The Information Commissioner’s Office (ICO) has published a Call for Views on its approach to regulating online advertising, asking whether there might be circumstances in which publishers could deliver online advertising to users who have not granted consent.

As the Call for Views explains, currently publishers which deploy online advertising technologies must secure people’s consent as storage and access technologies for online advertising purposes do not meet any of the exceptions to regulation 6 of the Privacy and Electronic Communications Regulations (PECR).

Whilst the ICO recognises that requiring consent is appropriate where online advertising involves extensive profiling of people across different services and devices (and makes clear that it will continue to enforce consent requirements for the collection of personal information for targeted advertising), it asks whether there are other situations where there is a sufficiently low risk to users’ privacy that requiring consent may be unnecessary.

A move to a ‘risk-based approach’ to enforcing the PECR, the ICO explains, could present opportunities as there are likely to be “commercially viable ways to deliver online advertising that don’t involve the scale and granularity of processing often undertaken with behavioural advertising”. The Call for Views invites submissions on what features would constitute the minimum requirements for such a commercially viable online advertising model, whilst still complying with data protection and privacy laws.

Looking ahead, the ICO intends to publish a statement early next year which will identify advertising activities that are unlikely to trigger enforcement action under the PECR. It is expected that this will allow new approaches to online advertising to develop whilst the Government works on planned secondary legislation to amend the PECR rules and create a new exception to the consent requirements for specific low-risk advertising purposes.

The Call for Views closes on 29 August 2025 and can be found here.

Updated Guidance on Storage and Access Technologies

Separately, the ICO has also launched a consultation on changes to its guidance on storage and access technologies in the light of the passage of the Data (Use and Access) Act 2025.  These include amendments to reflect changes to the PECR and a new chapter to explain the exceptions to the prohibition on storing or accessing information on people’s devices.

The consultation closes on 26 September 2025 and can be found here