The ICO has published its finalised guidance on Storage and Access Technologies.
The guidance, which covers how the Privacy and Electronic Communications Regulations 2002 (PECR) (and where relevant, the UK GDPR) apply to cookies, tracking pixels, device fingerprinting and similar technologies (‘storage and access technologies’), incorporates updates following two consultations and changes introduced by the Data (Use and Access) Act 2025. It includes new examples and points of clarification to help organisations comply with the law. It reflects the law as it currently stands, and sits separately from the ICO’s ongoing work to review regulation 6 of PECR for online advertising purposes, on which further updates will follow in the coming weeks. The ICO has also published a summary of the consultation responses.
The ICO has also published an update to its online tracking strategy which aims to:
- Provide industry with clarity on the requirements of data protection law, leaving no excuse for non-compliance;
- Make it easier for publishers to adopt more privacy-friendly forms of online advertising;
- Ensure publishers give people meaningful control over how they are tracked on websites;
- Investigate compliance concerns in the wider adtech ecosystem;
- Confirm how publishers can deploy ‘consent or pay’ models in line with data protection law, supporting their economic viability;
- Ensure that people have meaningful control over tracking for personalised advertising on apps and connected TVs; and
- Support the public to take control of how they are tracked online.
