Introduction

1. Introduction

1.1. Context

In December 2024, we launched a consultation on our draft storage and access technologies guidance. We received 40 responses. We paused our analysis of the consultation feedback because we anticipated passage of the Data (Use and Access) Act (DUAA) in June 2025.

After DUAA passed, we developed a new chapter addressing the additional exceptions to regulation 6 of the Privacy and Electronic Communications Regulations (PECR). We launched a second consultation on this new chapter in July 2025 and received 30 responses. 

This summary sets out the key themes from both consultations and explains how the feedback has informed the final guidance. 

We thank everyone who took the time to comment and share their views.

1.2. Overview of responses

We received a total of 70 responses across both consultations. The first consultation, which we launched in December 2024, generated 40 responses – 36 from organisations and four from individuals or academics. Of these 40 responses, 23 came through Smart Survey, our former consultation platform, and 17 arrived by email.

The second consultation, which focused on the new DUAA chapter and launched in July 2025, generated 30 responses – 27 from organisations and three from individuals or academics. Of these, 18 were submitted through Citizen Space, our new consultation platform, and 12 were sent by email.

We excluded six survey responses from the analysis (five from Smart Survey and one from Citizen Space) because they did not provide substantive answers to the consultation questions. Email responses did not follow the survey formats, so we have excluded them from the quantitative tables. However, we reviewed the qualitative insights they provided and addressed those points in our analysis where appropriate. 

Our Smart Survey included several questions designed to assess respondents’ understanding of, and agreement with, the updated guidance. One question asked whether the revised guidance clarified expectations for organisations’ use of storage and access technologies (see Table 1 below). Over half of respondents agreed that the updated guidance clarified expectations, with 52% (12 responses) agreeing and 4% (one response) strongly agreeing.

Table 1: Responses to the question: “How far do you agree that our guidance added clarity on our expectations for using storage and access technologies, compared to the previous ‘detailed cookies guidance’?”

Source: ICO Smart Survey consultation, 23 responses

Another question asked whether the guidance clarified the PECR rules for the use of these technologies. Again, more than half of respondents agreed, with 52% (12 responses) agreeing and 13% (three responses) strongly agreeing (see Table 2 below).

Table 2: Responses to the question: “How far do you agree that our guidance provides clarity on the PECR rules for storage and access technologies?”

Source: ICO Smart Survey consultation, 23 responses

While these results are encouraging, some respondents expressed disagreement or uncertainty in both areas. This feedback highlighted the need for further refinement to ensure the guidance is clear. We have addressed these points in the final version.

The remainder of this summary sets out the main points and recommendations from both consultations. We outline our response to the key themes and explain how we have taken these views into account in the final storage and access technologies guidance.