UK GDPR · PECR · Data (Use and Access) Act 2025 · Updated 9 October 2026

What Is Considered UK GDPR Compliant Consent? The 2026 Guide to the 7 Tests, Cookie Banners and Email Opt-Ins

Table of Contents

A plain-English, UK-specific guide for business owners, marketers and agencies. It covers the legal tests, real wording examples, the 2026 cookie exceptions, email and SMS rules, how to record consent, the fines, and how to keep consent compliant when you outsource marketing. Written by the Digital Masters 360 team, a consent-first digital marketing agency serving UK clients 100% online. Get a free consent check See the 7 tests

UK GDPR Compliant Consent in 50 Words

UK GDPR compliant consent is a freely given, specific, informed and unambiguous indication of a person’s wishes, given by a clear affirmative action (Article 4(11)). It must be separate from other terms, name you and any third parties, be as easy to withdraw as to give, and be recorded so you can prove it (Article 7).

Key takeaways

Opt-in only. Silence, pre-ticked boxes, inactivity and “by continuing to browse you agree” are never valid consent.
Seven tests, all at once: freely given, specific, informed, unambiguous, easy to withdraw, documented and kept up to date. Fail one and the consent fails.
Explicit consent (special category data, solely automated decisions, some transfers) must be confirmed in words, such as a signed or ticked statement.
Consent is not always the right lawful basis. Employers, public bodies and anything needed for a contract usually need a different basis.
Cookies and pixels: PECR requires prior consent to the UK GDPR standard, except for five narrow exceptions. Since February 2026, first-party analytics and appearance settings can be exempt if you give a simple, free way to object.
Email and SMS to individuals need consent unless the soft opt-in applies; since February 2026 charities have their own soft opt-in.
Fines: up to £17.5 million or 4% of global turnover under both UK GDPR and, since the Data (Use and Access) Act, PECR.
Regulator: the ICO became the Information Commission on 30 September 2026. The consent rules did not change with the name.

In this guide

What Counts as Consent Under the UK GDPR?

Article 4(11) of the UK GDPR defines consent as any freely given, specific, informed and unambiguous indication of the individual’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of their personal data. Article 7 then adds four conditions: you must be able to prove consent, the request must be clearly distinguishable from other matters, people can withdraw at any time as easily as they gave it, and consent is unlikely to be free if a service is made conditional on processing it does not need.The regulator’s test is objective: you judge consent on what the person actually did and what you can evidence, not on what you assume they meant.

Where the UK consent rules come from

Source	What it covers	Why it matters to you
UK GDPR Art. 4(11)	Definition of consent	The four core qualities every consent must have
UK GDPR Art. 6(1)(a)	Consent as one of the lawful bases	Only one of seven bases; often not the best one
UK GDPR Art. 7	Conditions: proof, separation, withdrawal, no bundling	Your records and your unsubscribe/withdraw flow
UK GDPR Art. 8 + DPA 2018 s.9	Children’s consent for online services (13 in the UK)	Parental consent under 13 for apps, games, social
UK GDPR Art. 9(2)(a), 22, 49	Explicit consent	Health, biometric and other special category data; automated decisions; some transfers
Recitals 32, 42, 43	Clear affirmative act; naming the controller; imbalance of power	No pre-ticked boxes; name third parties; employers beware
PECR reg. 6 + Schedule A1	Cookies, pixels, fingerprinting and other storage/access tech	Prior consent unless one of five exceptions applies
PECR reg. 21–22	Marketing calls, emails and texts	Consent or soft opt-in for individuals
Data (Use and Access) Act 2025	2026 changes: research consent, cookie exceptions, charity soft opt-in, PECR fines	The most important update since 2018

Is consent the right lawful basis for you?

Consent is appropriate when you can offer people real choice and control and you would genuinely stop if they said no. If you would process the data anyway, asking for consent is misleading, and the consent is invalid.

Situation	Use consent?	Usually better basis
Marketing emails/texts to individuals	Yes (or soft opt-in)	PECR decides; UK GDPR basis then follows
Non-exempt cookies, pixels, ad tags	Yes, required by PECR	None; PECR consent is mandatory
Delivering an order or service	No	Contract (Art. 6(1)(b))
Staff data at work	Rarely (power imbalance)	Contract, legal obligation, legitimate interests
Fraud prevention, network security	No	Legitimate interests (now a recognised legitimate interest for some purposes)
Health data in a wellness app	Explicit consent often	Explicit consent + Art. 6 basis
Scientific research	Optional	Public task or legitimate interests; broad consent now possible if you do use consent

When you should not rely on consent

Employers and public authorities: the imbalance of power means consent is rarely free.
Processing a service needs anyway: making it a “condition” of consent invalidates it; use contract.
When you cannot honour a withdrawal: if you would keep the data regardless, pick another basis now, because you cannot swap bases later.

