The Information Commissioner’s Office (ICO) is calling for views on a new enforcement approach that could unlock privacy-preserving alternatives to the dominant adtech business model.

The proposal – set out in a call for views on how the ICO applies regulation 6 of the Privacy and Electronic Communications Regulations (PECR) – aim to support innovation by enabling new advertising models that respect user privacy while maintaining revenue streams.

Regulation 6 revolves around the processing involved in storing or accessing stored information in user devices as it applies to GDPR.

The ICO is exploring how publishers could deliver privacy-preserving advertising to users who have not given consent, where the risks are demonstratably low.

“Currently, publishers deploying online advertising technologies must secure people’s consent. This is because online advertising involves storage of, or access to, information on people’s devices. Storage and access technologies for online advertising purposes do not meet any of the exceptions to regulation 6 requirements,” the ICO said.

“We are exploring whether a risk-based approach to enforcing PECR could allow publishers to deliver online advertising to users who have not granted consent, where there is a low risk to their privacy.”

The regulator will continue to enforce consent requirements for the collection of personal information for targeted advertising during this exploration.

“Online advertising doesn’t have to come at the expense of privacy. We want to see industry develop new models that put users in control while supporting publishers and platforms to thrive,” Stephen Almond, director of regulator risk at the ICO said.

“Our role isn’t to dictate how that’s done – it’s to remove unnecessary regulatory barriers and open the door to responsible innovation.”

The ICO has also launched an updated consultation on its Storage and Access Technologies (SATs) guidance, revised to reflect changes introduced by the new Data (Use and Access) Act 2025. The Act permits consent-free use of cookies for certain low-risk functions, such as statistical analysis and website improvement.

Recommended reading

• New ICO Guidelines Push for More Privacy in Smart Tech
• ICO Apologises Over Data Protection Response Times
• ICO Publishes New AI and Biometric Tech Strategy

The regulator believes that there may be commercially viable ways to deliver online advertising that do not require the intensive processing often undertaken with behavioural advertising.

“A new approach to regulation can create opportunities to unlock business growth through innovation, while safeguarding people’s privacy and improving user experience,” the regulator contends.

“Provided users have a clear understanding that services appearing to be ‘free’ are funded by advertising, they may accept some storage and access of information for functions to deliver that advertising. However, they may not accept the scale and granularity of processing often currently undertaken when they grant consent,” the ICO says.

The ICO is also commissioning further user research to better understand public attitudes to online tracking and consent, ensuring its regulatory approach is aligned with real-world expectations.

The call for views on the ICO’s enforcement approach closes on Friday 29 August, while the SATs guidance consultation closes on Friday 26 September. Responses will inform the ICO’s final guidance and a formal statement on its updated enforcement approach, due in early 2026.