UK ICO’s risk-based approach to online advertising and cookie consent

The question

How is the ICO proposing to adopt a more risk-based, proportionate approach to online advertising regulation - particularly around cookies - while maintaining privacy safeguards? And will it help free up online advertising in the UK?

The key-takeaway

The ICO has opened a consultation on adopting a risk-based approach to enforcing PECR for online advertising (the Consultation), alongside updated guidance reflecting reforms introduced by the Data (Use and Access) Act 2025 (DUAA). The two initiatives are linked: DUAA creates new consent exemptions, while the Consultation explores how certain low-risk advertising functions might operate under that framework. This includes when certain low-risk advertising functions could operate without prior consent, and where consent will continue to be required. The overall aim is to reduce the practical requirements on business without sacrificing the safeguarding of user privacy.

The background

Following DUAA receiving Royal Assent on 19 June 2025, the ICO issued updated draft guidance on the reforms implemented by the DUAA to the Privacy and Electronic Communications Regulation 2003 (PECR). Historically, PECR has been a key source of legislation on the placement of cookies and other storage and access technologies. The ICO is now exploring a transition to a risk-based approach in its enforcement of PECR in an effort to develop “new commercially viable advertising models that can support innovations to improve privacy and boost economic growth.”

This reflects the ICO’s concern that current consent-driven adtech models impose a heavy compliance burden on business and may not meaningfully improve user privacy or experience. The ICO questions whether the scale and granularity of processing that is needed to safeguard users in relation to behavioural advertising is restricting business growth unnecessarily, without contributing substantially to the safeguarding of users’ privacy or improving user experience.

The development

The ICO’s guidance provides notable updates on:

• the expanded scope of technologies captured by the DUAA
• the management of consent mechanisms in practice
• the application of PECR to online advertising
• the consequences of non-compliance following the alignment of fines under PECR with the UK GDPR.

One key development is the inclusion of new exemptions to the existing rules that no information should be stored on the terminal equipment of a user unless: (i) sufficient information has been provided to the user; and (ii) the user has provided consent. The new exemptions include those for statistical purposes, service appearance or functionality, and emergency assistance, among others.

In early 2026, the ICO intends to publish a further statement that identifies advertising activities that would be unlikely to trigger enforcement under PECR. The hope is that this list of whitelisted advertising activities will support the government to draft amendments to the PECR consent rules, allowing for new approaches to online advertising to scale up.

To that end, the ICO has called for industry views on:

• advertising purposes and capabilities
• the potential impact of the ICO’s proposed approach
• technical safeguards necessary to protect user privacy.

Why is this important?

The ICO’s updated draft guidance and consultation highlight the beginning of a significant shift in the regulation of cookies and storage technologies in the UK. While both remain subject to further review, organisations should begin considering their internal policies and practices in relation to cookies and online advertising for compliance with the new updated guidance.

Any practical tips?

Now’s a good time to revisit your cookie notices and consent mechanisms, to ensure that these meet the ICO’s updated guidance requirements. Consider also auditing your tracking and analytics technologies, to identify which ones fall within the expanded scope set out in the ICO’s updated guidance.

Autumn 2025