Consent is not the same as…

Accepting terms and conditions: agreeing to T&Cs is not data-protection consent.
Ethics or clinical-trial consent: a separate legal duty; you still need a UK GDPR lawful basis.
A privacy notice: telling people is transparency, not permission.

The 7 Tests for Valid UK GDPR Consent

Most guides list four or five qualities. In practice the regulator checks seven things, and your consent is only compliant if it passes all seven at the same time.

#	Test	Passes when…	Fails when…
1	Freely given	People can say no with no penalty; consent is unbundled	Consent is a condition of service it isn’t needed for; power imbalance
2	Specific and granular	Separate choices for separate purposes	One tick covers marketing, profiling and sharing
3	Informed	You name yourself, third parties, purposes and the right to withdraw	Vague wording, double negatives, hidden in T&Cs
4	Unambiguous, affirmative	An active tick, click, toggle, signature or spoken “yes”	Pre-ticked boxes, silence, scrolling, inactivity
5	Easy to withdraw	One click, link or reply, as easy as opting in	Login, phone call or form maze to opt out
6	Documented	You can show who, when, how, what they saw, what they chose	No logs, no versioned wording
7	Current	Refreshed when purposes change; reviewed regularly	“Evolving” consent stretched to new uses

Test 1: Freely given

People must have a genuine choice. They must be able to refuse or withdraw without detriment, and consent should be unbundled from your terms.

Bundling and “conditional” consent

If you make a sale or service depend on consent to processing that the service does not need (for example, sharing buyer details with partner retailers at checkout), consent is presumed not to be free. Delivery details needed to fulfil the order are different, and the contract basis fits them better anyway.

Incentives: allowed or a penalty?

A reasonable incentive is allowed: a loyalty discount for joining a mailing list is a benefit, not a punishment for refusing. The line is crossed when refusers are worse off than normal (higher price for the same service without a fair alternative, or blocked access).

Power imbalance

Employers, landlords, schools and public bodies hold power over people. Unless refusal genuinely has no consequence, choose another lawful basis.

Test 2: Specific and granular

Each separate purpose needs its own opt-in: newsletter, partner offers, personalised ads, analytics, each of them. A single “I agree to everything” box fails, unless the activities are truly interdependent.

Test 3: Informed

The four things every consent request must state

Who you are, plus every third-party controller that will rely on the consent, named. “Selected partners” is not enough.
Why: each purpose, in plain words.
What you will do: the processing activities (for example, emails twice a month, sharing with a named ad platform).
That people can withdraw at any time, and how.

Keep the request prominent, concise, separate from your terms and in plain English. Layered notices and just-in-time prompts help you stay clear without overwhelming people.

Test 4: Unambiguous, by a clear affirmative action

All consent is opt-in. There is no such thing as opt-out consent. Valid actions include ticking an empty box, switching a toggle from off to on, clicking a clearly labelled “Accept” next to an equally prominent “Reject”, signing a statement, or saying yes on a recorded call.

Is implied consent ever valid?

Sometimes, offline, and only for the obvious purpose. Dropping a business card in a prize-draw box is consent to be contacted about the draw, but not to marketing. Submitting a survey is consent to process the survey answers, but not to anything else.

Test 5: As easy to withdraw as to give

If people opted in with one click, they must be able to opt out with one click: an unsubscribe link, a “cookie settings” link in the footer, a STOP reply to texts. Stop the processing as soon as possible after withdrawal. Withdrawal does not make earlier processing unlawful.

Test 6: Documented: what a consent record must contain

Field	Example
Who	User ID / email hash / CRM record
When	Timestamp with time zone
How	Web form v3.2, cookie banner, phone call script 2026-04
What they saw	Saved copy or version number of the wording and privacy notice
What they chose	Newsletter: yes · Partner offers: no · Analytics: yes · Ads: no
Withdrawal	Date, channel and what was withdrawn

How long to keep consent records

For as long as you rely on the consent, plus a reasonable period after (often six years in the UK, matching the limitation period for claims). Store them securely and limit access.

Test 7: Kept current

Consent does not last forever and cannot stretch to new purposes. Refresh it when your purposes change, and review it at sensible intervals (many UK businesses re-permission email lists every 24 months of inactivity). Cookie choices are commonly re-asked after a set period or when your tags change.

