According to the UK Information Commissioner’s Office (ICO), the ICO is signalling a more risk-based approach to enforcing cookie-consent rules in online advertising. The ICO states it is reviewing how it enforces Privacy and Electronic Communications Regulations (PECR) consent requirements, and it indicates this may support commercially viable, lower-risk advertising approaches where consent is not present. Founders should expect increased scrutiny of tracking design, alongside opportunities for contextual and other privacy-preserving monetisation models.

A risk-based approach is not a relaxation

Signals of this kind are easy to read as pressure coming off, and that reading tends to be expensive. A risk-based posture means attention concentrates where the risk is greatest rather than being spread evenly. For a business running behavioural tracking at scale, that is an increase in exposure, not a reduction, even as the overall enforcement posture softens.

The more useful reading is the second half: where lower-risk, privacy-preserving monetisation is treated as commercially viable, that changes the calculation on whether behavioural tracking is worth its compliance and contractual overhead in the first place.

What to check

• Which revenue actually depends on consent-based behavioural tracking, as distinct from which reporting merely uses it.
• Whether contextual or aggregate alternatives would materially degrade performance, or only reporting granularity.
• Whether consent rates are known per surface, since a low rate quietly makes the compliance overhead harder to justify.
• Whether tracking design decisions are documented, given that a risk-based regulator will look at reasoning as well as outcome.

Where this lands in the contract

If a business moves toward privacy-preserving models, the vendor agreements usually lag the product decision. Terms written for behavioural targeting will still permit data uses the business has stopped relying on, leaving exposure attached to a revenue stream it no longer has. Where the monetisation model changes, the adtech terms should change with it.