Revolutionizing Online Tracking: The ICO's Vision for 2025

Stephen Almond is the ICO's Executive Director of Regulatory Risk.

Online tracking is an integral part of our digital lives. It not only enables personalized advertising but also funds numerous free services and shapes our online experiences. However, when mismanaged, it can lead to significant harm. For instance, vulnerable individuals, such as gambling addicts, may be bombarded with targeted ads based on their browsing history without any means to block them. Moreover, sensitive personal information related to sexuality, beliefs, and health can be unintentionally disclosed.

Recognizing these challenges, the ICO has taken decisive steps to ensure that organizations navigate online tracking responsibly while protecting individuals' personal information. Our vision is to create a fair and transparent online environment where users have meaningful control over their tracking.

Our Strategy for 2025

Our new online tracking strategy outlines our approach for 2025, focusing on addressing the challenges of online tracking across various platforms. This initiative goes beyond mere compliance; it's about fostering innovation, trust, and creating a level playing field for all.

Organizations have expressed concerns about complying with data protection laws while remaining competitive in the digital advertising landscape. Our strategy aims to remove barriers, clarify ambiguities, and simplify compliance processes.

One of our primary objectives is to ensure that the top 1,000 UK websites comply with data protection standards. Last year, we witnessed significant compliance advancements in the top 200 websites. We now aim to extend our focus to the top 1,000 websites, offering guidance and taking action where necessary. Our goal is to enhance user experiences by providing clear choices and reducing intrusive practices.

We are also encouraging publishers to adopt privacy-preserving advertising models, such as contextual advertising, while examining how current regulations may hinder this transition. Engaging with Consent Management Platforms (CMPs) is essential, as they play a pivotal role in managing user consent and tracking permissions.

Alongside our strategy, we have released guidance regarding the “consent or pay” advertising model, which provides users the choice between consenting to personalized ads or paying to avoid them. Organizations adopting this model must comply with UK data protection laws, ensuring that users can freely give consent for their personal information's processing.

Our guidance clarifies how to implement the “consent or pay” model while maintaining users' rights and supporting organizations' economic viability. We will work closely with publishers to uphold users' information rights and address any non-compliance.

Simplifying Compliance

To facilitate a smoother compliance process, we have launched a consultation on our updated guidance regarding storage and access technologies (previously known as “cookies guidance”). This guidance offers clarity on our expectations for organizations using online tracking technologies such as cookies, tracking pixels, and fingerprinting.

Our vision is for tracking to benefit everyone—providing users with clear choices and confidence in how their information is utilized, while allowing businesses to operate fairly and responsibly. Our strategy for 2025 ensures we achieve both objectives.