Explicit Consent: When the Bar Is Higher

Explicit consent is needed for special category data (health, biometrics, genetics, ethnicity, religion, sexual orientation, politics, trade union membership) when consent is your Article 9 condition, for solely automated decisions with legal or similarly significant effects, and for some international transfers under Article 49.

How explicit consent differs from ordinary consent

	Ordinary consent	Explicit consent
How given	Statement or clear affirmative action	Express statement, in words (written or oral)
Can it be inferred from conduct?	Yes, if clear	Never
Must name the sensitive element?	No	Yes: the data type, the decision or the transfer risk
Separate from other consents?	Yes	Yes, and from ordinary consent
Oral consent	Allowed with records	Allowed; keep the script and call record

Explicit consent wording example

Compliant: “☐ I consent to [Clinic name] using the details of my skin condition I’ve given above to recommend suitable treatments. I can withdraw this at any time at [link].”

Not explicit: an optional free-text box labelled “Skin conditions (we’ll use this to recommend products)”. It may be implied consent, but it is not an express statement.

Valid vs Invalid Consent: 14 Real-World Examples

Scenario	Verdict	Why
Empty newsletter tick box at checkout	✅ Valid	Active, separate, specific
Pre-ticked “Send me offers” box	❌ Invalid	Default setting, not an affirmative act
“By using this site you accept cookies” banner	❌ Invalid	Inactivity, no choice
Banner with “Accept all” and equally prominent “Reject all” on first layer	✅ Valid	Equal choice; granular settings available
“Accept” button plus “Manage settings” only	⚠️ High risk	Refusing takes more effort than accepting
Cookie wall blocking all content unless you accept tracking	❌ Usually invalid	Not freely given (consent-or-pay models judged case by case)
One box: “I agree to the T&Cs and marketing”	❌ Invalid	Bundled with terms
“We may share your data with selected partners”	❌ Invalid	Third parties not named
Double opt-in confirmation email logged in CRM	✅ Valid (strong evidence)	Not legally required but proves consent
Bought email list “fully GDPR consented”	❌ Usually invalid for you	Your organisation was not named at the time
Verbal yes on a recorded call with a script	✅ Valid	Statement, recorded, specific
Email consent from 2019 used for SMS in 2026	❌ Invalid	Different channel and purpose; consent not specific
Employee asked to “consent” to CCTV	❌ Invalid basis	Power imbalance; use legitimate interests
Parent ticks consent for 11-year-old on a gaming app	✅ Valid (with reasonable checks)	Under 13 needs parental consent

Consent wording you can adapt

Email newsletter sign-up

☐ Yes, email me [Brand]’s monthly tips and offers. You can unsubscribe in one click at any time. See our privacy notice.

Cookie banner (first layer)

We’d like to use cookies and similar technologies to measure ads (Google Ads, Meta) and personalise content. Essential cookies are always on. [Accept all] [Reject all] [Choose settings] · Change your mind any time via “Cookie settings” in the footer.

Sharing with a named partner

☐ Share my name and email with [Partner Ltd] so they can email me about home insurance. They will be responsible for their use of it.

The regulator’s own list: when you do not have valid consent

You have any doubt that the person consented, or they didn’t realise they had.
You have no clear record of it.
There was no genuine choice, refusal was penalised, or there is a clear power imbalance.
Consent was a precondition of a service that does not need the processing, or was bundled into terms.
The request was vague, used pre-ticked boxes or default settings, or didn’t name your organisation.
People weren’t told they could withdraw, or can’t withdraw easily.
Your purposes have moved on since the consent was given.

What Changed in 2026: The Data (Use and Access) Act and New Guidance

The core definition of consent did not change. What changed is the surrounding rules: when you need consent at all, how research consent works, and how much non-compliance can cost.

Change	In force	What it means for consent
Broad consent for scientific research (DUAA s.68)	5 Feb 2026	Consent to an area of research counts as specific if purposes can’t be fully identified, it meets ethical standards, and people can consent to only part where possible. Commercial research is included.
Charity soft opt-in (DUAA s.114)	5 Feb 2026	Charities can email/text supporters who showed interest or donated, without consent, if they offered an opt-out at collection and in every message.
New PECR cookie exceptions (statistical purposes, appearance, emergency assistance)	Feb 2026	First-party analytics and remembering user preferences can run without consent, with clear information and a simple, free way to object.
PECR fines raised to £17.5m / 4%; seriousness threshold removed	Feb 2026	Any PECR breach (cookies, email, texts) can now attract a GDPR-level fine.
Children’s higher protection in design (DUAA s.81)	5 Feb 2026	Online services likely used by children must factor in their higher protection needs, including consent journeys.
ICO final guidance on storage and access technologies	29 Apr 2026	Replaced the 2019 cookie guidance; covers pixels, fingerprinting, scripts, ‘consent or pay’ and banner design.
Complaints duty (DUAA s.103 / DPA s.164A)	19 Jun 2026	You must be able to handle complaints, including about consent, and acknowledge them within 30 days.
ICO becomes the Information Commission	30 Sep 2026	New name and board structure; same consent rules, same guidance. Update privacy notices that name the ICO.
ICO consent guidance under review	Ongoing	The regulator flags its consent pages for update after the DUAA. The legal tests stay; watch for revised examples.

