ICO reprimands and UK programmatic advertising consent flows

What to take away

ICO actions relevant to UK programmatic consent flows

The ICO keeps a public register of every action it takes, and the ad tech entries are easy to miss among the large fines. The Enforcement action | ICO page carries reprimands, audit outcomes and enforcement notices, several of which involve tracking or marketing data.

The clearest example is Bonne Terre Limited, which trades as Sky Betting and Gaming. The ICO reprimanded the company in March 2024 after advertising cookies were placed on visitors' devices before consent had been given. The reprimand turned on the order of events, not the wording of the banner.

Experian was reprimanded in February 2023 over how it handled personal data for direct marketing and data broking. The ICO found that people's information had been used for marketing purposes in ways they would not expect. The case matters to ad tech because enforcement followed the data chain to the company that profited from it.

The ICO's interest in real time bidding is older than either case. In 2019 it published an update report into ad tech and real time bidding, which found that the sector was not meeting its transparency and consent obligations. That report led to audits of ad tech firms and a public promise of further scrutiny.

In November 2023 the regulator wrote to 53 of the UK's most visited websites. Each was given 30 days to bring its cookie banner into line, which placed the deadline in December 2023. This was the clearest signal yet that consent interfaces, not just back-end data flows, would be policed.

The ICO does not need a complaint to act. It can compel an audit through an assessment notice under the Data Protection Act 2018, which is how several ad tech reviews began. Firms that refuse to cooperate face a separate penalty.

Where a reprimand does not produce change, the next step is an enforcement notice. That document names the failing, sets a compliance period and carries its own sanction for breach.

The pattern is reprimand first, then audit, then escalation if the consent flow does not move.

The consent flow failures the ICO keeps naming

The ICO's Online tracking | ICO guidance is the document case teams work from. It requires consent before any non-essential cookie or similar technology touches a device, and it requires that consent to be unambiguous and specific.

Applied to Sky Betting and Gaming, that standard fails at the first step. Advertising cookies were set on arrival, before any choice was offered. Under the guidance, silence, scrolling and continued browsing are not consent, and a banner that only offers acceptance is not a free choice.

The second failure is implied consent more broadly. Some consent management platforms treat inactivity as agreement or leave analytics cookies on by default. Neither survives contact with the guidance.

The third is the missing reject option. Where withdrawing consent takes more clicks than giving it, consent is not freely given. The ICO has said refusal must be as easy as acceptance.

The fourth is the cookie wall. Blocking access to content unless a user accepts tracking turns consent into a condition of service, which the guidance rules out for advertising purposes.

The fifth is the stretched signal. Consent collected for one purpose is often passed down the chain as if it covered everything. Each purpose needs its own permission, and each bid request needs the right signal.

Dark patterns sit behind several of these failures. The Designing products that protect privacy | ICO guidance expects interfaces that are neutral, symmetrical and honest about what happens next.

Consent or pay models are the next test. The ICO has said they must offer a genuine choice and will be judged on the facts of each case, so a paywall that quietly degrades the free option is unlikely to hold.

Underneath all of it sits the UK GDPR guidance and resources: lawfulness, fairness and transparency, plus accountability for the choices you make and the records you keep.

Dated ICO actions and remediation windows

Deadlines arrive in three forms: warning letters, reprimands and audits.

The November 2023 letters are the clearest dated example. Websites that received one had 30 days to change their banners, so the working deadline was December 2023. The ICO followed up with further sweeps rather than fines.

Reprimands carry their own timetable and their own published date. A reprimand is listed on the register with the day it was issued, and the organisation is expected to complete the required changes and be able to show it has done so.

Audits come with a written schedule. In practice, an audited firm is typically asked for an action plan within 30 days and for completion of the priority items within 60 to 90 days. The ICO then checks the work.

Enforcement notices set a compliance period, usually measured in weeks rather than months. Breaching one is a separate matter from the original data protection failure, and the penalty can be higher.

The maximum fine under UK GDPR remains £17.5 million or 4 per cent of global annual turnover, whichever is greater.

The Data (Use and Access) Act 2025 changes part of the picture. It gives the government room to create limited exceptions to cookie consent and a list of purposes that may rely on a recognised legitimate interest. Advertising cookies are not part of that relief.

For planning, treat any ICO letter as a 30 day clock. Diarise the response, name an owner, and keep the evidence bundle for at least three years.

How enforcement reshapes supply-side and demand-side consent signals

On the supply side, consent has to be captured before any data leaves the page. The CMP must write the signal before the ad server or SSP is called, not after.

Publishers in Greater London and the South East, where inventory volumes are highest, feel this first. Their banner choices now determine what they can sell.

On the demand side, buyers must check the signal they receive. A DSP that bids on a request with no valid consent is processing personal data without a lawful basis, and the ICO has shown it will follow the chain to whoever paid for the impression.

Signal quality is the practical problem. Most UK trading uses the IAB Europe Transparency and Consent Framework, but the ICO has said the framework alone does not create compliance. It records what was said, not whether it was lawful.

The CMA adds a second layer of scrutiny. Its oversight of Google's Privacy Sandbox commitments means changes to signal formats and cookie alternatives are watched for competition effects as well as privacy ones.

For most teams, this is where programmatic advertising data protection stops being a policy document and becomes an engineering task.

Practical controls include refusing to bid without a consent string, logging that string with the impression, and alerting when consent rates fall sharply. A sudden drop is usually a broken tag rather than a change in user behaviour.

Sellers.json and ads.txt files also matter here, because they show buyers who is authorised to sell a given inventory. The ICO will not audit those files, but a supply chain you cannot describe is a supply chain you cannot defend.

Vendor contracts, audit trails and evidence the ICO expects

The ICO asks for evidence before it asks for explanations. Our rules and ethics guide covers the commercial side of the same problem, including what agencies should refuse to sign.

Keep the core audit records together so they can be retrieved promptly.

Contracts are where most reviews find gaps. A data processing agreement must state the purpose of processing, the duration, the security measures and the sub-processor list. Vague wording about industry standard practices will not do.

You also need a lawful basis recorded for each processing activity. In ad tech that is usually consent under PECR, with UK GDPR principles such as minimisation and storage limitation applying on top.

If you rely on legitimate interests for anything, keep a legitimate interests assessment that records the balancing test. For advertising cookies the assessment will rarely come out in your favour.

Audit trails should outlive the campaign. Consent records, signal logs and withdrawal requests should be kept for the life of the processing, and longer where accountability demands it.

What UK programmatic advertising teams should change this quarter

Do this in order, and keep a record of each step.

Agencies can use this quarter to win pitches. Clients are asking what happens if their banner is the next one in a sweep. A clear answer, backed by evidence, is worth more than a discount.

Keep the evidence. If the ICO asks what you did and you cannot show it, the answer is treated as nothing.

Common questions