---
title: "United Kingdom — AdTech & Commercial Privacy | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/united-kingdom/adtech-and-commercial-privacy/
source_html: /jurisdictions/united-kingdom/adtech-and-commercial-privacy/index.html
description: "United Kingdom — AdTech & Commercial Privacy (Amber, 6 sub-modules, 4 claims): Cookies and direct marketing are well evidenced; opt-out signal standards, clean rooms and cross-context advertising remain research gaps."
generated_at: 2026-10-25T04:46:50Z
content_sha256: daab6566a130436e295ed0fd0b37e85ca57ea6d7abee091c0103b7d47b1dee09
generator: "fe-fleet/md-twin@1.0"
---
# United Kingdom — AdTech & Commercial Privacy | Data Protection Monitor

### D7AdTech & Commercial Privacy6 sub-modules4 claimsAmber▾#

Cookies and direct marketing are well evidenced; opt-out signal standards, clean rooms and cross-context advertising remain research gaps.

Primary framework PECR 2003 (as amended by DUAA 2025); UK GDPR Article 21

Supervisory authority [Information Commissioner's Office (ICO)](https://ico.org.uk/)

Traffic-light rationale — Amber Cookies and direct marketing are well evidenced; opt-out signal standards, clean rooms and cross-context advertising remain research gaps.

#### Sub-modules (6)

Category narrative 206 words

PECR Reg. 6 requires prior UK GDPR-standard consent for non-essential cookies, pixels, SDKs, and browser fingerprinting unless an exemption applies. From 5 February 2026, DUAA 2025 s.112 and Schedule 12 (commenced by SI 2026/82) introduce four statutory exemptions to PECR Reg. 6(1) consent: (1) first-party statistical/analytics cookies used solely to collect aggregate information to improve the service or website; (2) appearance/preference cookies that adapt service functionality or display to user preferences; (3) security/fraud-prevention and software-update cookies; and (4) emergency geolocation, provided users receive clear information and a simple, free opt-out mechanism. Third-party cross-site advertising, real-time bidding (RTB), and behavioural profiling cookies remain outside the DUAA Schedule 12 exemptions and continue to require prior affirmative opt-in consent, with the ICO enforcing symmetrical 'Reject All' banner prominence and reviewing 'Consent or Pay' models against its 2025/2026 guidance. Under DUAA 2025 s.114 (in force 5 February 2026), charities may rely on the PECR Reg. 22(3A) non-commercial 'soft opt-in' to send electronic mail marketing to individuals who expressed support or interest in the charity's purposes and were given an opt-out at collection and in every message. Maximum PECR fines rose on 5 February 2026 from £500,000 to £17.5 million or 4% of global annual turnover (DUAA s.115 and Sch. 13).

Evidence 4

Sources and claims (4)
- Confirmed[Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services/) — The Children's code requires that nudge techniques not be used to encourage children to provide unnecessary personal data or weaken/turn off their privacy settings.observed 2026-07-28
- Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/__data/assets/pdf_file/0014/2903/oaic-research-international-regulation-of-digital-platforms-final-paper-publish2.pdf) — The ICO reviewed justifications for using legitimate interests as the lawful basis for real-time bidding (RTB) in adtech and found the justifications offered by organisations insufficient.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/) — The DUAA clarifies that direct marketing can be conducted on the basis of legitimate interests as a lawful basis under UK GDPR.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/04/charities-given-new-flexibility-to-contact-supporters-under-data-law-change/) — Since 5 February 2026, charities may send electronic mail marketing (including texts and social media direct messages) furthering their charitable purposes to individuals who have expressed interest or offered support, without prior consent, under a new 'soft opt-in', subject to safeguards.observed 2026-07-28