your team about. PECR used to talk about communications exchanged or conveyed, which implied they had to reach someone. The DUAA changes that: a communication now includes information transmitted, a call includes an attempt to connect, and a recipient includes an intended recipient.
The government's factsheet spells out the effect: an infringement can happen even if the call or message didn't reach the person. A bounced spam blast or a dialler making unanswered calls is no longer a defence.
Enforcement and codes of conduct
The DUAA brings PECR enforcement into line with the UK GDPR, so the mechanisms and penalties are the same in most cases. For email, text and call marketing, that means the same toolkit the ICO uses for data protection breaches.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
There's a positive side too. Trade associations and sector bodies can now write PECR codes of conduct and submit them to the ICO. If you follow an approved code, you can use that to show you comply.
What to do on your website and list
- Audit your cookies. Split them into strictly necessary, statistical and functionality, and advertising, and only move the first groups out from behind consent once you've checked them against the ICO's updated guidance.
- Check your sign-up forms still offer a clear opt-out at the point of collection, and in every message.
- Clean your list. Messages to dead or mistyped addresses now count as sent.
- Make sure you have a written process for handling data protection complaints.
- If you're a charity, review the ICO's updated guidance on direct marketing using electronic mail before relying on the new soft opt-in.
If you're choosing a platform at the same time, our guide to the best email marketing software for small business will help you pick one.
My advice
Don't rip your cookie banner out because you read a headline. Use the new exceptions to stop nagging visitors about basic analytics, keep consent for anything that tracks people for ads, and treat every send as if it counts, because now it does.
Frequently asked questions
What is the Data (Use and Access) Act 2025?
It's a UK Act that amends the UK GDPR, the Data Protection Act 2018 and PECR. The ICO says its changes were phased in between June 2025 and June 2026.
Do I still need cookie consent after the Data Use and Access Act?
For most advertising and tracking cookies, yes. The Act adds exceptions for cookies used to collect statistical information to improve your service and to improve your website's functionality, but storage or access is still prohibited unless an exception applies.
What is the charity soft opt-in?
It lets charities send email, text and social media marketing that furthers their charitable purposes to people who offered support or expressed interest, if they offered an opt-out when collecting the details and in every message. It came into force on 5 February 2026.
Do marketing emails that bounce count under PECR now?
Yes. The Act changed the definition of a communication to include information transmitted, so an infringement can happen even if the message didn't reach the intended recipient.
Did the Act change PECR penalties?
It brought PECR enforcement into line with the UK GDPR, so the enforcement mechanisms and penalties are the same in most cases.