What did not change

The definition in Article 4(11) and the conditions in Article 7.
Advertising, retargeting and third-party tracking still need prior consent.
Pre-ticked boxes, silence and inactivity are still invalid.
Children under 13 still need parental consent for online services relying on consent.

Cookie Consent: What Is Compliant in the UK in 2026

How PECR and the UK GDPR fit together

PECR decides whether you need consent to store or read anything on a device (cookies, local storage, pixels, SDKs, fingerprinting, link decoration). The UK GDPR decides what good consent looks like. So a cookie banner must meet all seven tests above, and non-exempt tags must not fire until the person has said yes.

The five exceptions where you don’t need cookie consent

Exception	Covers	Conditions
Communication	Technology needed purely to transmit a communication	Sole purpose only
Strictly necessary	Shopping basket, log-in session, security, load balancing, consent-preference cookie	Essential to the service the user asked for, from the user’s point of view
Statistical purposes (new)	Measuring how your site or service is used to improve it	Clear information + simple, free way to object; sole purpose; aggregate statistics
Appearance (new)	Remembering language, font size, layout or display choices	Clear information + simple, free way to object; sole purpose
Emergency assistance (new)	Locating a device to send emergency help	Sole purpose; triggered by a request for help

The statistical purposes exception in practice

This is the one marketers ask about. It only applies when the sole purpose is improving your own site or service. If the same tag also feeds advertising, audience building, cross-site tracking or a vendor’s own product development, the exception falls away and you need consent.

Does Google Analytics 4 need consent in the UK?

In most real set-ups, yes. GA4 linked to Google Ads, with Google signals, or sharing data for Google’s own purposes goes beyond pure statistics. A tightly configured first-party analytics tool with no ad links, no data sharing, aggregated reporting and an easy opt-out can fit the exception. If in doubt, ask for consent.

Quick test

Ask: “Would this tag still be useful to us if no advertising platform could ever see its data?” If the answer is no, it isn’t a statistics-only tag.

What a compliant cookie banner looks like

Reject all on the first layer, as easy and prominent as Accept all.
No non-exempt cookies or pixels before a choice (check with your browser’s developer tools).
Granular categories (analytics, advertising, personalisation) and named third parties.
No pre-enabled toggles, no nudging colours that hide the reject option, no endless re-prompts after a refusal.
A persistent “Cookie settings” link to change or withdraw consent.
Records of each choice, the banner version and the time.

Cookie walls and “consent or pay”

Blocking access unless people accept tracking will usually fail the “freely given” test. A “consent or pay” model (accept personalised ads or pay a fair fee for an ad-free version) can be compliant, but only with a genuinely equivalent alternative, a fair price and clear information. The regulator judges these case by case.

Marketing tags: consent needed?

Tool	Consent needed in the UK?	Notes
Google Ads conversion tag / remarketing	Yes	Advertising: no exception
Meta Pixel / Conversions API with browser IDs	Yes	Advertising: liability sits with the website owner
LinkedIn Insight Tag, TikTok Pixel, X Pixel	Yes	Advertising and audience building
GA4 linked to Ads or with Google signals	Yes	Not statistics-only
First-party, ad-free analytics (configured for the exception)	Possibly not	Inform + simple free opt-out required
Hotjar / Microsoft Clarity session recording	Yes (usually)	Third-party vendor processing; treat as non-exempt
Language or dark-mode preference cookie	No (appearance)	Inform + opt-out
Cart, login, security, CMP preference cookie	No (strictly necessary)	Explain in cookie notice

Google Consent Mode v2: basic vs advanced

Consent Mode passes the visitor’s choice to Google tags. Basic mode blocks Google tags until consent: the safest UK set-up. Advanced mode loads tags and sends cookieless pings before consent; assess this carefully under PECR, because the tag still reads or stores information on the device. Consent Mode is a signal, not a substitute for a compliant banner.

