Cybersecurity Policy Report, U.K. Privacy Office Publishes Updated Guidance on Tracking Technologies, (Apr 30, 2026)
By Tony Foley
The United Kingdom’s Information Commissioner’s Office (ICO) has published final guidance on how the Privacy and Electronic Communications Regulations (PECR) and the U.K.’s General Data Protection Regulation (GDPR) apply to cookies, tracking pixels, device fingerprinting, and other storage and access technologies (SATs).
In a news release yesterday, the ICO said the final version of the guidance incorporated updates following two public consultations, as well as changes introduced in the recently enacted Data (Use and Access) Act (DUAA). It includes new examples and points of clarification designed to assist organizations in complying with PECR and the U.K.’s GDPR, although ICO added that the changes did not reflect its ongoing work in reviewing PECR regulations for online advertising purposes, which will be completed in the coming weeks.
"Online service providers want regulatory certainty so that they can innovate responsibly. They want clear, practical guidance they can rely on,” said William Malcom, the ICO’s executive director–regulatory risk and innovation. “That is exactly what we have delivered with the publication of the Storage and Access Technology guidance. We listened carefully to what industry told us during our consultations and addressed the questions we heard most frequently.
"We are also taking direct action to drive compliance,” Mr. Malcom added. “99% of the UK's top 1,000 websites now meet compliance standards for cookie banners owing to focused ICO work with industry. There is still more to do, and our work and interventions will continue to drive for a fairer, more transparent online tracking ecosystem that gives people meaningful control over how their data is used."
The updated guidance adds two new subchapters, one on the meaning of the term “simple means of objecting” to use of SATs and the other on the circumstances in which an organization can use the same SAT for multiple purposes. In general, the guidance outlines what SATs are, explains the rules under PECR and how they relate to the U.K. GDPR, guidance on complying with PECR, managing consent issues in practice, and specific issues related to the use of SATs in online advertising. The updated guidance also notes that changes to PECR enforcement activity have been implemented under the DUAA and that the ICO will update a section on available enforcement mechanisms once the new regime is in force.
Along with the update to the SAT guidance, the ICO said it had updated its online tracking strategy, which was originally published at the start of 2025, setting out the agency’s plans to give people meaningful choice and control over how they are tracked online. The ICO said it was working with industry and other stakeholders to support the development of commercially viable privacy-protecting advertising models to ensure that publishers gave people meaningful control over how they are tracked on websites.
Finally, the ICO highlighted its ongoing review of how publishers can employ “consent or pay” models in line with data protection principles, as well as its work to ensure that smart product manufacturers and developers take a data protection-by-design approach, including the pending publication of its finalized guidance and impact assessment on the use of consumer Internet of things (IoT) products and services.
News: InternationalLegislation DataPrivacy DataSecurity GDPR