The ICO’s new tracking guidance pulls advertisers into PECR liability even when they never set the cookie
The ICO has finalised guidance that catches tracking pixels, fingerprinting, and tags, not just cookies. Under the Data (Use and Access) Act 2025, liability now follows whoever instigates the tracking, and the ICO is actively monitoring the top 1,000 UK websites for compliance.
The ICO has finalised guidance on storage and access technologies, replacing its old cookies guidance and expressly covering tracking pixels, device fingerprinting, web storage, scripts, tags, and link decoration. Under the Data (Use and Access) Act 2025, PECR now catches any organisation that instigates tracking, not just the party that technically sets it. Advertisers and ad-tech vendors who assumed the publisher carried the risk need to look again.
What the ICO’s new guidance actually covers
Finalised 29 April 2026, replacing the old cookies guidance with express coverage of pixels, fingerprinting, web storage, scripts, tags, and link decoration.
The ICO’s guidance on “storage and access technologies” is a deliberate rename, not a cosmetic update. It confirms that PECR was never only about cookies in the narrow, traditional sense, and closes off the argument that a tracking method avoids regulation simply because it is not a cookie.
Any business relying on device fingerprinting, first-party tag managers, or link decoration to track users across sessions is now squarely inside the guidance the ICO will assess compliance against.
Why “instigate” changes who is liable
PECR now catches any organisation that instigates storage or access, not only the party that technically sets or reads it.
Under the Data (Use and Access) Act 2025, an advertiser whose scripts cause a third-party cookie to be set on a publisher’s website can fall within PECR’s scope even though it never itself set that cookie. The technical act of setting the tracker is no longer the only thing that matters. Who caused it to happen matters just as much.
This directly overturns the assumption that liability sits with whichever party’s domain the tracker technically runs on.
Liability no longer tracks who technically “sets” the tracker. It tracks who instigated it.
The new penalty ceiling
Up to £17.5 million or 4% of global annual turnover, whichever is higher, in force since February 2026.
The new penalty regime under Regulation 6 of PECR brings tracking-technology breaches into the same financial territory as UK GDPR fines. This is no longer a modest fixed penalty a business can treat as a cost of doing business. It scales with the size of the organisation.
Why active monitoring changes the calculus
The ICO has confirmed it is actively monitoring the top 1,000 UK websites for compliance against this guidance.
Guidance that sits unenforced changes very little in practice. Guidance backed by active monitoring of a named, substantial slice of the UK web is a different proposition. Any business operating a high-traffic UK site, or supplying tracking technology to one, should assume its implementation is within the group the ICO is actually looking at.
Who this reaches beyond the obvious adtech vendors
Advertisers, ad-tech vendors, and publishers can all fall within scope depending on who instigated the tracking.
A publisher that assumed its ad-tech partner carried all the PECR risk, and an advertiser that assumed the publisher’s site carried it, can both be wrong under the “instigate” test. Businesses buying targeting or measurement services need to understand exactly what their supplier’s scripts do on third-party sites, not just what happens on their own.
What to put in the contract
Build consent and liability terms that reflect who instigates tracking, not just who technically hosts it.
- Add consent-flow warranties confirming exactly how and when user consent is captured before any tracker fires, on every party’s side of the relationship.
- Build indemnities that run in both directions between advertiser, ad-tech vendor, and publisher, since any of the three can now be the instigating party.
- Require audit rights over which tags and pixels are deployed, and by whom, so a business can verify what is actually running rather than relying on a supplier’s assurance.
- Map tracking technology beyond cookies in every commercial agreement, including fingerprinting, tag managers, and link decoration, to match the ICO’s expanded definition.
- Review contracts with any supplier serving a top-traffic UK site first, given the ICO’s confirmed monitoring priority.
Questions this raises
Six questions the ICO’s tracking guidance tends to prompt, answered directly.
What did the ICO change with its new tracking guidance?
On 29 April 2026 the ICO finalised guidance on storage and access technologies, replacing its old cookies guidance. It expressly covers tracking pixels, device fingerprinting, web storage, scripts, tags, and link decoration, not just cookies in the traditional sense.
Who is liable for a tracker under the new guidance?
Under the Data (Use and Access) Act 2025, PECR now covers any organisation that instigates the storage of or access to information on terminal equipment, not only the organisation that directly sets or accesses the cookie. An advertiser whose scripts cause a third-party cookie to be set on a publisher’s site can fall within scope even though it never set that cookie itself.
How large are the penalties now?
New penalties under Regulation 6 of PECR have applied since February 2026, with a ceiling of up to £17.5 million or 4% of global annual turnover, whichever is higher.
Is the ICO actually enforcing this or is it just guidance?
The ICO has confirmed it is actively monitoring the top 1,000 UK websites for compliance, and that investigations following the new guidance will be assessed against the new penalty framework. This is active supervision, not a guidance document sitting on a shelf.
Does this only affect the company that owns the website?
No. Advertisers, ad-tech vendors, and publishers can all fall within scope depending on who instigated the tracking. A business that pays for or configures a tracking script running on someone else’s site cannot assume the publisher alone carries the PECR risk.
What should change in adtech and martech contracts?
Consent-flow warranties confirming how and when consent is captured, indemnities that run in both directions between advertiser, vendor, and publisher, and audit rights over exactly which tags and pixels are deployed and by whom, since liability no longer tracks who technically set the tracker.
Sources
- Information Commissioner’s Office, guidance on storage and access technologies, published 29 April 2026.
- Data (Use and Access) Act 2025, provisions amending the Privacy and Electronic Communications Regulations 2003, penalty regime in force since February 2026.
Running tracking, tags, or pixels on UK websites?
Eliga provides embedded commercial and technology counsel to scaling businesses. If your business advertises, supplies ad-tech, or publishes content in the UK, we should review who actually instigates each tracker in your stack before the ICO does.
This page is general information about UK data protection and privacy law. It is not legal advice and does not create a solicitor-client relationship. Take specific advice on anything you are about to negotiate or sign.