In their first significant update on adtech since 2019, the ICO have today reiterated the expected privacy standards adtech companies and products must meet.

This is a shot across the bows for new solutions coming to market that might work without cookies, but do not materially improve privacy.

In particular, the ICO gives key takeaways for companies building products based on Universal IDs, the IAB’s Transparency Consent Framework, and Google’s Privacy Sandbox.

Universal IDs

On Universal IDs, the headline conclusion is that the ICO does not think that existing proposals “address the issues raised in the 2019 report regarding transparency, control, consent or accountability.”

Going further, they state that, “in their current form these approaches do not appear to result in a significantly different outcome for individuals when compared with existing techniques that use cookies and similar technologies.”

The ICO expands on this conclusion, but central to their view is the issue of the email address identifier (or similar) being at the heart of these products.

“Depending on the specifics, these approaches may also not result in effective pseudonymisation, particularly if the original email address is also involved.”


On the TCF, the ICO does not believe that the current iteration has addressed issues identified in 2019 around transparency, fair processing, or free and informed consent.

Together with the Belgian regulators draft ruling on TCF, this raises additional questions around how the current consent management framework will function in the future where “user choice, consent, control and accountability must be meaningful.”

The Privacy Sandbox

Commenting on Google’s Sandbox proposals for post-cookie advertising, the ICO states that they are “not yet sufficiently mature to assess in detail.”

“They have not fully shown how they demonstrate participants’ compliance with the law, or how they result in better data protection outcomes compared to the existing ecosystem.”

While not directly criticising, the report does summarise some of the wider public objection to the proposals and places a range of expectations on Google to satisfy the regulator.

Warnings for Privacy-First Programmatic

The ICO makes clear their expectations for new products coming to market. It ends the report with a set of principles and recommendations that adtech companies must both follow and document when bringing new products to market.

The ICO’s concludes by warning that the industry must recognise the need for change:

“[The industry] should understand that the Commissioner does not advocate for alternatives that use the same fundamentally flawed approaches. Solutions that seek to continue “business as usual”, through which existing practices are essentially maintained by revised or new frameworks, technologies or contractual arrangements will not satisfy this expectation.”

Back to News
Back to News