The UK Information Commissioner’s Office has launched two consultations as part of the transition to the Data User and Access Act framework. These consultations will be of particular interest to organisations operating UK-facing websites, analytics tools, and online advertising services.
Cookies and Similar Technologies (closes 26 September 2025)
The ICO is seeking views on when consent is required for the use of cookies and similar technologies. In particular, it is exploring whether exemptions could be extended to cover low-risk technologies that enhance user experience such as preference settings, basic analytics, or certain security updates.
Online Advertising and Consent (closes 7 September 2025)
The ICO is also considering whether limited low-risk forms of tracking for advertising could be permitted without explicit consent under the DUAA. This consultation raises important questions for publishers, platforms, and adtech providers balancing privacy compliance with advertising models.
For businesses, these consultations signal potential changes to the familiar “cookie banner” landscape and may result in divergence from the EU ePrivacy regime. Organisations with cross-border operations should track these developments carefully and consider whether to submit responses.
We recently examined the wider DUAA reforms, highlighting the implications for data protection compliance and digital business models. The outcomes of the ICO’s consultations will play a key role in shaping how the DUAA operates in practice.
Next Steps
We recommend businesses review the consultation papers and assess how proposed changes may impact customer-facing sites, analytics arrangements, and advertising partnerships.