The ICO has warned that Google’s policy shift on fingerprinting does not give businesses free rein and has reiterated that PECR governs storage-and-access technologies beyond cookies. Contract stacks with adtech partners should harden lawful basis, transparency, audit rights, and change-control for tracking. EU case law anchors the consent standard: the Court of Justice held in Planet49 that pre-ticked consent for cookies is invalid, reinforcing active consent expectations.