Legal Requirements for Websites and Apps: United Kingdom

The UK looks like the EU and is quietly drifting away from it. UK GDPR still governs personal data with no size threshold, PECR still governs cookies and marketing — but since the Data (Use and Access) Act 2025 took effect on 5 February 2026, some statistical analytics qualify for a conditional consent exception in the UK, PECR fines jumped to UK GDPR levels (£17.5 million or 4% of global turnover), and from 19 June 2026 people can complain directly to you and you must respond. Alongside that sit three things that catch small builders off guard: the Online Safety Act, whose scope depends on service functions, UK links and statutory exemptions; the ICO data protection fee, which is a legal registration you probably owe; and the Equality Act, which makes an inaccessible site a discrimination risk. The single most useful UK-specific fact: some aggregate statistical analytics can qualify for an exception, with clear notice, a simple free objection mechanism and restricted purposes. Notice plus an opt-out does not exempt every analytics product. That's a real divergence from the EU, and it changes how you build. This is the UK chapter of our pre-launch legal checklist. Run that prompt sequence first, then layer this on.

Key takeaways

• UK GDPR has no general revenue or headcount exemption; establishment, offering and monitoring determine territorial scope.
• Since 5 February 2026, statistical/analytics and appearance/preference cookies are exempt from consent — but only with clear information and a genuine opt-out.
• PECR fines rose from £500,000 to £17.5 million or 4% of global turnover.
• From 19 June 2026, individuals can complain directly to you; you must acknowledge within 30 days and resolve without undue delay.
• Almost every business processing personal data must pay the ICO's annual data protection fee — a simple registration people forget.
• The Online Safety Act can cover small user-to-user or search services with UK links, but limited-functionality and other exemptions must be checked. Ofcom fines reach £18 million or 10% of global turnover.
• Marketing email: consent required, with a narrow "soft opt-in" for your own existing customers of similar products.

UK GDPR: what changed, and what didn't

Didn't change: the fundamentals. A lawful basis for every purpose, transparency about what you collect and why, data minimisation, individual rights (access, rectification, erasure, portability, objection) answered within one month, written contracts with every processor, a 72-hour breach notification to the ICO where there's a risk to individuals, and accountability — being able to show your working.

Did change, via the Data (Use and Access) Act 2025, with key provisions effective 5 February 2026:

• Recognised legitimate interests. A new lawful basis covering things like crime prevention, safeguarding and national security, without a balancing test. Narrow, but useful.
• Automated decision-making loosened. The prohibition on solely automated significant decisions now applies mainly where special category data is involved; other automated decisions can rest on a broader set of bases, with safeguards.
• Direct complaints, from 19 June 2026. Individuals can complain to you first. You must acknowledge within 30 days and deal with it without undue delay. Build a route for this — an email address in your privacy notice and a place to log it.
• PECR penalties aligned with UK GDPR. Nuisance marketing and cookie violations now carry the same ceiling as data breaches.

International transfers. The UK recognises the EEA as adequate, and uses the IDTA or the UK Addendum to the EU SCCs for other destinations, plus the UK Extension to the EU–US Data Privacy Framework for certified US recipients.

The ICO data protection fee. If you process personal data as a business, you almost certainly need to register with the ICO and pay a tiered annual fee. It's small for a micro business and it's a legal requirement, not a subscription — failing to pay is itself an enforceable breach. Check your tier on the ICO's site and set a calendar reminder.

Cookies: the UK's genuine divergence

The statistical-purpose exception is limited to aggregate information used to improve the service or website. It does not generally permit identifying, profiling or tracking visitors across sites. A third party cannot reuse the data for its own advertising. Clear information and a simple, free objection mechanism are required.

Necessary storage and other exceptions have their own conditions; do not apply the statistical rule to every category. Check the actual configuration against ICO’s exceptions guidance. Optional advertising remains consent-gated.

The Online Safety Act — yes, it probably applies to you

An in-scope user-to-user or search service with UK links can have duties even when small. However, there are statutory exemptions. A service limited to comments or reviews on provider-published content may qualify for the limited-functionality exemption; user posts, messaging and other features can change that assessment.

Use Ofcom’s scope checker and the Act’s exemption explanations. If in scope, document illegal-content and children’s-access assessments, implement proportionate reporting and safety controls, and keep them current. Age assurance follows the applicable duties and risks, not simply the existence of a form.

Consumer rules if you sell

Consumer Contracts Regulations 2013: pre-contract information, a 14-day cancellation right for distance contracts, and a model cancellation form. Digital content delivered immediately can be excluded only with the consumer's express consent and acknowledgement that the right is lost — capture both at checkout.

Consumer Rights Act 2015: goods, services and digital content must be as described, fit for purpose and of satisfactory quality. You cannot contract out of it.

