Privacy & Cybersecurity Law Blog

On May 18, 2026, the UK Information Commissioner’s Office (“ICO”) announced that it had provided advice to the UK government on possible changes to Regulation 6 of the Privacy and Electronic Communications Regulations (“PECR”) in relation to online advertising. The advice follows an ICO review of whether PECR’s current consent requirement is hindering the development of more privacy-preserving advertising models.

The ICO said the existing framework often requires consent whenever information is stored on, or accessed from, a user’s device for advertising purposes, even where the privacy risk may be relatively limited. In its view, this current “one size fits all” approach may be reducing incentives to invest in lower-risk alternatives to behavioral advertising.

The ICO’s advice suggests that Regulation 6 could be revised to distinguish between lower-risk advertising practices and more intrusive forms of tracking. On that basis, some advertising activity may be capable of being carried out without consent, while consent would remain necessary for models that depend on tracking and profiling individuals over time and across different services. The ICO also takes the view that context-based advertising, which relies on the content a user is viewing rather than their previous online behavior, is less privacy-invasive and better reflects what users are likely to expect.

If the UK government decides to amend Regulation 6, the ICO’s preferred approach would introduce a “first-party framework” under which the publisher or online service directly engaged with the user could rely on a limited exception for certain purposes. These purposes could include ad delivery, targeting, measurement and billing, attribution, frequency capping, brand safety, and ad fraud prevention and detection. The ICO said any such approach should include safeguards, including limits on third-party data sharing and the use of privacy-enhancing technologies.

The ICO emphasized that no legal change has yet been made and that the current PECR rules remain in force. Organizations must therefore continue to comply with the existing consent requirements unless and until the law is amended.

Read the press release here. Read the ICO report here.