Following a meeting between members of IAB UK (representing the UK digital advertising industry), the Association of Online Publishers (AOP) (representing the UK online publishing industry) and the Information Commissioner’s Office (“ICO”), the ICO has sent a letter to the IAB and AOP addressing queries around compliance with data protection law in relation to the use of cookies in different advertising models.

The letter explains that contextual advertising models – in which personal information is not used to determine the ad that is served to an individual – remain the easiest way to achieve compliance with data protection law. Personal information may nonetheless be processed to support related functions such as ad measurement and fraud detection. However, as the law currently stands, and as reflected in the ICO’s current guidance on cookies, consent is required when using cookies and similar technologies for such purposes. The ICO recognises that such processing is typically less intrusive than that associated with serving personalised ads and the ICO notes the organisations’ discussions with government regarding the potential for such processing to be exempted from requirements for consent in the Privacy and Electronic Communications Regulations 2003 via the Data Protection and Digital Information Bill (currently making its way through the legislative process as previously reported by Wiggin). The ICO states that, after the Bill receives Royal Assent, it will publish updated guidance for consultation in relation to the use of cookies and similar technologies, and expects to be able to provide more detailed guidance regarding the interplay between consent for targeted advertising and functionality that can be considered “intrinsically linked” on a technical level to that purpose.

The ICO expects all websites using cookies or similar technologies to serve personalised ads – which involves processing personal information to determine the ad that is served to an individual – to give people a fair choice over whether they consent to the use of such technologies. The easiest way to do so is to ensure that users can reject non-essential advertising cookies as easily as they can accept them. In respect of the industry’s interest in using “consent or pay” (i.e. ad-funded) models, the ICO invites the industry to respond to its call for views on “consent or pay” models launched on 6 March 2024.

Finally, as to determining the duration of cookie consents, the ICO refers the industry to its existing cookie guidance and states that it will consider if any changes to the guidance are needed in this area during the upcoming review.

For more information, click here.