How PECR and UK GDPR change the cookie banner on a UK lead-capture form

What to take away

Where PECR regulation 6 and UK GDPR consent meet on one enquiry form

PECR regulation 6 governs storage and access technologies on the device, so it catches cookies, local storage, pixels and any script that reads or writes to a visitor's browser. UK GDPR governs the personal data you then collect through the form. The two regimes meet at the moment a visitor lands on your enquiry page.

The banner is the PECR gate. The form is the UK GDPR gate. A UK lead-capture form usually needs both, because the banner sets or reads identifiers while the form collects names, work emails and phone numbers.

Take a typical enquiry form on a Manchester or Leeds B2B site. The banner loads first. If the visitor rejects, only strictly necessary storage runs. The form then collects the enquiry under a lawful basis you have chosen and disclosed.

That split matters for how you map the page. One row per purpose is how landing page data protection gets mapped, so the banner purpose and the form purpose sit in separate rows with separate bases.

Mapping the page event before the rule is the safer order. Map the page event before the rule when applying UK regulations to landing pages, because a script that fires on load behaves differently from one that fires on submit.

For a fuller treatment of the wider duties, including advertising claims and PECR and subscriptions, the same event-first method applies.

The two gates on one page

Why the order of firing matters

If an analytics pixel fires before the banner choice, you have set a non-essential technology without consent. That is a PECR regulation 6 problem, whatever your privacy notice says.

If the form saves a partial entry before the visitor submits, you are processing personal data. You need a lawful basis and privacy information at that point, not later.

Build the page so the banner resolves first, then the form scripts. Test with the browser network panel and read the request order, not just the visual banner.

Reading the ICO storage and access technologies guidance field by field

The ICO guidance on storage and access technologies is the rule behind cookie consent. It treats any technology that stores information on, or gains access to information stored in, a user's device as within scope, not just HTTP cookies.

That definition covers localStorage, sessionStorage, IndexedDB, pixels and SDKs in apps. Server-side identifiers that reach the device fall in scope too. A banner that only lists cookies misses most of what a modern lead form loads.

The guidance also sets the consent standard: an unambiguous indication of wishes by a clear affirmative action. Silence, pre-ticked boxes and continued browsing alone do not meet it.

Now apply that to one UK enquiry form, field by field. The example below is a standard B2B enquiry form used by a Midlands professional services firm.

Field 1: the banner itself

The banner is not a form field, but it is the first interaction. It must offer accept and reject with equal prominence, and it must not set non-essential storage before a choice.

Field 2: first name and last name

These identify a person, so UK GDPR applies from the moment they are captured. The lawful basis is usually legitimate interests or consent, and the privacy notice must say which.

Field 3: work email

This is the field that triggers the soft opt-in question later. It is also the field most likely to be used for duplicate suppression and CRM matching, which are further purposes.

Field 4: phone number

Phone numbers attract PECR rules on live and automated calls, and on text messages. If you plan to ring the enquirer, that purpose belongs in the privacy information.

Field 5: company name and job title

These are personal data where they identify a sole trader or a named individual at a small firm. Do not treat them as corporate data by default.

Field 6: free-text enquiry box

Visitors often type health, financial or other special category details into free-text boxes. You need a stated purpose for the field and a warning not to include sensitive details.

Field 7: marketing opt-in tick box

This must be unticked, separate from the submit action, and worded so the visitor knows what they are agreeing to receive and from whom.

Field 8: submit button

The submit button should not double as consent to marketing. Keep the transaction and the marketing permission as separate acts.

What each field implies for storage

The test to apply to each field

The ICO's own Guide to Privacy and Electronic Communications Regulations is the starting point for the cookie and marketing rules that sit behind this reading.

Consent wording, granularity and the soft opt-in for follow-up email

Consent wording must be specific to each purpose. A single line that covers analytics, advertising and email marketing fails the granularity test in ICO guidance on consent.

Use plain English. Say what you will send, how often, and how to stop it. Avoid words like "partners" and "selected third parties" unless you name them or describe the categories clearly.

Granularity also applies to the banner. Separate toggles for analytics, advertising and functional storage are the safer design. A single accept-all button with no reject route is the weakest position.

