On 29 April, the UK’s Information Commissioner’s Office (ICO) published its long-awaited final guidance on “Storage and Access Technologies” (SATs), the catch-all for cookies, tracking pixels, device fingerprinting, and the rest of the web’s tracking stack.
Updated after two rounds of consultation, the guidance also incorporates changes introduced by the UK’s Data (Use and Access) Act 2025 (DUAA). The ICO also used the moment to revamp its Online Tracking Strategy.For most organisations operating in the UK digital advertising ecosystem, the guidance doesn’t rewrite the rulebook, but it does sharpen several points:
- Consent still rules for advertising. The ICO has restated firmly that online advertising cannot lean on the “strictly necessary” exception. Consent is required, full stop.
- “Strictly necessary” is user-centric. Whether something qualifies must be assessed from the user’s perspective, not the publisher’s bottom line. If it’s not essential to what the user asked for, calling it “necessary” doesn’t make it so.
- Multi-purpose technologies need a granular approach. If an SAT serves more than one purpose, each purpose gets judged on its own. If any one purpose doesn’t meet an exception (even the new DUAA exemptions for analytics or fraud prevention), you’re back to consent, with granular user controls to match.
- High-stakes enforcement. With the DUAA now in force, PECR breaches carry the same heavy financial penalties as the UK GDPR—up to £17.5 million or 4% of global annual turnover.
- Consent refresh and withdrawal have defined expectations. Six months is the benchmark for refreshing consent, and if someone withdraws it, you should treat that like a request to erase their data.
- Exceptions to PECR don’t eliminate UK GDPR obligations. Even where consent isn’t needed under PECR, organisations must still identify a valid lawful basis under GDPR for any subsequent processing of personal data. An exemption in one regime isn’t especially useful elsewhere.
Where Things Get Interesting
What stands out most is what’s still unfinished. The ICO says it has already shared advice with the UK government on potential further PECR exemptions, focused on lower-risk, privacy-preserving uses like measurement and fraud prevention. It plans to publish that advice next month, ahead of a formal consultation with the Department for Science, Innovation and Technology (DSIT).
This week’s guidance sets the baseline. The real decisions come next—when the ICO weighs in on exemptions and the industry’s push for a more permissive regime. Publishers and adtech businesses should pay close attention when that drops.
The ICO’s update on data management platform investigations is also worth flagging. It has wrapped several probes and seems broadly satisfied with the improvements—suggesting the sector is, for now, on the right track rather than in line for fresh enforcement. That said, it isn’t looking away. The same goes for consent-or-pay models: the ICO is watching, not stepping in (yet).
Zooming out, the ICO is treating a 99% cookie banner compliance rate as proof its engagement-first approach is working. With PECR reform coming and the DUAA already reshaping enforcement, the next twelve months will decide whether the UK actually does something different or just ends up back where it started. That’s the difference between a more workable regime for adtech and more of the same.
So, What Now?
The UK’s approach stands out right now: nimbler than the EU, more structured than the US, and trying to pull off something both privacy-conscious and growth-friendly. For UK-focused businesses, the task is immediate and operational: review your SAT purposes, audit your consent mechanisms, and watch for the further PECR exemptions advice next month. For those operating internationally, the bigger challenge is navigating a world where the rules are multiplying faster than they’re harmonising.
