ICO online advertising consultation: the case for PETs and flexibility

One month into the summer consultation process (thanks EU Commission & others!), a few thoughts on the ICO’s online advertising consultation.

There is still one month to respond to the “call for views” from the UK Information Commissioner’s Office (soon “Information Commission”) regarding its approach to regulating online advertising: https://lnkd.in/evScibNJ

I cannot stress enough the importance of this consultation for those across Europe keen on seeing positive evolutions to the ePrivacy framework, notably as regards privacy-enhancing technologies (PETs).

Readers know how often I have written about issues relating to Section 5(3) of the ePrivacy Directive / Section 6 of PECR (= UK implementation of the ePD). In my view, the European Data Protection Board’s guidelines on the technical scope of Section 5(3) ePD have made matters worse, but the ICO’s current position still remains flawed and inconsistent (the ICO’s claim that you should “assess ‘strictly necessary’ from the point of view of the subscriber or user, not your own” doesn’t match the ICO’s recognition that no consent is needed for security measures – which have nothing to do with technical delivery to the user, just like monetisation and service improvement).

Yet the ICO has recognised that there are some changes that need to be made.
The ICO’s notes regarding its call for views are important: “We are exploring whether a risk-based approach to enforcing PECR could allow publishers to deliver online advertising to users who have not granted consent, where there is a low risk to their privacy”.

As a contributor to a related file before the ICO this past year, I know first-hand how hard they have clung to their previous position, while appearing receptive to the idea that *more flexibility is needed*.

The call for views suggests that they have understood: if consent is needed anyway for both a PET and a more data-hungry alternative, there is little incentive under ePD/PECR to go for the PET option.

This could therefore be the prelude to a new exception to Section 6 PECR, based on the new powers granted to the UK Secretary of State to adopt consent exceptions following consultation with the ICO.

Could this have an influence on the EU? Perhaps! While the EDPB may be quick to dismiss this as the UK’s separate track, the Commission might take notice. After all, I doubt anyone would like for the EU’s rules to be seen as hindering a broader adoption of PETs.

More reading on this topic:
– Deep dive regarding Section 5(3) ePD and its flaws: https://lnkd.in/eR87ybev
– A thinking exercise in whether the whole ePrivacy Directive should even be withdrawn: https://lnkd.in/e8qC_JAv

Data protection cookies adtech