Again, this isn't the GDPR at work here, it's ePrivacy, and, well, here's what the UK ICO say about PECR (their implementation): > regulation 6 actually applie

Again, this isn't the GDPR at work here, it's ePrivacy, and, well, here's what the UK ICO say about PECR (their implementation): > regulation 6 actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in either case by any method It's deliberately broad. You store it, you notify them. Full text on this: https://www.legislation.gov.uk/uksi/2003/2426/regulation/6/made https://www.legislation.gov.uk/uksi/2003/2426/regulation/6/m...