Cybersecurity Policy Report, U.K. Privacy Agency Advises Government on Online Ad Rule Changes, (May 18, 2026)
By Tony Foley
Citing changes currently under consideration by the government of the United Kingdom to online advertising requirements in the Privacy and Electronic Communications Regulation 2003 (PECR), the U.K. Information Commissioner’s Office (ICO) has published a report providing advice to the government after its review of PECR consent requirements.
In a blog post last week announcing the release of the advice document, ICO acknowledged the importance of the role of online advertising in U.K. digital economy but also emphasized that the PECR and U.K. General Data Protection Regulation (UK GDPR) play an important role in safeguarding individuals’ rights when using online services. Specifically, ICO reviewed the operation of PECR regulation 6, which covers the use of storage and access technologies such as cookies, scripts, and tags to determine whether it was preventing more privacy-friendly developments in online ad models. The review included an assessment on where the “one-size-fits-all” approach under regulation 6 for managing a spectrum of privacy risks could be holding back innovation.
The report considers a range of approaches that could support opportunities for innovation and economic growth while safeguarding people’s rights and freedoms, identifying the purposes that may not need consent, and the storage and access necessary for such purposes. ICO said in the report that if its preferred approach was ultimately enacted into law, it would allow certain low-risk forms of advertising to operate without consent under regulation 6, provided certain appropriate safeguards were maintained. For targeted ads, ICO’s approach would permit the following information to be stored and accessed from a user’s device:
High-level device and platform information;
Geolocation to the city or region level;
Temporal information (date and time); and
Contextual information including the content a user is viewing, mapped to a broad taxonomy.
The report also outlined the agency’s consideration of an alternative approach that would permit more data sharing with third parties under the UK GDPR’s legitimate interests basis, which it ultimately rejected because ICO felt that it was incompatible with data protection law. In addition, with respect to behavioral ads, ICO said the storage and access of such information and subsequent processing should continue to require consent under regulation 6 because the nature, scope, context, and purposes of this processing and the risks it poses to people’s rights and freedoms mean that consent is the only appropriate way to carry it out lawfully and fairly.
“Our preferred approach, if it became law, wouldn’t revolutionise the online advertising ecosystem,” the ICO said. “However, it could provide a way for service providers to deliver online advertising to users who do not consent to behavioural advertising.”
News: InternationalLegislation DataPrivacy GDPR