DUAA’s five new cookie exceptions activated on 5 February 2026, and most UK WooCommerce stores have already misread them. The statistical exemption in Section 105 requires the data to be used for the SOLE purpose of service improvement — and any tag that also feeds an ad platform fails that test. Stevens & Bolton’s reading … Read more
The UK Data (Use and Access) Act 2025 requires data controllers — including every WooCommerce store with UK customers — to operate a documented complaints procedure from 19 June 2026. The new individual right to complain has a 30-day acknowledgment clock that starts the day the complaint arrives, not the day the store reads it. Most stores fixated on the February cookie reform missed the June operational deadline. ICO autumn 2025 draft guidance recommends publishing procedure information covering submission and processing, and DUAA expanded ICO investigative powers to compel interviews, demand audits, and issue stop orders.
The ICO finalised its storage and access technologies guidance on 29 April 2026, and most UK WooCommerce cookie banners were built against the wrong document. The final version adds two new sub-chapters — ‘simple means of objecting’ and ‘multiple purposes for same technology’ — plus a new chapter on DUAA exceptions that did not exist … Read more
Maximum UK PECR fines went from £500,000 to £17.5 million on February 5, 2026 — a 35× jump that took effect overnight when the Data (Use and Access) Act 2025 commenced. The Information Commissioner’s Office has been auditing the top 1,000 UK websites since January 2025. Of the first 200 it reviewed, 134 received warning … Read more
The UK Data (Use and Access) Act 2025 received Royal Assent in June 2025. You may have read the headlines: analytics cookies are getting an exemption. Consent banners might not be required. Here’s what those headlines left out: the exemptions are not yet in force. Secondary legislation is still pending. And while the consent rules … Read more
A demand letter arrived in a WooCommerce store owner’s inbox last year. Not from a European data authority. From the UK ICO. The store had UK visitors. It had GA4 installed. And GA4 was firing on page load — before anyone clicked the consent banner. That’s not a GDPR violation. It’s a PECR violation. And … Read more
