The Information Commissioner’s Office (ICO) has issued an update on its online tracking strategy, which it launched at the beginning of 2025. It sets out the ICO’s plans to give people choice and control over how they are tracked online and provide businesses with certainty so they are able to innovate responsibly.
We recently wrote that the ICO had published its finalised guidance and impact assessment on the use of storage and access technologies (SATs) such as cookies, tracking pixels and scripts, following two consultations on updated guidance. The guidance includes examples and clarification to help these organisations’ compliance with the law and ensure others have choice about how their data is used.
The ICO has engaged with the online advertising industry to work towards future privacy-respecting initiatives. A significant proportion of online tracking is undertaken to provide key metrics to advertisers, meaning exploring and supporting approaches that enhance user privacy can improve users’ control over their data, and reduce the risk of misuse.
In 2025, the ICO consulted on its review of regulation 6 of the Privacy and Electronic Communications Regulations 2003 where the use of SATs may pose low privacy risks. It says that it will be publishing its advice to the government this month regarding removing PECR requirements to obtain consent for the use of storage and access technologies for online advertising purposes.
The ICO has also confirmed its commitment to reviewing cookie banners on the top 1,000 websites in the UK. Since taking action, the ICO has seen significant changes including a reduction in the prevalence of cookies being placed before users have expressed their choice. There has also been an increase in clear reject options on cookie consent banners and the ICO has reported that 992 out of the top 1,000 websites met the ICO’s compliance checks during their most recent tests.
In January 2026, the ICO completed its engagement with software companies providing online businesses with cookie banners and has driven improvements in standard products offered to website owners by working directly with key cookie banner vendors making up the largest market shares across the UK’s most popular websites. Companies such as OneTrust and Usercentrics have developed UK-specific templates aligned with the ICO’s guidance.
Investigations into several data management platforms by the ICO have been recently concluded. In these investigations, the ICO assessed areas of concern including the validity of consent for data processing carried out by these platforms and the lawful basis relied upon for processing. Following consideration and review of its concerns, the ICO has chosen not to take further action after observing significant positive improvements from the platforms.
The ICO has been monitoring the market adoption of consent or pay models and approaches to compliance. It will continue this monitoring and, where required, engage with industry participants to ensure users can freely give consent in these models.
The ICO is working towards ensuring that smart product manufacturers and developers factor data protection into their design approaches and seek consent if using SATs for online advertising purposes. The ICO will soon be publishing its finalised guidance and impact assessment on the use of consumer Internet of Things (IoT) products and services.
The ICO has also commissioned primary research to provide insights into understanding, views and attitudes towards control of personal information online. This research will feed into the ICO’s impact review of its online tracking strategy, the findings of which the ICO expects to publish later this year.
