| Link(s): |
| Our advice to government on potential changes to online advertising rules | ICO Economic growth commitment update ICO report for DSIT |
Context
The ICO has provided a report and advice to the Department for Science, Innovation and Technology by writing to the Rt Hon Ian Murray MP, Minister for Digital Government and Data, and The Lord Livermore, Financial Secretary to the Treasury. The advice relates to the application of, and potential exclusions from, Regulation 6 of the Privacy in Electronic Communications Regulations (PECR). Regulation 6, alongside the UK GDPR, governsthe use of storage and access technologies such as cookies, scripts and tags for the purposes of online advertising.
Alongside the advice, the ICO is also sharing findings from its public call for views, results from its citizen juries and a cost‑benefit analysis assessing the impacts of the proposed approach outlined in the advice to government.
Key points to note
- The blog which introduces the report sets out the importance of online advertising as a key component of the UK’s digital economy.
- With a clear ‘growth’ agenda driving this work and output, the ICO carried out a review to understand where the Regulation 6 consent (or ‘cookie consent’) requirements in PECR are preventing the development and adoption of more privacy-preserving forms of online advertising.
- Within the current framework, most commercially viable online advertising requires consent whenever information is stored on, or accessed from, a user’s device, even where the risks to people’s privacy are relatively low.
- To address this challenge, the ICO analysed a range of online advertising activities and considered which ones pose a lower risk to people’s privacy and could therefore be delivered without Regulation 6 consent.
- The work shows how Regulation 6 could be amended to allow certain low risk forms of online advertising to operate without consent, while continuing to require consent for advertising that involves intrusive tracking and profiling people over time and across services.
- Privacy risks are lower where advertising is based on the context of the content being viewed, rather than information about a person’s past online activity. The ICO’s user research indicates that this approach is closely aligned with people’s expectations and could provide a viable alternative to behavioural advertising for online services whose users don’t consent to more intrusive tracking.
- It is important to remember that nothing has changed at this stage. The existing PECR rules still apply, and organisations must continue to comply with them.
- The ICO’s guidance on the use of storage and access technologies provides further clarity on the current legislative framework and our expectations for compliance.