Stephen Almond is the ICO's Executive Director of Regulatory Risk.
Online tracking is a part of everyday digital life. It enables personalised advertising, funds many free services and shapes our online experiences.
But when it isn’t done responsibly, harm can occur. For example, gambling addicts may be targeted with betting ads based on their browsing record – with no easy way to block them. People’s sexuality, beliefs, health and location may be identified, causing unwanted disclosures.
A growing number of businesses have recognised this, and we at the ICO have been taking decisive action, supporting organisations to make changes to ensure organisations can navigate online tracking responsibly while safeguarding people’s personal information.
The vision is clear: a fair and transparent online world where people are given meaningful control over how they are tracked online. It is imperative that individuals can trust the digital services they use and make informed choices about how their information is used.
Our new online tracking strategy sets out how we will spend 2025 making this vision a reality - tackling the challenges of online tracking across websites, apps and connected devices. This is not just about compliance; it’s about fostering innovation, trust, and a level playing field for all.
Organisations have told us they face challenges complying with data protection laws while remaining competitive in the digital advertising industry. Our strategy is designed to remove barriers, clarify areas of ambiguity and make it easier for organisations to do the right thing.
One of our main aims for the year is bringing the top 1,000 UK websites into compliance. Last year, we saw the industry make concerted steps forward, with significant improvements in compliance in the top 200 websites. Now we're expanding our focus to the top 1,000 websites - offering advice and guidance, and taking action where required. Our goal is to ensure that people see a noticeable improvement in their online experiences with clearer choices and fewer intrusive practices.
We want to encourage publishers to deploy more privacy-preserving advertising such as contextual models, and we will explore where the Privacy and Electronic Communications Regulations (PECR) consent requirements are preventing such a shift. We also plan to engage further with Consent Management Platforms (CMPs) who are central to how many organisations manage online consent and tracking permissions.
Alongside our 2025 online tracking strategy, we have published guidance for organisations implementing a “consent or pay” online advertising model. This follows a call for views we opened last year on the model.
“Consent or pay” models are where organisations give people a choice to access a service by consenting to personalised adverts or paying to access a service and avoid personalised adverts.
If organisations choose to adopt a “consent or pay” model, they must demonstrate that the model is compliant with UK data protection law. This means that, among other data protection standards, organisations must demonstrate that people can freely give their consent to processing of their personal information for personalised advertising.
Our guidance clarifies how organisations can deploy “consent or pay” to give users meaningful control while supporting their economic viability and includes a set of factors to assess whether people can freely give their consent.
We will engage with publishers choosing to adopt “consent or pay” models to ensure that people’s information rights are upheld and we will take action where these models are introduced in ways that don’t allow for meaningful control.
We understand that the “consent or pay” model is new to many consumers and impacts how they access websites and online services. We have guidance to help the public navigate online tracking, how they have the right to meaningful choice over their personal information and what to do if they're unhappy with or have concerns about a website's model.
With this work, we aim to simplify compliance processes and reduce the burden on businesses. We plan to promote innovation in advertising models that respect user privacy, helping to level the playing field and ensure that all organisations operate under the same rules, which will build trust with consumers and foster long-term business growth.
We want businesses to continue to work with us to achieve this. We have launched a consultation on our draft updated storage and access technologies guidance (formerly known as the “cookies guidance”). The guidance, launched last month, provides further clarity on our expectations for organisations using online tracking technologies including cookies, tracking pixels, scripts/tags and fingerprinting, covered by PECR.
Tracking should work for everyone – giving people clear choices and confidence in how their information is used, while enabling businesses to operate fairly and responsibly. Our strategy for the next year ensures both.