New ICO storage and access technologies (aka cookies) guidance published 28 April 2026
This guidance has been very much needed for years as the old guidance required significant updating to reflect current technology, internet use and on-line advertising practices. It’s taken so long to finalise there ended up being two consultations, as the original guidance consulted upon then required updating to reflect the DUAA changes.
A couple of key things to highlight as there is often confusion:
1. This guidance primarily relates to PECR / the Privacy and Electronic Communications Regulations (PECR).
2. Rules relating to cookies are in PECR not the UK GDPR but to the extent personal data is involved the UK GDPR applies too.
3. Cookies has always been an umbrella term used for what the ICO now calls ‘storage and access technologies’. The reason for the change is that there is so much more technology in use now and covered by PECR than cookies e.g tracking pixels, scripts and tags, device fingerprinting and link decoration and navigational tracking.
4. There is still, in my experience, a fairly common misunderstanding that the PECR rules only apply to cookies which isn’t correct. This misunderstanding is risky as it means, for example, that if a business is told by their web developer or an online partner that no cookies are used PECR is often disregarded which isn’t correct.
At the same time as publishing this guidance, the ICO published its online tracking strategy update. This strategy was originally published in early 2025 and set out ICO plans “to give people meaningful choice and control over how they are tracked online, and provide businesses with certainty to innovate responsibly” following which the ICO says it has been working on various projects to promote compliance with the law to ensure a fairer online tracking ecosystem.
The government have said they may make changes to the regulation 6 PECR requirements for online advertising purposes in the future but for now the existing law and guidance continues to apply and all online advertising purposes still require consent.
Guidance
_________________________________________________________________________________________
Disclaimer
This information is intended for general informational purposes only and does not constitute legal advice. We recommend seeking professional advice before taking any action on the information provided. If you would like to discuss your specific circumstances, please feel free to contact us on 0800 2800 421.