Email, SMS and Phone Marketing Consent Under PECR

Channel	Individuals (consumers)	Sole traders and some partnerships	Companies, LLPs, government (corporate subscribers)
Email / SMS	Consent or soft opt-in	Consent or soft opt-in	No consent needed; must identify yourself and offer an opt-out (UK GDPR still applies to named staff emails)
Live calls	Allowed unless TPS-registered or they objected	Same; check TPS	Allowed unless CTPS-registered or they objected
Automated calls	Specific consent only	Specific consent only	Specific consent only
Claims-management / pension cold calls	Banned without specific prior consent	Same	Same

The commercial soft opt-in

You can email or text existing customers without consent if all of these are true: you got their details in the course of a sale or negotiations for a sale; you only market your own similar products or services; you gave a simple opt-out at collection; and you offer an opt-out in every message.

The charity soft opt-in (new in 2026)

Charities can now use a similar route for people who donated, joined or expressed interest, when the marketing furthers the charity’s purposes and an opt-out was offered at the start and in every message.

Bought lists and third-party consent

Consent only covers organisations that were specifically named when it was given. Generic “partners” wording means a bought list is almost never consented for you. Ask suppliers for the exact wording, the date and the record for every contact, or don’t use the list.

Is double opt-in required in the UK?

No. It is, however, the easiest way to prove consent and stop malicious sign-ups, so we recommend it for most email lists.

Children’s Consent in the UK

Situation	Rule
Online services offered directly to children, relying on consent	Parental consent under 13 (UK age set by DPA 2018); reasonable efforts to verify
Other processing	Assess competence (Gillick test)
Scotland	A child of 12 or over is presumed able to understand, unless shown otherwise
Preventive or counselling services	Parental consent not required
Design duty	Children’s Code standards + DUAA higher-protection duty for services likely to be used by children

Parental consent does not expire automatically on a child’s 13th birthday, but refresh it sooner. For many child-facing services, another lawful basis may protect children better than consent.

How to Get, Record and Manage UK GDPR Compliant Consent: 10 Steps

1. Map every place you collect data or set tags

Forms, checkout, pop-ups, chat, phone scripts, events, apps, and every script in Google Tag Manager.

2. Decide the lawful basis per purpose

Use consent only where you’d honour a “no”. Record the decision; you can’t swap later.

3. Write one request per purpose

Short, plain-English, separate from terms, naming you and any third parties.

4. Use opt-in controls only

Empty boxes, off-by-default toggles, equal-weight Accept/Reject buttons.

5. Block tags until consent

Configure your consent platform and Tag Manager so advertising and non-exempt analytics fire only after a yes.

6. Log every consent and refusal

Who, when, how, wording version, choices. Sync to your CRM and email platform.

7. Make withdrawal one click

Footer cookie settings link, unsubscribe link, STOP keyword, preference centre.

8. Pass choices to vendors

Suppression lists to email tools; Consent Mode or equivalent signals to ad platforms; processor contracts in place.

9. Test before and after launch

Check in a private browser window that no ad cookies drop before consent; test the reject path and withdrawal on mobile.

10. Review and refresh

Re-check after every new tool, campaign or purpose; review banner and wording at least yearly.

Free official resources

The regulator’s guidance on consent, lawful basis and the lawful basis interactive tool.
Guidance on the use of storage and access technologies (April 2026).
Direct marketing guidance and the Telephone Preference Service (TPS/CTPS).
The Children’s Code (Age Appropriate Design Code).

UK GDPR Consent vs EU GDPR, US, Canada, Australia and India

Law	Default model	Cookie / tracking consent	Key difference from UK
UK GDPR + PECR (UK)	Opt-in	Prior consent; 5 exceptions incl. first-party analytics	Benchmark
EU GDPR + ePrivacy (EU/EEA)	Opt-in	Prior consent; no analytics exception in most states	Stricter on analytics; EDPB guidance binding in EU
CCPA/CPRA (California, US)	Opt-out of sale/sharing	Notice + opt-out; honour Global Privacy Control	Consent mainly for minors and sensitive data uses
PIPEDA (Canada)	Express or implied by sensitivity	Implied acceptable for low-risk; express for sensitive	Implied consent wider than UK; CASL needs express/implied for email
Privacy Act 1988 / APPs (Australia)	Express or implied	No specific cookie law; Spam Act needs consent for email	Implied consent wider; reforms ongoing
Privacy Act 2020 (New Zealand)	Purpose-based; consent not central	No specific cookie law; UEMA for email	Lower consent bar
DPDP Act 2023 (India)	Consent-led, with ‘consent managers’	Notice + consent; rules phasing in	Consent manager framework; verifiable parental consent under 18

Opt-in vs opt-out: the one-line difference

The UK and EU require people to say yes first; the US model mostly lets businesses proceed until people say no. If you market to all of these countries, build your consent to the UK/EU standard and you will meet the others.

