How will the ICO make use of its new cookie enforcement powers?

A blog article by Jon Baines for Mishcon de Reya considers the enhanced enforcement powers granted to the Information Commissioner's Office (ICO) concerning the use of unlawful cookies and tracking technologies. Baines writes that under the Data (Use and Access) Act 2025 (DUA Act), the legal threshold for issuing fines has been significantly lowered. Previously, the ICO could only penalise "serious" contraventions likely to cause "substantial damage or substantial distress". Following the introduction of secondary legislation enacting the majority of the data protection amendments under the DUA Act on 5 February 2026, these requirements have been removed, meaning any breach is now potentially punishable.

The DUA Act has also increased the maximum penalty for contravening the Privacy and Electronic Communications Regulations (PECR), aligning them with those under the UK General Data Protection Regulation (GDPR). Despite the increased risk, Baines rightly notes that the ICO has historically shown a limited appetite to enforce cookie provisions compared to other areas, such as unsolicited marketing. However, Baines also warns organisations to watch for any change in tone coming from the regulator, particularly once the ICO releases its updated guidance. 

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.