Skip to main content
Hafan

Online tracking strategy update – April 2026

Contents

Latest updates - 29 April 2026

29 April 2026 - this update was published.

At the start of 2025, we published our online tracking strategy setting out our plans to give people meaningful choice and control over how they are tracked online, and provide businesses with certainty to innovate responsibly.

We have been working on a range of projects to promote compliance with the law to deliver a fairer online tracking ecosystem. This update reflects on how we are delivering on our strategy and key achievements.

Provide industry with clarity on the requirements of data protection law, leaving no excuse for non-compliance

Today we have published our finalised guidance and impact assessment on the use of storage and access technologies (SATs). This follows two consultations on draft updated guidance: the first was our significant update in December 2024 and the second was to reflect the changes DUAA made to the Privacy and Electronic Communications Regulations (PECR) in July 2025. We have also published our consultation summary report to share the feedback we received and how we have addressed it in the updated guidance.

Storage and access technologies, such as cookies, tracking pixels and scripts and device fingerprinting, are key mechanisms that help organisations track people online. Our guidance includes new examples and points of clarification to help organisations to comply with the law and ensure users have a meaningful choice over how their data is used.

The government may make changes to the regulation 6 PECR requirements for online advertising purposes in the future (see our work exploring privacy-preserving advertising below). In the meantime, the law and this guidance continue to apply and all online advertising purposes still require consent.

"Our organisation is also likely to benefit from an improved understanding of the relevant legislation, which will allow us to ensure our tools align with regulatory expectations and help customers make more informed configuration decisions."

- SATs consultation respondent.

We have also engaged with the online advertising industry to help shape future privacy-respecting initiatives. Our work with Meta in our Regulatory Sandbox, for example, explored how organisations could use privacy-enhancing technologies to measure the performance of online advertising with less risk to users. As a significant proportion of online tracking is undertaken to provide key metrics to advertisers, exploring and supporting privacy-enhancing approaches can improve user control over their data, reducing the risk of misuse.

Make it easier for publishers to adopt more privacy-friendly forms of online advertising 

We are working with industry and other stakeholders to support the development of commercially viable privacy-preserving advertising models that respect people’s rights. 

Last year, we opened a call for views on our review of regulation 6 PECR where the use of storage and access technologies for advertising may pose demonstrably low privacy risks. 

Next month, we will be publishing our advice to government on where PECR requirements to obtain consent for the use of storage and access technologies for online advertising purposes could be removed. We understand that the government is exploring whether to create an exception or exceptions for some online advertising purposes, using secondary regulation-making powers under regulation 6A of PECR. This work will help inform government policy–making.

We look forward to seeing whether this change can encourage innovation towards forms of ads that improve user choice and control. In the meantime, we will continue to regulate the law as it stands.   

Ensure publishers give people meaningful control over how they are tracked on websites

We committed to reviewing cookie banners on the top 1,000 websites in the UK. As we updated in December, our action has seen significant changes. It has lowered the prevalence of cookies being placed before a user has expressed their choice and has driven an increase of clear reject options on consent banners, making it easier for users to control how they are tracked.

As a result of this work, 992 (99%) of the top 1,000 websites met our compliance checks at the time of their most recent test.

In January 2026, we completed our engagement with the software companies who provide online businesses with cookie banners. This is typically the main way a user can control how they are tracked online. The design and implementation of these consent management platforms can make a crucial difference in how websites offer and act on privacy choices made by users.

We have driven improvements in the standard products offered to website owners by working directly with key cookie banner vendors responsible for the largest market shares across the UK's most popular websites. For example, OneTrust and Usercentrics have developed UK-specific templates aligned with our guidance. This is in addition to a range of other improvements made by these platforms and changes implemented by Sourcepoint and Inmobi to enhance their existing templates and guidance. This engagement has raised the bar across a significant portion of the market and made it easier for online businesses to offer fair, compliant choices to users.

Investigate compliance concerns in the wider adtech ecosystem

We recently concluded our investigations into several data management platforms – businesses that bring together data insights relating to a user's online activity.

We assessed key areas of concern, including: the validity of consent for the data processing carried out by these platforms and their lawful basis relied upon for processing.

After careful consideration and review of our concerns, we concluded that further action would not be appropriate after observing positive improvements from the platforms as compared to their historical processing practices. This was communicated to the platforms in January of this year.

Our work will not stop here. We will continue to monitor compliance and ensure that online businesses uphold their legal obligations to provide their users with fair and transparent choices.

Confirm how publishers can deploy 'consent or pay' models in line with data protection law, supporting their economic viability

In 2025, we published guidance providing industry with clarity about how data protection law applies to consent or pay models. This guidance set out a framework of four factors to assess whether a consent or pay model would be compliant with the law on a case-by-case basis. Our guidance has assisted organisations to make choices about the business model that works best for them, whilst ensuring their compliance.

Following the publication of this guidance, we have been monitoring the market adoption of consent or pay models and approaches to compliance. We will continue this monitoring and, where required, engage with industry participants to ensure users can freely give consent in these models.

Ensure that people have meaningful control over tracking for personalised advertising on apps and connected TVs

We are working to ensure that smart product manufacturers and developers take a data protection by design approach and seek consent if using storage and access technologies for online advertising purposes.  

We will soon be publishing our finalised guidance and impact assessment on the use of consumer Internet of Things (IoT) products and services. As the number of smart and connected devices continue to grow, this guidance will ensure that IoT developers and manufacturers give their users fair and transparent choices on how their data is used. 

From my perspective as an expert in IoT security and privacy, the document succeeds in translating legal obligations into practical requirements that reflect the realities of IoT ecosystems. It defines scope with precision, […] and clarifies accountability across the complex supply chains of device manufacturers, app developers, SDK providers, and cloud services.

– An academic specialising in IoT  

Previously, we committed to giving people meaningful control over tracking for personalised advertising on connected TVs. This year, we will engage with connected TV manufacturers to promote compliance with the law.

Support the public to take control of how they are tracked online

We have undertaken research to understand how our work can raise trust and confidence in the ways organisations use people's personal information for online tracking.

We ran two citizen jury research projects, one on user expectations for consumer IoT products and three juries exploring expectations around consent and online advertising.

We learned key insights, including how people find it hard to engage with privacy information and consent choices presented to them on their IoT products. We have taken their feedback into consideration when developing our finalised guidance on the use of consumer IoT products and services. The second citizen jury project has informed our views and advice to government on regulation 6 PECR requirements.

We have also commissioned primary research to provide insights into understanding views, behaviours and attitudes towards the control of personal information online. This research will feed into our impact review of our online tracking strategy. We expect to publish the findings of this review later this year, drawing together a comprehensive body of quantitative and qualitative evidence on the strategy's outputs, outcomes and overall impact.