UK Data (Use and Access) Act 2025 and ICO cookie guidance: what changed for advertising, and when

The Act is long, and most of it does not concern advertising. The table lists the provisions an ad tech or marketing team is likely to meet, with the instrument that brought each into force.

The Article 6(11) example does not remove the cookie rule. A marketer may rely on legitimate interests for some UK GDPR processing, but storing or reading an advertising identifier on a device still falls under PECR regulation 6.

What the law says. Regulation 6(1) now reads: "Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user" (PECR reg. 6). Two definitions widen it. Under regulation 6(2)(a), storing or accessing "includes a reference to instigating the storage or access". Under regulation 6(2)(b), gaining access includes "collecting or monitoring information automatically emitted by the terminal equipment".

The prohibition is the default. Schedule A1 then lists when storage or access may happen: with consent, or under one of five exceptions. The table sets them out clause by clause.

Sources for the table: PECR Schedule A1; DUAA s. 112; SI 2026/82; legislation.gov.uk draft SI search, 9 November 2026.

Note one asymmetry. The statistical exception excludes collecting information "automatically emitted" by a device (para. 5(2)), while regulation 6(2)(b) brings that collection inside the rule. Analytics that rely on emitted signals therefore cannot use the statistical exception.

What the regulator has said. The ICO published draft guidance on storage and access technologies in December 2024 and consulted on a new chapter on the Act's changes in July 2025 (ICO consultation, July 2025). It finalised the guidance on 29 April 2026 (ICO guidance). The guidance covers tracking pixels, link decoration, web storage, fingerprinting, scripts and tags, not only cookies (ZwillGen via Legal 500, 1 May 2026).

On analytics, ZwillGen's summary of the final guidance says the statistical exception does not reach "advertising-related measurement or attribution", profiling or cross-site tracking. Those uses "will generally still require consent". The same summary lists the ICO's design expectations: refusal as easy as acceptance, choices by purpose, named third parties, and no tags firing before consent (ZwillGen via Legal 500, 1 May 2026).

On strictly necessary storage, the five examples in Schedule A1 para. 4(2) now sit in the statute itself. They describe things the requested service needs: a shopping basket, a login, fraud checks on that service. A consent management platform (CMP) that sorts tags into "strictly necessary" therefore has a statutory test to apply, not only guidance.

What practitioners recommend. Law firms advise auditing every tag, not only cookies, and keeping exempt analytics separate from tags that need consent (practice) (ZwillGen via Legal 500, 1 May 2026). Search summaries of the ICO guidance report that bundling an exempt purpose with a non-exempt one in a single technology needs consent for all of it. We could not read the ICO page directly to confirm that wording.

What the law allows. Regulation 6A lets the Secretary of State add exceptions by statutory instrument. Before doing so, the minister must consult the regulator and others, and a draft must be approved by a resolution of each House of Parliament (DUAA s. 112(3)).

What the regulator advised. On 18 May 2026 the ICO published advice to government proposing a "first-party framework" for low-risk advertising without consent (Lewis Silkin, 21 May 2026; ICO, May 2026). According to Lewis Silkin's summary, the purposes it considers could be permitted are:

1. ad delivery;
2. limited targeting;
3. measurement and billing;
4. attribution;
5. frequency capping;
6. brand safety;
7. ad fraud prevention and detection.

Targeting would be limited to device and platform type, city or region, date and time, and the content on screen mapped to a broad taxonomy. That is contextual targeting. ID-based, demographic, interest-based and behavioural targeting would still need consent. The ICO itself expected only a modest effect, strongest for smaller publishers that lose most revenue when users refuse consent (Lewis Silkin, 21 May 2026).

Status on 9 November 2026. Nothing has changed in law. Legislation.gov.uk listed no 2026 statutory instrument and no draft instrument with "Privacy and Electronic Communications" in the title (legislation.gov.uk, 2026 SIs; draft SIs). We found no DSIT consultation on draft regulations. Dates will be tracked in our ad tech regulation calendar.

What the law says. PECR Schedule 1, as substituted by the Act, applies the Data Protection Act 2018 penalty regime. For regulation 6 breaches the maximum is the "higher maximum amount" (PECR Sch. 1, para. 18). For an undertaking that is £17.5 million or 4% of total annual worldwide turnover in the preceding financial year, "whichever is higher" (DPA 2018, s. 157(5)). Conduct before 5 February 2026 is still enforced under the old regulations, including the old cap (SI 2026/82, reg. 11). Since 30 September 2026 the enforcer is the Information Commission, which took over the Commissioner's functions (SI 2026/1015).

