ICO call for views on our approach to regulating online advertising
- Start date 7 July 2025
- Closing date 29 August 2025
- Type Stakeholder
- Status Open
We are reviewing our approach to enforcement of the Privacy and Electronic Communications Regulations (PECR) regulation 6 consent requirements. We see this as an opportunity for new commercially viable advertising models that can support innovations to improve consumer privacy and boost economic growth.
Currently, publishers deploying online advertising technologies must secure people’s consent. This is because online advertising involves storage of, or access to, information on people’s devices. Storage and access technologies for online advertising purposes do not meet any of the exceptions to regulation 6 requirements.
We are exploring whether a risk-based approach to enforcing PECR could allow publishers to deliver online advertising to users who have not granted consent, where there is a low risk to their privacy.
We are clear that there will remain circumstances where online advertising will always require consent. For example, because it involves extensive profiling of people based on their online activity, habits and behaviour, potentially across different services and devices.
Equally, this review doesn’t change our views 1 on the UK GDPR compliance requirements or current practices that could cause harm. We will continue to enforce consent requirements for collecting personal information for ad targeting and personalisation.
Read our online tracking strategy update for more information on how this work supports our vision to see a fair and consistent online ecosystem where people have meaningful control over how organisations use their information.
You can respond to this call for views using Citizen Space. Please share your thoughts with us before the consultation deadline of 29 August 2025.
New routes to deliver viable online advertising
We are exploring whether there are circumstances in which storage and access of information for certain advertising purposes can pose a low risk to user’s privacy.
In our view, there are likely to be commercially viable ways to deliver online advertising that don’t involve the scale and granularity of processing often undertaken with behavioural advertising. A new approach to regulation can create opportunities to unlock business growth through innovation, while safeguarding people’s privacy and improving user experience.
Provided users have a clear understanding that services appearing to be ‘free’ are funded by advertising, they may accept some storage and access of information for functions to deliver that advertising. However, they may not accept the scale and granularity of processing often currently undertaken when they grant consent.
Regulatory approach
In early 2026, we will publish a statement identifying advertising activities that are unlikely to trigger enforcement action under PECR. We will consider safeguards we would expect to reduce risks to users.
This will enable new approaches to online advertising to scale up. It will support the government in developing planned secondary legislation to amend the PECR rules and create a new exception to the PECR consent requirements for specific low-risk advertising purposes.
Capabilities for viable online advertising
Our approach intends to enable commercially viable ways to deliver online advertising. These need to be in line with data protection and privacy principles, and be ways that people would find acceptable without their prior consent.
We will frame our statement around the following categories of online advertising capabilities:
- ad delivery and billing;
- ad fraud prevention and detection;
- brand safety, brand suitability and brand compliance;
- frequency capping;
- measurement and attribution; and
- targeting (ie how an advert is targeted towards a user or group of users).
We are seeking views on our approach, as well as specific considerations under each of these categories. It is not our role as regulator to direct the industry towards any one solution or provider, but we can offer new routes to innovative approaches.
Alongside the call for views, we’ll be running an in-person technical workshop with participants from across the online advertising industry. We’ll also be holding meetings with trade associations and other representatives from across the sector.
We have commissioned user research to understand people’s expectations on online advertising and consent, and will publish our findings in due course.
Call for views
Your responses will help us to develop our views.
The survey is split into four sections:
- Section 1: Advertising purposes and capabilities
- Section 2: Impacts of our approach
- Section 3: Technical safeguards
- Section 4: About you and your organisation
This call for views will remain open until 29 August 2025. We may not consider responses we receive after the deadline.
Privacy Statement
For this consultation, depending on your preference, we may publish in full the responses received from organisations or a summary of the responses. If we do publish any responses, we will remove email addresses and telephone numbers from these responses. Please do not to share any information in your response which you would not be happy for us to make publicly available.
Should we receive an FOI request for your response we will always seek to consult with you for your views on the disclosure of this information before any decision is made. For more information about what we do with personal data please see our privacy notice, and the section on responding to our consultations and surveys.
Please note that we are using the platform Citizen Space to gather this information on our behalf. Citizen Space is provided by a UK supplier, Delib. You can read Delib's privacy policy here.
1 See the ICO’s 2021 opinion on data protection and privacy expectations for online advertising proposals (PDF)