ICO broadens focus beyond cookies with new guidance on tracking tech

What has happened?

On 29 April 2026, the Information Commissioner's Office (ICO) published final guidance on Storage and Access Technologies (SATs). The guidance explains how the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) and, where relevant, UK GDPR apply to cookies, tracking pixels, device fingerprinting and similar technologies that store information on, or access information from, a user's device. It also reflects changes introduced by the Data (Use and Access) Act 2025.

The guidance is intended to provide organisations with greater clarity on the legal requirements applicable to storage and access technologies, including when consent is required, how the available exemptions operate and how PECR interacts with UK GDPR requirements.

Why does this matter?

The guidance is important because many organisations have historically focused their compliance efforts on cookies and cookie banners. The ICO has made clear that organisations should instead assess the wider range of technologies used to collect information about users and devices, including tracking pixels, device fingerprinting and other technologies and mechanisms that enable analytics, personalisation and targeted advertising.

This is particularly relevant for organisations operating customer-facing websites, mobile applications, digital marketing programmes and online advertising activities. Technologies that sit outside a traditional cookie consent review may nevertheless fall within PECR's storage and access rules and require user consent.

The publication sits alongside the ICO’s broader Online Tracking Strategy. Regulation 6 of PECR prohibits storing information, or gaining access to information stored, in a subscriber’s or user’s terminal equipment unless an exception in Schedule A1 applies. Where no exception applies, organisations must tell users what the relevant technologies are, explain what they do, and obtain prior consent before using them. Separately, the ICO is continuing its review of the application of regulation 6 of PECR to online advertising, indicating that further developments in this area may follow. Organisations can therefore expect continued regulatory attention across the wider online-tracking ecosystem.

Key takeaways for our clients and internal teams:

• The guidance extends beyond cookies. It covers tracking pixels, device fingerprinting, scripts, tags, web storage technologies and other tools that store information on, or access information from, a user's device.
• The ICO has clarified the scope of new exceptions. The guidance provides detailed commentary on the new exceptions for technologies used solely for statistical purposes and for adapting or enhancing the appearance or functionality of a service or websites. Organisations may be able to rely on these exceptions without obtaining consent, provided the relevant statutory conditions are met, including giving users clear and comprehensive information and a simple, free means to object. The ICO emphasises that these exceptions are narrowly framed and only apply where the storage or access is carried out solely for the relevant purpose. Technologies used to monitor or track individual users, undertake profiling, support online advertising or pursue any other additional purpose will not fall within these exceptions.
• Consent remains central. The guidance provides additional clarification on when consent is required, how it should be obtained and how organisations should assess technologies that are used for multiple purposes. In particular, organisations may not be able to rely on certain exemptions from PECR’s consent requirement where storage and access technologies are used for multiple purposes. The ICO states that “the exemptions only apply where the storage or access is carried out for that purpose, as opposed to any other purpose at the same time”.
• Tracking pixels are specifically addressed. The ICO confirms that regulation 6 of PECR applies where a tracking pixel stores information on a user’s device or accesses information stored on a user’s device. The guidance includes examples involving pixels used in marketing emails and affiliate-marketing arrangements. Organisations should therefore ensure that pixels deployed through websites, emails and marketing arrangements are included within technology audits and consent assessments.
• Online advertising remains an area of focus. Under the law as it currently stands, the use of storage and access technologies for online-advertising purposes requires consent, and the statistical purposes and appearance exceptions are not available for advertising activities. Separately, the ICO is continuing to review the application of regulation 6 of PECR to online advertising, so organisations should monitor this work for further developments.
• Transparency and user control remain key regulatory themes. The ICO continues to emphasise the importance of meaningful user choice in relation to tracking technologies across websites, applications and connected devices. Where consent is required, organisations must provide users with clear and comprehensive information about the technologies they use and obtain valid consent before using non-exempt technologies. Organisations should avoid using generic statements and should instead ensure that cookie banners, consent management platforms and cookie policies accurately reflect the technologies operating in practice.

Recommended actions:

• Conduct a technical audit of websites, mobile applications and other digital services to identify all storage and access technologies in use, including pixels, scripts, tags, fingerprinting techniques and technologies deployed by third parties. Map the purpose of each technology and identify whether it involves the processing of personal data or the sharing of information.
• Assess whether existing consent mechanisms appropriately cover all storage and access technologies in use.
• Ensure privacy notices, cookie notices and consent management processes accurately describe tracking activities and their purposes.
• Review any reliance on PECR exemptions and confirm that the relevant conditions are satisfied.
• Where relying on the statistical purposes or appearance exceptions, carefully assess whether the relevant statutory conditions are satisfied. In particular, organisations should ensure that the storage or access is carried out solely for the relevant purpose, that users are provided with clear and comprehensive information and a simple, free means to object, and that any third-party providers use the information only for purposes consistent with the relevant exception.
• Monitor further developments arising from the ICO's online tracking strategy and any future reforms to the UK's online advertising and tracking framework.
• If you have operations outside the UK or collect information about users outside the UK, consider the requirements under international laws and regulations in this area.

Looking ahead

The ICO’s latest guidance reinforces a broader regulatory shift away from technology-specific compliance assessments and towards a more holistic review of tracking activities. Organisations should not assume that compliance efforts focused solely on cookies and cookie banners are sufficient. Instead, organisations should review the full range of technologies used across their digital estate, assess whether appropriate transparency and consent mechanisms are in place, and monitor the ICO’s ongoing work on the application of regulation 6 of PECR to online advertising and any resulting proposals or guidance.