Under UK GDPR, consent must be freely given, specific, informed and unambiguous. It must also be as easy to withdraw as to give, which means a visible route to change the choice later.

Soft opt-in for email

Soft opt-in is the PECR rule that lets you email an existing customer or enquirer about similar products without fresh consent, if three conditions hold.

A lead-capture form sits at the edge of this rule. An enquiry is not always a sale or negotiations for a sale, so soft opt-in is not automatic. The safer reading is that a plain enquiry may need consent for marketing email.

If you do rely on soft opt-in, the form must still carry an opt-out at the point of collection. A tick box that says the enquirer does not wish to receive marketing is enough, provided it is clear.

Soft opt-in covers email and SMS to existing contacts. It does not cover cold lists, third-party lists or advertising cookies, which need consent.

Consent wording examples that pass and fail

The ICO's Consent guidance sets out these standards in full, including the need to keep records of consent.

The privacy information a UK lead-capture form must carry

The right to be informed means a visitor must know certain things before or at the point you collect their data. On a lead-capture form, that usually means a short notice on the page plus a link to the full privacy notice.

The short notice should name your organisation, the purposes and the lawful basis. It should also name the recipients or categories of recipient, any international transfers and the retention period. The individual rights available belong there too.

It should also say how to withdraw consent and how to complain to the ICO. If you use automated decision-making, including lead scoring that has legal or similarly significant effects, say so.

Keep the notice layered. A short summary next to the submit button, with a fuller notice one click away, is easier to read than a wall of text above the form.

What the form notice should say, in order

The ICO's Right to be informed guidance lists the full set of information duties, including the exceptions where some details can be withheld.

Where the disclosure sits on the page

Build a clear disclosure procedure that names who writes the notice, who reviews it, and when it is checked against the live form fields.

A form field added by a growth team on a Friday can quietly create a new purpose. The disclosure procedure should catch that before the page goes live.

Cookie banner design choices that survive an ICO consent audit

An ICO consent audit looks at behaviour, not just wording. The auditor will test the banner as a visitor, on a phone and on a desktop, with cookies cleared.

The first test is the pre-tick state. Nothing non-essential should fire before a choice. The second is the reject route: it must be as easy to find and use as accept.

The third is granularity. Separate purposes need separate controls. The fourth is the record: you must be able to show what a given visitor chose and when.

Design choices that fail include a coloured accept button next to a grey reject link, a banner that reappears on every page until accept, and a cookie wall that blocks content until consent.

Design patterns that hold up

What an audit trail should contain

Keep the log for as long as you rely on the consent. If you cannot show the record, you cannot show consent.

What the Data (Use and Access) Act 2025 changes for cookie banners

The Data (Use and Access) Act 2025 changes parts of the UK cookie regime. It allows the Secretary of State to set exceptions to the consent requirement for specified low-risk purposes, such as some analytics and security storage.

The Act also addresses the harm from repeated consent banners and nuisance cookies. In practice, the direction is toward fewer interruptions for low-risk storage and clearer rules for the rest.

The change does not remove consent for advertising cookies or for cross-site tracking. It also does not remove the need for privacy information on the form.

The Data (Use and Access) Act 2025 is the text to read alongside ICO guidance, because the exceptions depend on regulations made under it.

What to do while the exceptions are settled

Keep the current consent model running. Do not switch off the banner on the assumption that all analytics are now exempt.

If you plan to rely on an exception, document which one and why the storage is low risk. Name the exception in your records.

Watch for ICO guidance on the new exceptions and update the banner when it lands. A dated change log on the banner version helps here.

A field-by-field consent cookie banner checklist for UK forms

Use this checklist before a UK lead-capture form goes live. It covers the banner, the fields, the wording and the record.

Banner and storage

Form fields and lawful basis

Wording and follow-up

Worked example: one enquiry form, checked

A Bristol software firm runs an enquiry form with a banner, a name field, a work email, a phone number and a marketing tick box. The banner loads with analytics off. The visitor rejects, so only a necessary consent flag is set.

The form collects the enquiry under legitimate interests, with a short notice next to submit. The marketing tick box stays unticked, so no soft opt-in is assumed and no marketing email is sent.

The consent record shows the reject choice, the banner version and the timestamp. The firm passes the four audit tests: pre-tick state, reject route, granularity and record.

Common questions