Reflection: How our online tracking strategy is coming together to provide clarity to businesses and meaningful control for people

At the start of 2025, we committed to giving people more meaningful control over how they are tracked online – and providing businesses with the certainty to innovate responsibly. 

This update marks a major step in delivering that strategy. We’re consulting on updated guidance on storage and access technologies (SATs), reflecting changes introduced by the Data Use and Access Act 2025 (DUAA). At the same time, we’re launching a call for views on proposals to relax enforcement of consent requirements for privacy-preserving advertising – supporting organisations to move away from intrusive tracking models. 

These developments form part of a sequence of interventions designed to provide a coherent, end-to-end framework for online advertising: 

• In December 2024, we published draft guidance clarifying how data protection law applies to storage and access technologies like cookies and fingerprinting, with clear expectations around transparency, proportionality and user choice.
• In January 2025, we finalised our companion guidance on “consent or pay” tracking models, providing organisations with certainty on the steps they need to take to comply with data protection law.
• Today, we are consulting on revised guidance on storage and access technologies, incorporating DUAA changes – including exemptions for certain low-risk functions, such as statistical analysis and website improvement.
• In parallel, we’re seeking views on proposals to relax enforcement of consent requirements for critical advertising purposes – such as fraud prevention– providing economic incentives for organisations to move away from intrusive tracking.
• These views will inform potential secondary legislation under DUAA that could widen consent exemptions to cover privacy-preserving ads, subject to robust evidence and safeguards.
• Once that legislation is in place, we’ll issue a final update to our guidance on storage and access technologies – integrating it with our consent or pay position to deliver a single, clear regulatory framework. 

This phased approach allows us to offer clarity now while remaining responsive to legislative change. It also encourages investment in low-risk, privacy-enhancing models rather than reinforcing intrusive tracking practices. 

One thing isn’t changing: the need for organisations to secure freely given consent when deploying storage and access technologies for targeted advertising. As announced in January, we have reviewed the cookie banners of the top 1000 most popular websites in the UK and are taking enforcement action where they do not give people meaningful control. 

Our strategy is reshaping the foundations of online advertising – enabling more trustworthy, commercially viable models that respect people’s rights. A more privacy-friendly digital economy is within reach – and this is how we get there.