ICO responds to IAB UK & AOP members regarding cookie compliance

Last November, the ICO wrote to 53 of the UK’s top 100 websites stating that organisations must make it as easy for users to ‘Reject All’ advertising cookies as it is to ‘Accept All’. This followed the ICO and CMA’s publication of joint guidance on website design earlier in the year - including the need to use design to empower user choice and control. 

Since then, IAB UK and the AOP have worked jointly with our members to identify key areas where more clarity was needed on the ICO’s interpretation of the law to inform businesses decisions about steps they may need to take to ensure their approach to cookie consent is compliant. 

As part of this, we hosted a joint IAB/AOP meeting with our members, which the ICO also attended, to enable the industry to put its queries to the regulator about different aspects of legal compliance. The ICO has now published an update and letter thanking the industry for its constructive engagement and setting out its position on three points. These are: 

• Contextual advertising: The ICO states that “the easiest way to achieve compliance with data protection law” is via contextual advertising, but acknowledges that “personal information may nonetheless be processed to support functions such as ad measurement and fraud detection.” It goes on to say: “As the law currently stands, consent is required when using cookies and similar technologies for such purposes” but recognises that “such processing is typically less intrusive than that associated with serving personalised ads”. The regulator will publish updated cookie guidance after the DPDI Bill receives Royal Assent and adds that it expects that this will cover “the interplay between consent for targeted advertising and functionality that can be considered “intrinsically linked” on a technical level to that purpose’. 

• ‘Pay or consent’ models for personalised advertising: The ICO has launched a new call for views today to inform its detailed positioning on its approach to “consent or pay” business models and the factors that organisations considering these should take into account. This is published on the ICO’s website here and we at IAB UK will be working with our members on a submission.  

• Reconsenting users: For example, users who have rejected all cookies but wish to continue to access ad-funded content and services. The ICO points to its existing guidance on the duration of consent. It states that it will “consider whether any updates to our position are necessary in the ICO’s upcoming guidance on cookies and similar technologies” (see reference in point 1). 

You can read the letter in full here.  

The ICO also reiterates that it will continue its work to enforce the law against sites that are not in compliance and will shortly be starting its next wave of work, focused on the second 100 most frequented websites - according to UKOM data.  

IAB UK has been lobbying for amendments to the DPDI Bill, which introduces some limited new exemptions to the cookie consent requirements. We have worked with members of the House of Lords to table an amendment that would allow the use of cookies for ad and audience measurement purposes without needing prior consent from users. However, it remains to be seen whether the amendment will succeed and there is therefore no assumption that the law will change in this respect.