The ICO is consulting on its approach to enforcing the requirements in regulation 6 of the Privacy and Electronic Communications Regulations (PECR). The ICO says that it sees this as an opportunity for new commercially viable advertising models that can support innovations to improve consumer privacy and boost economic growth.
Currently, publishers deploying online advertising technologies must secure people’s consent. This is because online advertising involves storage of, or access to, information on people’s devices. Storage and access technologies for online advertising purposes do not meet any of the exceptions to regulation 6 requirements.
The ICO is exploring whether a risk-based approach to enforcing the PECR could allow publishers to deliver online advertising to users who have not granted consent, where there is a low risk to their privacy.
The ICO is clear that there will remain circumstances where online advertising will always require consent. For example, because it involves extensive profiling of people based on their online activity, habits and behaviour, potentially across different services and devices. Equally, this review does not change its views on the UK GDPR compliance requirements or current practices that could cause harm. It will continue to enforce consent requirements for collecting personal information for ad targeting and personalisation.
New routes to deliver viable online advertising
The ICO is exploring whether there are circumstances in which storage and access of information for certain advertising purposes can pose a low risk to user’s privacy.
In the ICO’s view, there are likely to be commercially viable ways to deliver online advertising that do not involve the scale and granularity of processing often undertaken with behavioural advertising. A new approach to regulation could create opportunities to unlock business growth through innovation, while safeguarding people’s privacy and improving user experience.
As long as users have a clear understanding that services appearing to be “free” are funded by advertising, they may accept some storage and access of information for functions to deliver that advertising. However, they may not accept the scale and granularity of processing often currently undertaken when they grant consent.
Regulatory approach
At the end of the year, the ICO will publish a statement identifying advertising activities that are unlikely to trigger enforcement action under the PECR. It will consider safeguards it would expect to reduce risks to users. This will enable new approaches to online advertising to scale-up. It will support the government in developing planned secondary legislation to amend the PECR rules and create a new exception to the PECR consent requirements for specific low-risk advertising purposes.
Capabilities for viable online advertising
The ICO’s approach intends to enable commercially viable ways to deliver online advertising. These need to be in line with data protection and privacy principles and be ways that people would find acceptable without their prior consent.
It will frame its statement around the following categories of online advertising capabilities:
- ad delivery and billing;
- ad fraud prevention and detection;
- brand safety, brand suitability and brand compliance;
- frequency capping;
- measurement and attribution; and
- targeting (ie how an advert is targeted towards a user or group of users).
The ICO is seeking views on its approach, as well as specific considerations under each of these categories. It says it is not its role as regulator to direct the industry towards any one solution or provider, but it says it ican offer new routes to innovative approaches. The consultation ends on 29 August 2025.
