Tech & Legal Updates
Short, executive level legal and commercial updates for founders and leaders of scaling technology businesses.
ICO enforcement intensifies on consent and tracking technologies
The Information Commissioner’s Office has initiated further enforcement against non-compliant cookie and tracking implementations, particularly within adtech ecosystems.
This affects revenue models dependent on behavioural tracking. Non-compliance now carries direct commercial risk through enforcement and reduced data usability.
Contractually, this requires clear allocation of responsibility between publishers, platforms, and adtech vendors, including indemnities for unlawful tracking, and warranties on consent validity mechanisms. Martech stacks must now be contractually aligned across all participants.
Source Allowed: Information Commissioner’s Office, published March 2026
https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-cookies-and-similar-technologies/
Why this reaches revenue and not just compliance
Enforcement against tracking implementations has a commercial characteristic that most regulatory risk does not. It attacks the data that the revenue model runs on. A fine is a one-off cost that can be absorbed. Losing the ability to rely on a tracking mechanism changes attribution, audience targeting and measurement at the same time, and does so across every campaign already in flight.
That distinction matters when deciding how much attention this deserves. The exposure is not primarily the enforcement action. It is the dependency.
What to check
- Whether consent is captured before tracking fires, or whether tags load on page arrival regardless.
- Whether the consent record is retrievable per user, or exists only as an aggregate configuration setting.
- Which adtech and analytics vendors receive data before consent, including tags added by marketing teams outside a formal change process.
- Whether any revenue-critical reporting would break if a tracking method became unavailable.
Where this lands in the contract
The contractual gap in most martech stacks is that responsibility for consent validity is never allocated to anyone. Publishers assume the platform handles it, the platform assumes the publisher obtained it, and the vendor agreement is silent. That silence resolves badly under scrutiny, because the party holding the customer relationship is usually the one that has to answer for it.
Terms with adtech and analytics vendors should state who is responsible for obtaining valid consent, warrant that the consent mechanism meets the applicable standard, and carry an indemnity for unlawful tracking that survives the point at which the tags were installed.