Using cookies and the law
You must be open about what cookies do, how and why you use cookies and provide instructions on how to turn them off to comply with electronic communications regulations.
Last updated 30 June 2025
The Data (Use and Access) Act (DUAA) became law on 19 June 2025. As a result, this guidance is under review and may change. See the latest DUAA guidance.
Cookies are text files that are stored on a user's computer when they visit a website that uses them. Thereafter, the cookie sends information back to the website. They can be used to monitor browsing preferences of users, eg types of goods searched for, pages visited and length of dwell time on each page. However, you need to be open with your customers about how you will use this information to comply with the law on cookies.
If you use cookies as part of your website you will need to tell individuals about that the cookies are there, explain what the cookies are doing and why, and get the person's consent to store a cookie on their device. You must give clear and comprehensive information about why you are using cookies and obtain their consent.
This information should be easy to understand and should tell users of the website that cookies will be used to collect and store information about them. You should also give users the opportunity to refuse the continued storage of any cookies on their computer or access to it and explain how users can turn the cookies off. There are very few circumstances where this information does not have to be provided.