Data Protection Monitor
Global Privacy & Data Protection Intelligence

United Kingdom (UK) · Module Detail

United Kingdom: AdTech & Commercial Privacy

← Full United Kingdom overview Build report with United Kingdom Request deeper dive

#

Cookies and direct marketing are well evidenced; opt-out signal standards, clean rooms and cross-context advertising remain research gaps.

Primary frameworkPECR 2003 (as amended by DUAA 2025); UK GDPR Article 21
Supervisory authorityInformation Commissioner's Office (ICO)
Traffic-light rationale — AmberCookies and direct marketing are well evidenced; opt-out signal standards, clean rooms and cross-context advertising remain research gaps.

Sub-modules (6)

Category narrative206 words

PECR Reg. 6 requires prior UK GDPR-standard consent for non-essential cookies, pixels, SDKs, and browser fingerprinting unless an exemption applies. From 5 February 2026, DUAA 2025 s.112 and Schedule 12 (commenced by SI 2026/82) introduce four statutory exemptions to PECR Reg. 6(1) consent: (1) first-party statistical/analytics cookies used solely to collect aggregate information to improve the service or website; (2) appearance/preference cookies that adapt service functionality or display to user preferences; (3) security/fraud-prevention and software-update cookies; and (4) emergency geolocation, provided users receive clear information and a simple, free opt-out mechanism. Third-party cross-site advertising, real-time bidding (RTB), and behavioural profiling cookies remain outside the DUAA Schedule 12 exemptions and continue to require prior affirmative opt-in consent, with the ICO enforcing symmetrical 'Reject All' banner prominence and reviewing 'Consent or Pay' models against its 2025/2026 guidance. Under DUAA 2025 s.114 (in force 5 February 2026), charities may rely on the PECR Reg. 22(3A) non-commercial 'soft opt-in' to send electronic mail marketing to individuals who expressed support or interest in the charity's purposes and were given an opt-out at collection and in every message. Maximum PECR fines rose on 5 February 2026 from £500,000 to £17.5 million or 4% of global annual turnover (DUAA s.115 and Sch. 13).

Sources and claims (4)
  1. ConfirmedInformation Commissioner's Office — The Children's code requires that nudge techniques not be used to encourage children to provide unnecessary personal data or weaken/turn off their privacy settings.observed
  2. ProbableOffice of the Australian Information Commissioner — The ICO reviewed justifications for using legitimate interests as the lawful basis for real-time bidding (RTB) in adtech and found the justifications offered by organisations insufficient.observed
  3. ConfirmedInformation Commissioner's Office — The DUAA clarifies that direct marketing can be conducted on the basis of legitimate interests as a lawful basis under UK GDPR.observed
  4. ConfirmedInformation Commissioner's Office — Since 5 February 2026, charities may send electronic mail marketing (including texts and social media direct messages) furthering their charitable purposes to individuals who have expressed interest or offered support, without prior consent, under a new 'soft opt-in', subject to safeguards.observed