Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
Most businesses treat “cookie compliance” as a solved problem once a consent banner is installed, but the Privacy and Electronic Communications Regulations (PECR) actually cover any technology that stores or accesses information on a user’s device — not just cookies. Session replay tools, heatmap trackers, device fingerprinting scripts, tracking pixels embedded in emails, and CNAME-cloaked first-party trackers all fall under Regulation 6 and generally require the same informed consent as a cookie. The Information Commissioner’s Office has run a sustained programme of audits and warning letters targeting the UK’s most-visited websites over their use of these technologies, and its updated online tracking guidance makes clear that consent must be as easy to refuse as to accept, that pre-ticked or bundled consent for analytics and marketing tools is not valid, and that fingerprinting techniques used to circumvent cookie consent altogether are a direct compliance risk.
Session replay and heatmap tools are a particular blind spot because they can capture far more than businesses realise: mouse movements, keystrokes, and on-screen content including, in poorly configured setups, form fields that were never meant to be recorded such as passwords, card numbers, or health information typed into a support chat. Where that content amounts to personal data, or special category data, it triggers UK GDPR obligations on top of PECR — including a lawful basis, appropriate technical masking, and inclusion in the record of processing activities — regardless of what the cookie banner says. Any UK business running analytics, marketing pixels, replay/heatmap software or A/B testing scripts should check what those tools actually capture and how consent is obtained, rather than assuming a compliant-looking cookie banner covers everything running on the page.
