ICO advises PECR Reg 6 change to promote privacy-preserving online advertising

The Information Commissioner's Office has provided formal advice to the UK government on potential amendments to Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations) concerning online advertising. The recommendations follow a review by the regulator into whether existing consent rules are hindering the development of more privacy-preserving advertising models.

In its comprehensive report, the ICO outlines that the current framework uses a uniform approach that requires user consent whenever device information is stored or accessed for advertising, even when individual privacy risks are minimal. The ICO suggests this approach reduces commercial incentives to invest in lower-risk alternatives to traditional behavioural advertising.

The ICO's advice proposes revising Regulation 6 to differentiate between lower-risk advertising methods and intrusive tracking. Under this model, certain low-risk activities could proceed without explicit consent, while consent would be required for models that track and profile individuals across multiple services over time. The ICO highlights contextual advertising as a less intrusive option, which serves ads based on the content being viewed at the time the ads are served rather than tracking past online viewing behaviour.

The report recommends adopting a first-party framework. This structure would grant a limited exception to publishers and online services directly engaged with users for specific functions, such as ad delivery, targeting, performance measurement, billing, attribution, frequency capping, brand safety, and fraud prevention. The framework would also require strict safeguards, including restrictions on sharing data with third parties and the mandatory deployment of privacy-enhancing technologies. 

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.