The Information Commissioner’s Office (ICO) has published advice to Government suggesting that existing consent requirements for certain forms of online advertising could be relaxed.

The advice follows recent work conducted by the ICO (including a Call for Views last year, discussed here), which considered whether there might be circumstances in which publishers could deliver low-risk forms of online advertising to users who have not granted consent.

Such a change would mark a significant departure from the existing position under the law. Currently, the use of storage and access technologies such as cookies, scripts, and tags is governed by Regulation 6 of the Privacy and Electronic Communications Regulations (PECR). As the ICO explains, under the current framework “most commercially viable online advertising requires consent whenever information is stored on, or accessed from, a user’s device, even where the risks to people’s privacy are relatively low”.

A relaxation of the Regulation 6 PECR requirements has been mooted for some time – and recently touched upon in the ICO’s update on its online tracking strategy (discussed here) – not only to address so-called ‘consent fatigue’, but also to encourage the development of privacy-enhancing alternatives to more intrusive behavioural advertising models.

In its advice to Government, the ICO sets out its preferred approach which would retain safeguards while introducing an exception to the Regulation 6 PECR consent requirements, allowing publishers to store and access information on the user’s device without consent for the following purposes:

1. Ad delivery;
2. Targeting;
3. Measurement and billing;
4. Attribution;
5. Frequency capping;
6. Brand safety; and
7. Ad fraud prevention and detection.

In the ICO’s view, this approach strikes an appropriate balance between, on the one hand, reducing ‘avoidable frictions’ for compliant publishers and making low-risk advertising models commercially viable, and on the other, protecting users by still requiring consent for higher risk activity such as tracking and profiling.

It is now for the Government to decide whether to proceed with the ICO’s recommendations, after which the ICO would update any relevant guidance.

To read the advice in full, click here.