What the regulator has done. The ICO's main cookie action has been a sweep of the UK's top websites. It wrote to the top 100 in November 2023, and by September 2024 said 99 of them offered a meaningful choice or were improving (Press Gazette, 17 September 2024). In December 2025 it reported that 979 of the top 1,000 sites passed its checks and that it had issued 17 preliminary enforcement notices (ICO, December 2025). By April 2026, 99% of those sites reportedly passed (ZwillGen via Legal 500, 1 May 2026).

The clearest formal sanction on advertising cookies is older. On 16 September 2024 the ICO reprimanded Sky Betting and Gaming, whose site shared data with ad tech companies before visitors could accept or reject cookies, between 10 January and 3 March 2023. The ICO found the processing "not lawful, transparent or fair" and imposed no fine (Press Gazette, 17 September 2024). We found no ICO monetary penalty for a regulation 6 breach announced between 5 February and 9 November 2026.

What the law says. Three statutory points matter for the bidstream. First, the "instigating" wording in regulation 6(2)(a) reaches whoever causes storage or access, not only the party whose code runs. Second, regulation 6(2)(b) brings in information "automatically emitted" by a device. Third, no Schedule A1 exception names advertising, so advertising identifiers rely on consent (PECR reg. 6; Schedule A1).

What the regulator has said. The ICO's guidance names pixels, scripts and tags, and its advice keeps ID-based and behavioural targeting on a consent basis (Lewis Silkin, 21 May 2026). It accepted "consent or pay" models in principle in January 2025, provided consent is freely given (same source).

Our analysis (practice, not law). A scenario shows how the pieces fit. A UK news publisher runs Prebid with five supply-side platforms (SSPs), a first-party analytics script and a frequency-capping cookie.

1. The analytics script may fit the statistical exception if the data stay with the publisher and its improvement partners, and users can object free of charge.
2. Each SSP's user-sync cookie needs consent. On the statute's wording, the publisher instigates that storage by placing the tag.
3. The frequency-capping cookie needs consent today, although it appears on the ICO's list for a possible future exception.
4. Bid requests still carry IP address and user agent. Whether collecting them is "gaining access" under regulation 6(2)(b) is not settled by any decision we found.

UK publishers signal consent in bid requests with the IAB Europe Transparency and Consent Framework (TCF), which our TCF consent string decoder reads. Country-by-country banner rules are compared in our cookie banner rules by country tracker. For the EU side, where the Digital Omnibus may move cookie exceptions in a different direction, see the EU Digital Omnibus tracker. Identifier alternatives are covered in identity after Privacy Sandbox.

• The ICO's own pages could not be accessed, so its guidance wording, the December 2025 sweep figures and the May 2026 advice are cited through the ICO URLs found in search and through dated law-firm summaries.
• Whether any regulation 6 penalty notice has been issued under the new regime (none found).
• Whether DSIT has opened a consultation on draft regulation 6A regulations (none found).
• How the Information Commission brands its guidance after 30 September 2026; we keep "ICO" for documents published before that date.

1. legislation.gov.uk, Data (Use and Access) Act 2025 (c. 18), introductory text (Royal Assent 19 June 2025). https://www.legislation.gov.uk/ukpga/2025/18/introduction
2. legislation.gov.uk, Data (Use and Access) Act 2025, section 70 (lawfulness of processing). https://www.legislation.gov.uk/ukpga/2025/18/section/70
3. legislation.gov.uk, Data (Use and Access) Act 2025, section 112 (storing information in the terminal equipment). https://www.legislation.gov.uk/ukpga/2025/18/section/112
4. legislation.gov.uk, Data (Use and Access) Act 2025, section 115 (Commissioner's enforcement powers). https://www.legislation.gov.uk/ukpga/2025/18/section/115
5. legislation.gov.uk, PECR (SI 2003/2426), regulation 6 as substituted 5 February 2026. https://www.legislation.gov.uk/uksi/2003/2426/regulation/6
6. legislation.gov.uk, PECR, Schedule A1 as inserted 5 February 2026. https://www.legislation.gov.uk/uksi/2003/2426/schedule/A1
7. legislation.gov.uk, PECR, Schedule 1 as substituted 5 February 2026, paragraph 18. https://www.legislation.gov.uk/uksi/2003/2426/schedule/1
8. legislation.gov.uk, Data Protection Act 2018, section 157 (maximum amount of penalty). https://www.legislation.gov.uk/ukpga/2018/12/section/157
9. legislation.gov.uk, Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, SI 2026/82 (made 29 January 2026). https://www.legislation.gov.uk/uksi/2026/82/made
10. legislation.gov.uk, Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, SI 2026/1015 (made 10 September 2026). https://www.legislation.gov.uk/uksi/2026/1015/made