Time to spring clean your digital marketing? Updates from the ICO’s latest guidance and online tracking strategy

Digital marketing compliance continues to be an area of intense focus in the UK, EU and US, as we discuss in our must-read briefing, Digital marketing compliance - spring cleaning tips for 2026. Since then, developments have continued apace, with the Information Commissioner’s Office (ICO) publishing an update to its online tracking strategy, together with the final version of its storage and access technologies (SATs) guidance, a consultation response paper and an update to its electronic mail direct marketing guidance. Here are some key takeaways from these latest documents:

Finalised guidance for industry 

In publishing the final version of its SATs guidance, the ICO has said industry now has “no excuse for non-compliance”. The final version largely retains earlier policy positions (discussed here) but adds clarifications responding to consultation feedback, including why ‘necessity’ for the ‘strictly necessary’ exception must be assessed from the user’s perspective and why consent should be refreshed after six months. Updates also include:

• more on what a ‘simple means of objecting’ looks like for organisations relying on the ‘statistical purposes’ and ‘appearance’ consent exceptions introduced by the Data (Use and Access) Act 2025 (DUA Act), including confirming that this can be addressed within existing consent mechanisms (we discuss evolving UK cookie banner market practice in our briefing); and
• new guidance on using the same cookie for different purposes, confirming that the consent exceptions are purpose-specific and must be assessed separately for each use (see our briefing for more on how to apply the tightly drafted exceptions).

The ICO’s electronic mail marketing guidance has also been updated to reflect the DUA Act extension of the “soft opt-in” to charities. Where the conditions are met, charities can email existing supporters without prior consent.

ICO industry engagement is driving change (with no fines required) 

In the latest update to its online tracking strategy, the ICO outlines how its industry engagement efforts have been paying-off: 

• cookie banners on 99% of the UK’s top 1000 websites have now passed the ICO’s compliance checks;
• major consent management platforms, which provide the UK’s most popular websites with cookie banners such as OneTrust and Usercentrics, have made changes to their products in response to ICO engagement, including developing new templates that reflect the latest ICO guidance; and
• data management platforms, which combine data insights relating to a user's online activity, have also made positive changes following the ICO voicing particular concerns about their approach to consent and lawful bases. As a result, the ICO has decided not to pursue any further enforcement action against them at this stage (although it will continue to monitor their compliance).

Notably, the statement does not indicate that any fines have, or will be, issued in relation to these areas. This restraint is particularly notable given the uplifted fining powers the ICO now has available to address cookies/marketing infringements, following the DUA Act changes. 

Tracking remains in the spotlight

Although the ICO’s work on its SATs guidance is complete (for now), its work on online tracking isn’t. The ICO is continuing to focus on tracking across apps and internet connected devices and will soon be publishing the final version of its guidance on Internet of Things products and services. Whether consent is being sought for personalised advertising where required is a particular area of focus – with the ICO intending to engage with smart TV manufacturers to promote compliance with the law during this year. We discuss broader trends in EU and US regulators’ approaches to tracking technologies in our briefing and we discuss a recent Court of Appeal decision on consent to personalised marketing in this blog.

Further consent exceptions are coming (as promised) 

As we have outlined previously, the ICO is working with the Government to develop further consent exceptions to support ‘privacy-preserving’ forms of advertising. The ICO has now confirmed it is intending to share its evidence base with the Government next month to drive this work forward. 

Outlook 

Taken together, the latest suite of documents from the ICO confirms the UK cookies regime is maturing, the regulator’s policy positions are settling and market practice for cookie banners is continuing to shift. All good reasons to think about a spring clean of marketing compliance.