Spelling note: this page uses UK English (organisation, licence, optimise) because the keyword, law and audience are UK. Our US pages use US spelling; Australian pages follow AU spelling, which matches UK forms in most cases.

What Happens If Your Consent Isn’t Compliant?

Breach	Maximum fine	Other consequences
Processing without a valid lawful basis (Art. 6/7/9 UK GDPR)	£17.5m or 4% of global annual turnover	Orders to stop processing and delete data
PECR: cookies, emails, texts, calls	£17.5m or 4% of global turnover (since the DUAA; previously £500,000)	Enforcement notices; failing to comply is a criminal offence
Individuals’ claims	Compensation for damage or distress (Art. 82)	Group claims, reputational damage
Data you can’t use	N/A	Invalidly consented lists and audiences may have to be deleted

Enforcement focus: online tracking

The regulator’s online tracking strategy has targeted cookie banners on the UK’s most visited websites since 2023, writing to the top 1,000 sites. Typical problems: non-essential cookies before consent, no reject option, and nudging designs. With the old “substantial damage or distress” threshold for PECR fines gone, small and mid-sized businesses are no longer below the radar.

15 common consent mistakes

Mistake	Fix
Pixels fire before the banner loads	Block in Tag Manager until consent
No Reject all on first layer	Add equal-weight button
Pre-ticked marketing boxes	Untick by default
One box for terms and marketing	Separate the requests
“Selected partners” wording	Name each third party
No consent logs	Use a CMP and CRM fields with timestamps
Unsubscribe takes a login	One-click link
Old email list reused for SMS	Ask again per channel
Bought lists	Verify named consent or don’t use
Consent used for staff data	Switch to the right basis
Ignoring children on your site	Age checks and parental consent where needed
Assuming GA4 is exempt	Configure carefully or ask for consent
Banner never re-tested after new tags	Re-scan monthly
Privacy notice still names “ICO” only	Update to the Information Commission
Agency with ad-account access but no contract	Sign an Article 28 processor agreement

Consent-First Marketing With an Offshore Agency: What UK Buyers Should Know

Many UK businesses and agencies now outsource SEO, paid media, tag management and CRM work to India. Done properly it is fully compatible with UK GDPR consent rules, and often cheaper than fixing consent with a local agency. Here is exactly how Digital Masters 360 (DM360), based in Hyderabad, works with UK clients.

Is it legal for an Indian agency to handle UK consent data?

Yes. You stay the controller; we act as your processor under a written Article 28 contract. Because India has no UK adequacy regulations, any access to personal data from India is a restricted transfer, covered by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, plus a transfer risk assessment.

How we keep transfers minimal

Most consent work (banner configuration, Tag Manager, Consent Mode) needs no access to personal data at all.
Analytics and ad dashboards are shared with role-based, named logins on your accounts, never exported.
Customer lists stay in your CRM; we work on hashed or aggregated data where possible.

Documents you should ask any offshore agency for

Article 28 processor agreement · IDTA or UK Addendum · transfer risk assessment · security summary (MFA, device encryption, access logs) · breach-notice commitment · sub-processor list.

Never do this

Never email raw customer spreadsheets or share a single master login. If an agency asks for either, walk away.

Cost: DM360 vs typical UK consent and tracking projects

Service	Typical UK agency (indicative)	DM360	USD	EUR	AUD
Consent and tracking audit	£1,500–£3,500	£750	$998	€863	A$1,500
Consent Fix Sprint (CMP + GTM + Consent Mode v2)	£2,000–£5,000	£950	$1,264	€1,093	A$1,900
Consent-ready marketing (SEO/PPC/social), per month	£1,500–£4,000	from £495	from $658	from €569	from A$990
White-label consent audits for agencies	N/A	from £395	from $525	from €454	from A$790

Conversions at £1 = $1.33 / €1.15 / A$2.00 (October 2026, rounded). UK agency ranges are indicative market quotes, not a survey. UK VAT: B2B services from India fall under the reverse charge; we invoice without UK VAT.

