The ICO's consultation on regulating online advertising - Which? response

Executive Summary

Which? welcomes this opportunity to respond to the ICO’s proposal to introduce a risk-based approach to enforcing PECR, allowing publishers to deliver online advertising to users who have not granted consent where there is a low risk to their privacy.

In our response, we argue for:

Better and more effective enforcement of PECR:

• We want people to have a better experience of online tracking technologies.  Our research shows that consumer acceptability of data collection is also dependent on the collection process - and so informed consent should recognise the process used to collect data for targeted advertising, and not just whether the advertising is targeted.
• We want to see more effective enforcement, not less enforcement.  One of the stated aims of the ICO’s Online Tracking Strategy 2025 is that 'organisations are not disadvantaged by following the rules and improving their approach to online tracking to ensure it is compliant.'  We believe that the best way for the ICO to ensure fairness for organisations is to enforce more effectively and more consistently - not to enforce less.
• We want clarity on the scope and criteria of proposed 'low risk' uses of unconsented data. The ICO proposals do not have a clear statement of what is 'low risk' or how the criteria would be determined.
• We want the ICO’s process around possible changes to PECR enforcement to be transparent, inclusive and consultative. We strongly urge that the ICO’s planned statement for early 2026 should be published as a draft, and that the ICO consults on any changes it might make to the secondary legislation. We also strongly urge the ICO to publish in full the findings of the user research it has commissioned as soon as it is available, and at the latest by the time of the proposed statement.

Better and more effective safeguarding and empowering of people:

• We believe the ICO’s proposals don’t do enough to safeguard or empower people.  One of the two strategic objectives of the ICO’s Online Tracking Strategy 2025 is 'safeguarding and empowering people'.  We are concerned that the ICO’s proposals include no measures for empowering people, and may instead reduce existing safeguards. 
• We want people’s agency over their privacy to be upheld, not weakened.  The ICO’s Online Tracking Strategy 2025 identifies four areas where people are not being given the control they are entitled to under data protection law: deceptive or absent choice; uninformed choice; undermined choice; irrevocable choice. These are not addressed in the ICO’s proposals.  We are concerned that introducing a category of 'low risk' unconsented data use will further erode the extent to which people feel informed about their data rights or able to exercise them.
• We believe the ICO’s characterization of vulnerable positions is inadequate.  A person does not have a fixed or static relationship to vulnerability; and online tracking of a person might subsequently become data about someone in a vulnerable position.
• We believe the ICO’s approach towards privacy harm is inadequate. The ICO’s proposals don’t make it clear how people can ensure that they are not tracked online, whether or not they are in a vulnerable position.  We are also concerned that in a regime where unconsented online tracking is normalised unless there is risk of discrimination, people who proactively reject online tracking might be inferred to be in a vulnerable position, and so might experience discrimination anyway.