Does PECR Apply to Businesses Outside the UK?

PECR is a UK statute, but “it’s a UK law” doesn’t answer the question most non-UK businesses actually want answered: does it apply to my business if I’m not incorporated there. The short answer is that PECR’s cookie and marketing rules generally follow the same logic as UK GDPR’s territorial scope, they’re triggered by who you’re reaching and what you’re doing to them, not by where your company is registered.

The cookie rule: triggered by the visitor, not your location

PECR’s Regulation 6 cookie consent requirement is generally understood to apply based on where the individual whose device is affected is located, similar in spirit to how EU/UK GDPR and the parallel EU ePrivacy rule apply based on the data subject’s location rather than the controller’s. If your website has UK visitors and sets non-essential cookies on their devices, the same practical logic that makes GDPR apply to non-EU businesses reaching EU visitors, covered in our GDPR territorial scope guide, applies here: a US, EU, or anywhere-based business with meaningful UK traffic should treat the cookie rule as in scope rather than assuming its non-UK incorporation is a shield.

The marketing rules: depends on where the recipient is

PECR’s restrictions on unsolicited marketing communications are generally understood to protect UK subscribers, individuals and certain UK-based businesses receiving the communication. A non-UK company sending marketing emails, texts, or making marketing calls to people in the UK is generally expected to comply with PECR’s consent and disclosure requirements for those communications, the same way a UK company sending marketing into the EU has to account for the local implementation of the EU’s ePrivacy rules in the recipient’s country.

Why this mirrors the GDPR pattern, not a coincidence

PECR was built to work alongside GDPR, and both trace back to the same underlying EU ePrivacy framework historically. It’s not surprising that their territorial logic runs in parallel: laws protecting individuals from specific practices, tracking and unsolicited marketing, generally focus enforcement on where the affected person is, since that’s who the law is designed to protect, rather than where the company doing the tracking or marketing happens to be based.

Practical enforcement reality for a non-UK business

The ICO’s practical ability to enforce against a business with no UK presence, assets, or corporate structure is more limited than against a UK-based company, enforcement mechanisms like fines and orders are harder to execute cross-border without cooperation agreements or a UK subsidiary to target. That said, this is a practical enforcement limitation, not a legal exemption, and businesses with any UK presence (a subsidiary, UK bank account, UK-based staff, or UK marketing spend) lose that practical distance quickly.

What to actually do if you have UK traffic or customers

1. Apply the same cookie consent standard to UK visitors that you’d apply to EU visitors under GDPR/ePrivacy, the substantive requirements are closely aligned.
2. Get proper opt-in before marketing to UK contacts, following the same scenario-based approach covered in our PECR email marketing guide.
3. Don’t assume distance from the UK is a durable compliance strategy, especially if your UK footprint (revenue, staff, or entity structure) grows over time.

This guide is educational and not legal advice. Cross-border enforceability and applicability depend on specific facts; consult a privacy attorney for your business’s situation.