Time zones and communication

Client location	Your time	DM360 live overlap
UK (BST, to 25 Oct 2026)	9:00 am – 6:00 pm	Full overlap (1:30–10:30 pm IST shift)
UK (GMT, from 25 Oct 2026)	9:00 am – 5:00 pm	Full overlap (2:30–10:30 pm IST)
US East Coast (ET)	9:00 am – 1:00 pm	Morning overlap
Australia East (AEDT)	2:30 pm – 6:00 pm	Afternoon overlap
EU (CET/CEST)	Full working day	Full overlap

How we communicate

A shared Slack or Microsoft Teams channel (replies within 4 business hours), a weekly Zoom or Google Meet call, a live Looker Studio dashboard, and a monthly written report with consent rates, tag status and campaign results.

Data privacy and compliance across your markets

Your market	Law we work to	Transfer tool
UK	UK GDPR, DPA 2018, PECR, DUAA	IDTA or UK Addendum
EU / EEA	EU GDPR, ePrivacy	EU Standard Contractual Clauses
US	CCPA/CPRA and state laws	Service-provider contract terms
Australia	Privacy Act 1988, APP 8, Spam Act	Contractual APP-equivalent safeguards
India (our base)	DPDP Act 2023	Processor obligations under contract

Contracts, NDAs, payments and onboarding

Contracts and NDAs

Master services agreement under the law of England and Wales on request, mutual NDA before any access, Article 28 terms and IDTA. You own all work, accounts and data.

Payments

Invoices in GBP, USD, EUR or AUD; pay by bank transfer (Wise), card or PayPal. Monthly retainers billed in advance; one-off projects 50% upfront, 50% on delivery.

14-day onboarding

Day 1–2: kickoff call, NDA and contracts · Day 3–5: access set-up with named logins · Day 6–10: audit and consent map · Day 11–14: fix plan agreed and first changes live.

White-label consent services for UK agencies

UK agencies resell our consent audits, CMP set-ups and tracking fixes under their own brand. We work as your sub-processor, deliver in your templates and never contact your clients directly.

DM360 Consent and Tracking Packages

Free Consent Check

£0

15-minute review of your banner, forms and top tags with a short written list of risks.

Book free check

Consent & Tracking Audit

£750

Full scan of cookies, pixels and forms; consent-log review; prioritised fix list; 45-minute walkthrough.

Order audit

Consent Fix Sprint

£950

CMP configuration, Reject all, Tag Manager blocking, Consent Mode v2, form wording, testing and handover.

Start sprint

Consent-Ready Marketing

from £495/mo

SEO, PPC or social management built on compliant consent, with monthly consent-rate reporting.

Talk to us

What’s included in every paid package

NDA and processor agreement
Named logins, no shared passwords
Before/after evidence screenshots
Plain-English report for your board or client
30 days of follow-up questions

What we don’t do

We are a digital marketing agency, not a law firm. We don’t give legal advice or act as your DPO. For legal sign-off, we work alongside your solicitor or data protection adviser.

How to Choose a Consent or Tracking Partner

10 questions to ask

Will you show me, in a browser, which tags fire before consent today?
Do you configure Reject all on the first layer by default?
How do you handle Consent Mode: basic or advanced, and why?
Which consent management platform do you recommend for my CMS and budget?
How are consent records stored and exported?
Will you sign an Article 28 agreement and IDTA?
Who will access my accounts, and how is access removed at the end?
How do you test after each new campaign or tag?
What working hours overlap with mine?
Can you show results from a similar UK client?

Red flags

“Implied consent is fine for analytics” with no configuration plan
Dark-pattern banners that hide Reject
No written contract or transfer terms
Requests for shared master logins or customer spreadsheets
Guarantees of “100% GDPR compliance”

Glossary

Term	Meaning
Controller	The organisation that decides why and how personal data is used
Processor	An organisation that handles data on a controller’s instructions (e.g. an agency)
Lawful basis	One of six legal grounds in Art. 6 for processing personal data
Explicit consent	Consent confirmed in an express statement, needed for higher-risk processing
PECR	Privacy and Electronic Communications Regulations 2003: cookies and e-marketing
DUAA	Data (Use and Access) Act 2025: the 2026 reforms
CMP	Consent management platform: software that shows the banner and records choices
Soft opt-in	PECR rule allowing marketing to existing customers (and, since 2026, charity supporters) without consent
Information Commission	The UK regulator (formerly the ICO) since 30 September 2026
IDTA	International Data Transfer Agreement for transfers out of the UK

Frequently Asked Questions About UK GDPR Compliant Consent

What is considered UK GDPR compliant consent?

Consent that is freely given, specific, informed and unambiguous, given by a clear affirmative action such as ticking an empty box. It must be separate from other terms, name your organisation and any third parties, be as easy to withdraw as to give, and be recorded so you can prove it.

What are the 4 requirements for valid consent under UK GDPR?

