WIREDGOV

Blog posted by: William Malcolm, the ICO's Executive Director Regulatory Risk and Innovation, 18 May 2026.

Online advertising is a key component of the UK’s digital economy, helping to fund content, services and innovation across the web. At the same time, the Privacy and Electronic Communications Regulations (PECR) and the UK General Data Protection Regulation (UK GDPR) play an important role in safeguarding people’s rights and freedoms when they use online services. People rightly expect high standards of transparency and control in relation to online advertising. 

Through our online tracking work, we are committed to driving high standards of compliance across the industry.  

We are also committed to ensuring that our regulatory approach enables investments in privacy-friendly advertising and recognises the spectrum of risks that different advertising technologies and use cases create.  

That is why, last year, to support our commitments to government on economic growth, we carried out a review to understand where the regulation 6 consent requirements in PECR are preventing the development and adoption of more privacy-preserving forms of online advertising. This included an assessment on where the regulation 6 ‘one size fits all’ approach to managing a spectrum of privacy risks and harms could be holding back innovation. We have now completed this work.  

We have published our findings as advice to government as it considers changes to regulation 6 through secondary legislation. In this context, we have acted in our statutory role as an independent expert adviser, providing evidence-based input to support government’s public policy development. 

We’ve heard from many organisations across the advertising ecosystem that they want to do things differently and explore alternatives to more intrusive behavioural advertising models. While new privacy‑enhancing technologies offer opportunities to do things differently, many told us they were getting stuck. This is in part because regulation 6 applies consent requirements regardless of the level of privacy risk involved, limiting incentives to invest in and adopt lower risk approaches. While this is by no means the only obstacle to the adoption of such approaches, we often hear that it is a regulatory barrier.  

Regulation 6, alongside the UK GDPR, governs the use of storage and access technologies such as cookies, scripts and tags for the purposes of online advertising. Within the current framework, most commercially viable online advertising requires consent whenever information is stored on, or accessed from, a user’s device, even where the risks to people’s privacy are relatively low. To address this challenge, we analysed a range of online advertising activities and considered which ones pose a lower risk to people’s privacy and could therefore be delivered without regulation 6 consent.  

Our advice is evidence-based and transparent. It is informed by analysis of PECR and the UK GDPR, engagement with stakeholders across the online advertising ecosystem and user research into people’s expectations around online advertising and privacy. Alongside our advice, we are also sharing findings from our public call for views, results from our citizen juries and a cost‑benefit analysis assessing the impacts of the proposed approach outlined in our advice to government. 

Our evidence to government 

Our work shows how regulation 6 could be amended to allow certain low risk forms of online advertising to operate without consent, while continuing to require consent for advertising that involves intrusive tracking and profiling people over time and across services. 

This reflects our assessment that privacy risks are lower where advertising is based on the context of the content being viewed, rather than information about a person’s past online activity. Our user research indicates that this approach is closely aligned with people’s expectations and could provide a viable alternative to behavioural advertising for online services whose users don’t consent to more intrusive tracking. 

It’s important to remember that nothing has changed at this stage. The existing PECR rules still apply, and organisations must continue to comply with them. Our guidance on the use of storage and access technologies provides further clarity on the current legislative framework and our expectations for compliance. 

We know that the majority of organisations are focused on delivering online advertising responsibly. However, we have seen through our engagement and monitoring of this industry that some actors choose to adopt technologies and approaches that undermine informed choices and increase risks to users. Today, we remind organisations delivering online advertising that, where users lack control, harm can occur. We will take action against organisations who act irresponsibly and in ways users do not understand or expect.  

If government were to amend regulation 6, there could be practical benefits for people. Over time, it could mean that websites and apps would not always need to request consent when you first visit them, where only low-risk advertising is involved. This could help reduce consent fatigue, while maintaining a requirement for valid consent where advertising relies on more intrusive tracking or profiling. We look forward to working with all stakeholders on next steps in this important process and to continuing to advance our Online Tracking strategy.