The Information Commissioner’s Office has set out recommendations for changes to the UK’s online advertising laws citing it is holding the industry back.
The Information Commissioner’s Office (ICO) has reviewed the UK’s online advertising laws, and assessed the ‘regulatory barrier’ that advertisers face.
This includes suggestions regarding changes to regulation 6 and its ‘one size fits all’ approach to curbing privacy risks and harms – which is “holding back innovation”, the ICO’s executive director, William Malcolm said.
Regulation 6, coupled with UK GDPR, governs the use of data storage and access technologies such as cookies, scripts and tags for the purposes of online advertising. Currently, most online advertising requires consent whenever information is stored on, or accessed from, a user’s device, even if the privacy risk is low.
Digital advertising adds £129bn of gross value to the UK economy per year, enabling businesses to reach new markets and customers – boosting the digital economy.
Digital ads are one of the primary reasons that consumers are able to access content for free online, and some users do value the personalisation that advertisers offer.
That being said, the ICO recognised that some audiences are increasingly concerned with the ways in which their data is being used by advertisers.
The current regulations apply consent requirements no matter the privacy risk level, which the ICO identifies as limiting the incentive to invest and adopt lower risk approaches, and introduces a layer of friction which could be avoidable.
In its guidance, the ICO defined low risk advertising must fall within its “first-party framework” and should be based solely on the content of the page or service a user is interacting with and not on personal profiles or tracked behaviours.
“We’ve heard from many organisations across the advertising ecosystem that they want to do things differently and explore alternatives to more intrusive behavioural advertising models. While new privacy‑enhancing technologies offer opportunities to do things differently, many told us they were getting stuck,” Malcolm explained.
As such, the independent advisor recommends amendments to regulation 6 for certain low risk forms of advertising such as contextual advertising, allowing them to operate without consent. Meanwhile, consent would still be required for advertising which requires “intrusive tracking and profiling people over time and across services”.
For advertisers, this would mean that low risk strategies are encouraged, and website users are met with much less friction and fewer barriers to use, reducing consent fatigue.