Article 4(11) sets four: freely given, specific, informed and unambiguous. Article 7 adds that you must prove consent, keep the request separate, allow easy withdrawal and avoid making services conditional on unnecessary consent. In practice that makes seven tests.

Is implied consent valid under UK GDPR?

Only in limited offline situations and only for the obvious purpose, such as a business card dropped into a prize-draw box. Implied consent is never enough for marketing emails, non-exempt cookies or explicit consent.

Does consent have to be in writing?

No. It can be written, electronic or oral, as long as it is a clear affirmative act and you keep a record. Explicit consent must be an express statement, written or spoken.

Is a pre-ticked box valid consent in the UK?

No. Pre-ticked boxes, default-on toggles, silence and inactivity are not consent under the UK GDPR.

How long does UK GDPR consent last?

There is no fixed period. It lasts as long as the purpose and the person’s expectations; refresh it when purposes change and review it regularly. Many businesses re-permission inactive email contacts after about two years.

Do I need cookie consent for Google Analytics in the UK?

Usually yes. Since February 2026 a statistics-only exception exists, but GA4 linked to Google Ads, Google signals or data sharing goes beyond it. Tightly configured first-party analytics with a simple, free opt-out can be exempt.

Do I need consent to send B2B marketing emails in the UK?

Not for emails to companies, LLPs or government bodies (corporate subscribers), but you must identify yourself and offer an opt-out. Sole traders and some partnerships are treated like individuals and need consent or the soft opt-in.

What is the soft opt-in?

A PECR rule letting you email or text existing customers about similar products without consent, if you collected their details during a sale or negotiation, offered an opt-out then, and include one in every message. Charities gained their own version in February 2026.

Are cookie walls allowed in the UK?

Blocking access unless people accept tracking will usually fail the freely-given test. A consent-or-pay model can be acceptable if the paid alternative is genuinely equivalent, fairly priced and clearly explained.

Must a cookie banner have a Reject all button?

The regulator expects a Reject all option on the first layer that is as prominent and easy as Accept all. Hiding refusal behind extra clicks is high risk.

What is the difference between consent and explicit consent?

Explicit consent must be confirmed in words, such as a signed or ticked statement that names the sensitive data, decision or transfer. Ordinary consent can be shown by a clear affirmative action.

At what age can a child give consent in the UK?

For online services offered directly to children and relying on consent, 13. Under 13 needs parental consent. For other processing, competence is assessed; in Scotland 12 and over is presumed competent.

Can people withdraw consent, and what happens next?

Yes, at any time, and it must be as easy as giving it. You must stop the processing as soon as possible; processing before withdrawal stays lawful.

Is UK GDPR consent different from EU GDPR consent?

The definition is the same. Differences are around it: since 2026 the UK allows first-party analytics and appearance cookies without consent, broad research consent, and a charity soft opt-in, and EDPB guidance is no longer binding in the UK.

Can I use a bought email list in the UK?

Only if each contact consented to marketing from your organisation by name. Generic ‘selected partners’ wording does not cover you, so most bought lists can’t be emailed lawfully.

What is the fine for non-compliant consent in the UK?

Up to £17.5 million or 4% of global annual turnover under the UK GDPR and, since the Data (Use and Access) Act, under PECR too. Compensation claims and orders to delete data are also possible.

Who enforces consent rules in the UK now?

The Information Commission, which replaced the Information Commissioner’s Office on 30 September 2026. Its powers and guidance on consent carried over.

Get a Free UK Consent Check

Send us your website address. Within two working days we’ll show you which tags fire before consent, whether your banner passes the 7 tests, and what to fix first. No obligation, no shared passwords needed.

Email chennareddy819@gmail.com WhatsApp +91 9505971747

Hyderabad, India · Serving the UK, US, Canada, Europe, Australia, New Zealand, Singapore, Japan and Hong Kong 100% online · Replies within one UK working day

About the author

Chenna Reddy, Founder, Digital Masters 360 (Hyderabad, India). Chenna leads DM360’s consent, tracking and performance-marketing work for clients in the UK, US, Europe and Australia, delivered 100% online.

How we wrote this: based on the UK GDPR, PECR, the Data (Use and Access) Act 2025 and the regulator’s published guidance, checked on 9 October 2026.

Disclaimer: this guide is general information, not legal advice. For decisions about your organisation, speak to a qualified UK data protection solicitor or adviser.

Sources

Last updated: 9 October 2026. Related guides: Data Protection Act 2018 and UK GDPR · GDPR versus CCPA · Australian Privacy Principles · NZ Privacy Act 2020