Does a Smart Meter Reading Count as Access Under PECR?

Most people think of PECR regulation 6 as the cookie rule. The wording is wider than that: it bans storing information, or gaining access to information stored, in someone's "terminal equipment" without consent. So when your supplier pulls a reading off your smart meter, is that "access"? The honest answer is that the text points towards yes, and then a few other things get in the way.

This is my reading of the legislation, not settled law, and I have not found a court decision on it. Treat it as an argument worth understanding rather than a ruling.

What regulation 6 actually says

Regulation 6(1) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 says a person must not store information, or gain access to information already stored, in the terminal equipment of a subscriber or user. There are two ways out:

• the user gets clear and comprehensive information about the purpose, and gives consent; or
• an exemption applies, such as the access being strictly necessary for a service the user has requested.

Notice what is missing: nothing says "cookie", "browser" or "personal data". The rule is about the device and the information on it. Whether the data is personal data is irrelevant to whether regulation 6 is engaged.

Is a smart meter "terminal equipment"?

PECR does not define terminal equipment itself. It borrows the meaning from the EU telecoms terminal equipment directive (2008/63/EC, as retained). In short: equipment connected, directly or indirectly, to the interface of a public telecommunications network, for sending, processing or receiving information.

The "indirectly" matters. A GB smart meter does not talk to the mobile network itself. It talks over a short-range home network to a communications hub, and the hub has the cellular or long-range link. The hub is the obvious terminal equipment. The meter hangs off it.

Is the meter then "indirectly connected"? I think a regulator could comfortably say so. A phone connected via a laptop's hotspot is not outside the definition just because it is one hop further away.

Is reading it "gaining access"?

This is the easy bit. The meter stores consumption registers, tariff data and, in some cases, half-hourly interval data. A remote request that returns those values is a straightforward case of gaining access to stored information. There is no clever reading needed.

Quick detour, because it is the part I find daft: the "subscriber or user" might not be the person you assume. The subscriber is whoever holds the contract with the telecoms provider. The user is whoever is using the equipment. In a rented flat, the tenant, the landlord and the energy supplier can all plausibly be one or the other for different bits of kit. Consent from the wrong one is no consent at all.

Where the argument runs into exemptions

Even if regulation 6 applies, the strictly necessary exemption does a lot of work. Billing a customer for energy they used is a service they asked for, and a reading is needed to do it. A monthly or quarterly read to produce an accurate bill is the strongest case for exemption.

The exemption is narrower than people hope, though. It covers what is strictly necessary for the service the user requested, not what is convenient for the supplier. That leaves some awkward cases:

• Half-hourly data collected for marketing or tariff targeting is not needed to send a bill.
• Data pulled for network planning or product analytics is a different purpose from billing.
• A supplier app on your phone is unambiguously terminal equipment, so anything it stores or reads there needs its own analysis.

The Data (Use and Access) Act 2025 added further exceptions to regulation 6, including for some statistical and service-improvement purposes, with conditions attached. Check the current text of regulation 6 and its schedule before relying on any of them, because they carry notice and opt-out requirements.

The sector rules got there first

Here is the thing that makes this less urgent in practice. Suppliers already work under licence conditions and the Smart Energy Code, which set consent and opt-out rules for how often they can read your meter. As I understand the framework, daily reads can be taken unless you opt out, and half-hourly reads need your consent for most purposes, with billing as a notable carve-out.

Those rules were designed for energy regulation and were not built as a PECR analysis, but the outcomes line up fairly closely. In effect, the licence regime has already forced suppliers to ask for consent at roughly the point where a strict PECR reading would require it.

The overlap does not make PECR irrelevant. A separate legal regime does not substitute for compliance with this one, and the two are enforced by different bodies: Ofgem for the licence conditions, the ICO for PECR.

What I would do as a supplier or app developer

1. Map each read by purpose: billing, safety, settlement, analytics, marketing.
2. Mark which purposes you would defend as strictly necessary for a service the customer requested.
3. For everything else, get consent that meets the UK GDPR standard, since PECR uses that definition.
4. Where the meter data is personal data (and half-hourly data about a household usually is), run the UK GDPR analysis in parallel. Lawful basis and PECR consent are separate questions.
5. Treat the phone app as its own regulation 6 problem.

My view: nobody should be surprised if the ICO eventually says regulation 6 does reach smart meters. The definitions fit, and the carve-outs are what keep ordinary billing out of trouble. What the exemptions do not cover is the stuff suppliers would quite like to do with the interval data, and that is exactly where consent has to exist.