June 27, 2025
On June 11, the Data (Use and Access) Bill passed the House of Lords. Just over a week later, on June 19, it received Royal Assent, and is now known as the Data (Use and Access) Act 2025.
This is one of the most significant updates made to the UK’s data protection laws since GDPR came into effect in 2018. So, let’s go through the key changes and what they mean for you.
There have been several changes including further clarity surrounding legitimate interest as a lawful basis when processing data for direct marketing purposes, modernisation of the Information Commissioner’s Office (ICO), and the enablement of AI and automated decision making where it is beneficial and low risk.
But one of the most notable changes pertains to cookies. The DMA (Data & Marketing Association) states:
‘Cookies used strictly for necessary purposes, internal statistical analysis, improving functionality, security updates, or emergency assistance will no longer require consent.’
Previously, under GDPR, users had to give consent for a website to use cookies to collect personal information. Now this explicit requirement for consent for necessary purposes, internal statistical analysis, improving functionality, security updates, or emergency assistance has been removed.
This is incredibly useful for businesses as it's common to experience annoying popups that request complex consent signals for a range of different cookie categorisations. But the new bill implies that consent may only need to be gathered for personalised advertising purposes. This means websites can access anonymised user data regardless, making it easier for companies to collect analytics and usage data to make more informed decisions for their business and marketing efforts.
Additionally, when cookie banners are required, they will be simpler and easier to manage, which not only improves the user experience, but also reduces operational costs.
This is just our interpretation of the information provided, it’s yet to be confirmed how the bill impacts specific tools. We'll update this post as more information is provided and real-world use cases become clear.
If you’re unsure about how to remain compliant with your marketing activities, don’t hesitate to get in touch with us today.