DMCC Act 2024: since April 2025 the CMA enforces unfair commercial practice rules directly, with fines up to 10% of global turnover. The provisions with teeth for small products: drip pricing — the total price, including unavoidable fees, must be shown up front — and fake reviews and concealed incentivised reviews, which are prohibited. A new statutory regime for subscription contracts (reminders before renewal, easy exit, cooling-off) is legislated but awaiting commencement, anticipated by the government for spring 2027, subject to legislation. Build for it now; it's the direction of travel in every market on this site.

Identity and contact details must be given before the contract: trading name, geographic address, and a way to reach you quickly.

Accessibility

There is no web-specific regulation for private businesses. What exists is the Equality Act 2010, which requires reasonable adjustments so disabled people aren't put at a substantial disadvantage — and a website that can't be used with a keyboard or a screen reader is exactly that. Claims are brought by individuals, and the practical benchmark courts and auditors use is WCAG 2.2 Level AA. Public sector bodies are separately bound by accessibility regulations at that standard.

The ICO's Age Appropriate Design Code ("Children's Code") applies to any information society service likely to be accessed by children in the UK: high-privacy defaults, minimal data, no nudge techniques toward weaker privacy, geolocation off by default, and no profiling for advertising.

The UK-specific prompt

Run this after the ten prompts in the main checklist:

Add United Kingdom compliance mechanics to this app. Implement each item and report exactly what changed:

1. Inventory cookies and device access. Keep optional tracking blocked unless I have documented that its configuration meets a specific PECR exception. For qualifying statistical use, enforce its sole service-improvement purpose, clear notice and a simple free objection mechanism. Do not exempt a tool merely because it is labelled analytics. Advertising, marketing and cross-site tracking cookies must still be blocked until the user opts in. Show me the resulting list of scripts by category and which ones load before any user choice.
2. A privacy notice covering: lawful basis per purpose, retention, recipients, international transfers and the safeguard used, all UK GDPR rights, the right to complain to us directly and then to the ICO, and our ICO registration reference as [[ICO REGISTRATION NUMBER]].
3. A direct complaints route: a form or dedicated address for data protection complaints, an automatic acknowledgement to the complainant, and an internal log recording the date received, the acknowledgement date and the outcome.
4. Self-service rights: export my data, delete my account, correct my profile, and object to marketing — each in at most two clicks.
5. Marketing email consent: an unticked opt-in at signup, a record of when and how consent was given, sender identification and a working unsubscribe in every message. If we rely on the soft opt-in for existing customers, mark that in the code with a comment so I can check it with a lawyer.
6. If the app has any user-to-user feature — comments, messaging, profiles, uploads, reviews — list every one of them, and add: a way for any user to report content, a record of reports and what we did about them, terms stating what is not allowed, and a note in the admin area prompting an annual illegal-content risk assessment. Do not claim the app is Online Safety Act compliant; just build the mechanisms and list what is missing.
7. If we sell to consumers: total price including all unavoidable fees shown up front, a 14-day cancellation route in the account area, an explicit unticked acknowledgement for immediate delivery of digital content, and renewal date and amount shown before purchase and in account settings.
8. An accessibility pass against WCAG 2.2 Level AA — report findings by severity before fixing anything.

For each item report PASS or explain what blocked it.
Copy prompt

Pre-launch checklist — UK

• ICO data protection fee paid and registration number in the privacy notice
• Privacy notice states lawful basis, retention, transfers, rights and both complaint routes
• Cookie categories correctly split: analytics/preferences with notice + opt-out, advertising behind opt-in
• Direct complaints route live, with 30-day acknowledgement
• Data export, deletion and correction all work end to end
• Marketing consent captured and recorded; unsubscribe works
• User-to-user features inventoried; reporting mechanism, terms and risk assessment documented
• Selling: total price up front, 14-day cancellation, digital-content acknowledgement, renewal transparency
• Accessibility audited against WCAG 2.2 AA
• Children's Code considered if under-18s could plausibly use the service

What the build checks establish

The prompts are implementation requests, not a legal certification. Two-click controls and consent-first defaults are practical design choices, not universal statutory requirements. Confirm jurisdiction, exceptions, retention and provider contracts separately. Verify controls with test accounts and actual browser/network behaviour; a builder’s PASS based only on code inspection is incomplete evidence.

Official sources and review scope

Updated September 14, 2026. The linked sources support the scope and corrections discussed here; this is an editorial review, not an exhaustive legal opinion or a certification of your product. Check the operative rule when acting.

• ICO cookie exceptions
• Ofcom scope checker
• Government subscription regime response

• ICO complaints commencement

The UK is EU-shaped with its own dialect — and the differences are worth money. Run the pre-launch checklist, then the UK prompt above. Selling elsewhere? See the European Union, the United States, Canada, Australia, Brazil and Israel. You can build this.