Consentfolio UK GDPR vs EU GDPR for Cookies: The Divergence
Since the DUAA 2025, UK and EU cookie rules have diverged. The UK now exempts first-party analytics and interface preferences from consent on strict conditions, while the EU still requires consent for both under the ePrivacy Directive. If your site serves visitors in both, you meet the stricter EU standard for your EU traffic and the UK rules for your UK traffic. In practice most dual-regime sites apply the stricter EU approach across the board for simplicity.
The gap is narrow but real, and it sits exactly where analytics lives, so it affects almost every site that measures its traffic.
Where the rules differ
| Cookie purpose | UK (PECR, as amended by DUAA 2025) | EU (ePrivacy Directive) |
|---|---|---|
| First-party analytics, operator only | Exempt, with information and a free opt-out | Consent required |
| Interface appearance and preferences | Exempt, with information and a free opt-out | Consent required in most member states |
| Advertising and marketing | Consent required | Consent required |
| Cross-site tracking and profiling | Consent required | Consent required |
| Maximum fine | £17.5m or 4% of global turnover | Under GDPR, up to €20m or 4% of global turnover |
What this means in practice
Two workable approaches:
- Geo-targeted rules. Apply the UK exemptions to UK visitors and full consent to EU visitors. This keeps more analytics data for your UK traffic, at the cost of running two rule sets.
- One stricter standard. Apply full consent everywhere. Simpler to run and defend, and it covers both regimes, at the cost of the UK analytics exemption.
Most sites without geo-targeting choose the second. If your analytics data from UK traffic is valuable and you can target by region, the first is worth the extra setup.
The direction of travel
The UK has signalled it may diverge further, and the EU continues to review the ePrivacy rules, so the gap could widen. Review your setup annually. See the DUAA 2025 and cookies for the UK changes and UK cookie law explained for the full UK picture.
Frequently asked questions
Do I follow UK or EU rules if I serve both? You meet the UK rules for UK visitors and the EU rules for EU visitors. Without geo-targeting, applying the stricter EU standard everywhere covers both.
Does the UK analytics exemption apply to my EU visitors? No. The exemption is a UK change. EU visitors still need consent for analytics under the ePrivacy Directive.
Is a single consent banner enough for both regimes? Yes, if it applies the stricter standard, or if it targets rules by the visitor's region. What it cannot do is apply the UK exemptions to EU traffic.
Written by Tudor Rusmanica, founder of Consentfolio. Tudor has spent over a decade in agency SEO, working where search performance meets data protection: the analytics, tagging and consent setups that keep measurement useful and lawful. Connect on LinkedIn.
Published 13 July 2026. This guide is general information, not legal advice.