Key themes

ICO response

We have added a new example to the guidance to illustrate how regulation 6 applies to the use of tracking pixels in an affiliate marketing context. This example shows how information stored on a user’s device is later accessed when a tracking pixel fires on an order confirmation page and how this engages regulation 6. 

Remember the list of storage and access technologies in the guidance is not exhaustive and the examples we provide for each technology are illustrative. They are intended to support practical understanding, not to define every possible technology or use case that may fall within scope.

ICO response

We have added further detail to the guidance to explain why organisations must interpret the strictly necessary exception from the user’s perspective. The rules on storage and access technologies are designed to protect people’s private sphere, which includes their devices. The strictly necessary exception applies only when the use of these technologies is essential to deliver a service that the user has actively requested, so organisations must make this assessment from the user’s point of view. If the storage or access is not essential for the service the user requests, it cannot be considered strictly necessary.

This interpretation reflects the intent and wording of the legislation and aligns with previous guidance issued by the ICO and other data protection bodies, including the Article 29 Working Party’s Opinion 04/2012 on Cookie Consent Exemption. ¹ 

ICO response

We have added an example to the guidance that illustrates an activity likely to meet the strictly necessary exception in the context of cashback and reward services. The guidance explains that this exception applies only when the storage or access is essential to deliver the service the user has actively requested. 

Whether a cashback or rewards service can rely on the exception depends on how the service operates, including what storage and access technologies are set, by whom and in what circumstances, as well as the different ways users can engage with the other service.

The finalised guidance sets out the key factors that organisations should consider and includes the full example to support practical understanding. 

ICO response

The strictly necessary exception does not apply to online advertising. Using storage or access technologies for advertising is not essential to provide a service to the user because the service can operate without any advertising. Online advertising is therefore not necessary to deliver the service the user has requested.

Since early 2025, we have been reviewing where the current regulation 6 consent requirements may prevent the development of privacy-preserving advertising. As part of this work, we are exploring whether certain low-risk online advertising activities could, in future, be delivered without consent under PECR. This work aims to support growth in the advertising sector and encourage innovation in new privacy-friendly advertising products and services, while protecting people’s rights and freedoms.

We are clear that some forms of online advertising will always require consent, particularly where they involve extensive profiling based on individuals’ online activity, habits or behaviour across different services and devices.

We will share our evidence base with government in late spring 2026, as it considers whether to use its new regulation 6A power to introduce any additional exceptions to the consent requirements. ² 

ICO response

We have added an example to the guidance to clarify how an organisation can rely on a lawful basis other than consent for subsequent processing of personal data when it relies on an exception under regulation 6 for its use of storage or access technologies.  

In the example, an emergency service organisation relies on the emergency assistance exception to store and access information after receiving a communication indicating that a user needs urgent help. As it then processes location data, which is personal data, to determine the user’s location, it must identify an appropriate lawful basis under the UK GDPR. Given the circumstances, the organisation relies on the vital interests lawful basis.

ICO response

We have provided further rationale in the guidance for this good practice recommendation. We suggest six months as a reasonable and proportionate interval for requesting consent again, particularly where a user has previously declined consent. This strikes an appropriate balance between avoiding repeated consent requests and ensuring user choices remain up-to-date. 

In developing this recommendation, we also considered approaches in other jurisdictions with similar laws, including in several EU Member States, where regulators advise a six-month period for similar reasons. ³ In addition, the European Commission’s Digital Omnibus proposal would incorporate this six-month interval into EU law. ⁴ 

Organisations can still seek fresh consent more frequently where appropriate or required. For example, organisations must seek fresh consent if their purposes or activities change from those originally presented to the user.  

ICO response

We have retained the expectation that organisations must interpret withdrawal of consent as a request for erasure. This means that organisations must delete any personal information collected under that consent. Continuing to process personal data obtained under that consent or retaining it for other purposes after someone withdraws consent, undermines the user’s choice. Our existing ‘Right to erasure’ guidance sets out in more detail how organisations should meet this requirement.

ICO response

Our position remains unchanged. Organisations must not rely solely on browser settings or third-party control mechanisms to indicate consent.

ICO response

We have added a short explanatory section to make clear that the illustrations show examples of both good and bad practice practice. We also labelled them more clearly to aid understanding. 

ICO response

We are reviewing our approach to PECR enforcement because of the DUAA changes to our powers. We will update this section of the guidance once that review is complete.

ICO response

Where organisations aggregate these metrics and use them solely to improve a service or understand website interaction patterns, the statistical purposes exception may apply. However, if organisations use this data to analyse or measure a user’s activity, they must obtain the user’s consent.

Behavioural and engagement metrics can involve the collection of individual-level information that may constitute personal data, such as information about a specific visitor. In these cases, organisations must also comply with the UK GDPR.

To rely on the statistical purposes exception, organisations must ensure that the data is aggregated and that any personal data is not retained for longer than necessary to complete the aggregation process.

We did not expand the list of examples to include technologies such as eye-tracking because these tools may capture information about identifiable users and therefore fall outside the scope of the exception. However, we have added bounce rates to the exceptions table, as this metric can fall within the exception when it is aggregated and used solely to understand overall service interaction patterns.

ICO response

We believe the guidance already reflects the types of activities that are likely to fall within the appearance exception. The examples illustrate situations where a service adjusts its presentation or functionality in line with a user’s expressed preferences. We considered the additional examples suggested by respondents but did not expand the list further, as the exception is purpose-specific rather than technology-specific and the existing examples provide sufficient clarity on when the exception is likely to apply.

ICO response

We have added a new section to the guidance to clarify how regulation 6 applies when a storage or access technology is used for more than one purpose. The guidance explains that the exceptions are purpose-specific and that organisations must assess each purpose individually. 

Where all purposes fall within the scope of the same exception, organisations do not need consent. However, the statistical purposes and appearance exceptions only apply when the storage or access is carried out for the sole purpose of that activity, so organisations cannot combine them with any non-exempt purposes.

If any purpose does not meet an exception, organisations must obtain consent for the use of that technology. They must also give users granular controls over non‑exempt purposes and ensure their consent mechanism works effectively in practice.

The guidance also explains that, although organisations may prefer to use one technology for multiple purposes, it may be more practical to use separate technologies to meet their PECR obligations.

ICO response

We have added a new section to the guidance to clarify what a simple means of objecting looks like in practice. The guidance explains that organisations may offer this functionality through their existing consent mechanism and we also illustrate this approach in the ‘Our expectations for consent mechanisms’ section of the guidance.  

ICO response

We have added a new example to the guidance to illustrate how the emergency assistance exception may apply in practice. The example describes a smart watch with fall‑detection or pulse‑detection functionality that automatically contacts the emergency services when the user has enabled the feature and does not cancel the alert.