Privacy, Consent and Tracking in 2026

UK: PECR and the soft opt-in

In the UK, marketing email and texts are governed by the Privacy and Electronic Communications Regulations (PECR), enforced by the Information Commissioner's Office. The ICO's guidance on electronic mail marketing states the core rule plainly: you must not send marketing emails or texts to individuals without specific consent. There is a limited exception, often called the soft opt-in, for your own previous customers: people who bought, or negotiated to buy, a similar product or service from you, and who were given a simple way to opt out both when their details were collected and in every message.

The rule turns on who the recipient is. Sole traders and some partnerships are treated as individuals. Corporate bodies — companies, LLPs, government bodies — are not covered by the consent requirement, so you can email them; but the ICO describes it as good practice and good business sense to keep a 'do not email' list of businesses that object, and notes that emailing an employee at a personal corporate address (firstname.lastname@company) still raises data protection issues.

One 2026-specific caution: the ICO's page carries a notice that, due to changes made by the Data (Use and Access) Act, the guidance is under review and may change. Check the ICO's current guidance before relying on any detail here.

EU: what valid consent means under the GDPR

Where consent is your lawful basis under the EU GDPR, Article 7 sets conditions. You must be able to demonstrate that the person consented. If consent is requested in a written declaration that also covers other matters, the request must be clearly distinguishable from them, in plain language. The person has the right to withdraw consent at any time, must be told so before consenting, and — the clause that matters most operationally — it must be as easy to withdraw consent as to give it. When assessing whether consent was freely given, account is taken of whether a service was made conditional on consent that was not necessary for it.

The European Data Protection Board's Guidelines 05/2020 on consent (adopted May 2020) are the regulators' collective interpretation and the right next read. For marketing, the practical consequences are a record of when and how each person consented, a consent request that stands on its own rather than being buried in terms, and an unsubscribe that is genuinely one step.

Marketing email in EU member states is also subject to national electronic-communications rules alongside the GDPR. The details vary by country; this is an area for local advice.

US: California and the state-law patchwork

In the US, CAN-SPAM (Lesson 3.3) governs commercial email, while the rights people have over their personal data more broadly come largely from state laws. California's is the most developed. The California Attorney General's CCPA page lists consumers' rights: to know what personal information a business collects, its sources and uses; to delete it; to correct inaccurate information; to limit the use of sensitive personal information; and to opt out of the sale or sharing of their personal information — including via a user-enabled global privacy control, after which a business cannot sell or share their information unless the consumer later authorizes it again.

California is no longer alone. The IAPP maintains a US State Privacy Legislation Tracker of comprehensive state privacy laws, last updated in September 2026, and the laws it tracks set different thresholds and rights. The workable approach for a small company is to adopt the strictest common practices — honour opt-out signals including the global privacy control on your website, keep a data inventory, honour deletion requests — rather than track each state separately, and to get advice when you approach any state's applicability thresholds.

Third-party cookies: what actually happened

For five years the marketing industry planned around Chrome removing third-party cookies. That is not what happened. In April 2025 Google announced that, taking ecosystem feedback and other factors into account, Chrome would maintain its current approach of offering users third-party cookie choice and would not roll out a new standalone prompt for third-party cookies. In October 2025 Google followed up: after evaluating feedback and in light of low adoption, it decided to retire a set of Privacy Sandbox technologies that had been built as cookie replacements.

So, as of 2026, Chrome keeps third-party cookies as a user choice rather than removing them. The practical lesson is not that tracking is back. Consent rules (above) apply regardless of what a browser technically allows, users can still turn third-party cookies off, and the durable asset for a small company is first-party: people who chose to give you their email, their questions in a call, and their behaviour on your own site, used under a lawful basis they understood.