The long-awaited amendments to the UK’s data protection regime received Royal Assent on 19 June 2025. These include a number of changes to the UK’s implementation of the ePrivacy Directive, the Privacy and Electronic Communications Regulations 2003 (PECR). The changes which will have the widest impact, and which are the focus of this article, are

1. the loosening of the consent rules for analytics cookies,
2. the ability of charities to rely on the soft opt-in for electronic direct marketing, and
3. the alignment of the maximum penalties with those under the UK GDPR.

The Act also made some technical changes to definitions, a change in the deadline for communications providers to notify personal data breaches from 24 hours to 72 hours, and changes to the powers of the Information Commissioner’s Office (ICO) (soon to become the Information Commission) to enforce PECR to more closely match powers under the UK GDPR. Lastly, it includes measures to encourage the development of sectoral codes of conduct in relation to PECR.