ICO consultation storage and access guidance: call for input to DMA response

The Information Commissioner's Office (ICO) is consulting on this draft updated guidance on storage and access technologies, previously known as the ‘detailed cookies guidance.

This updated guidance represents a significant revision of the detailed cookies guidance. It clarifies and references the broad range of storage and access technologies that are now commonly used alongside cookies, incorporating examples throughout.

To enhance regulatory clarity, the guidance has been rewritten using “must,” “should,” or “could” language, helping readers better understand compliance requirements. Additionally, it reflects recent case law and the ICO’s positions on key topics, including expectations for online advertising. To assist past readers in navigating these changes, the following sections outline the updates at the chapter level.

This guidance is designed for providers of online services, including web and app developers, who require a deeper understanding of how the Privacy and Electronic Communications Regulations (PECR) and, where relevant, data protection law apply to storage and access technologies. PECR covers a range of technologies, including but not limited to cookies, tracking pixels, link decoration and navigational tracking, local storage, device fingerprinting, and scripts and tags.

Additionally, the guidance addresses the UK GDPR where the use of these technologies involves processing personal data. However, it does not cover other areas of PECR outside of Regulation 6, except where they are relevant to storage and access technologies. It also does not address broader compliance obligations under the Data Protection Act (DPA) and UK GDPR when using these technologies, except where they intersect with PECR requirements.

Overall, the DMA believes the ICO guidance ought to provide more specific examples for users to reference and understand how the guidance applies. In particular, it is really important for the ICO to provide a more detailed and realistic view on tracking tech ‘in use’ today in the UK. Therefore, the DMA encourages members to share their working examples of, in particular, using tracking tech that reflect everyday commercial use by digital advertisers and brands.

With the complexity of personalised advertising, tracking, tech and solutions on offer these days; the practicalities how they all actually work; and what companies like Meta and digital advertisers are saying to brands; there is a distinct lack of clarity when it comes to the practical baking in of data protection.

The DMA will be submitting our response to the consultation. Let us know your views by March 1^st by writing to Michael.Sturrock@dma.org.uk, and we will incorporate them in our response.

You can respond directly to the ICO via this link.