How UK GDPR and PECR shape programmatic advertising consent

What to take away

What to take away

Where UK GDPR consent ends and PECR cookie rules begin in programmatic advertising

Two regimes apply at the same time. UK GDPR governs the processing of personal data, including the lawful basis for building audiences and bidding on them. PECR regulation 6 governs the act of storing information on, or accessing information from, a user's device.

That split matters in practice. A bid request that carries a user ID involves both: the ID is personal data under UK GDPR, and reading or writing a cookie or device identifier is a storage and access event under PECR. You need to satisfy both, not one.

The retained UK General Data Protection Regulation sets the consent standard: a clear affirmative action, specific to the purpose, with easy withdrawal. PECR adds a separate consent requirement for non-essential cookies, which covers almost everything used in programmatic advertising.

PECR sits alongside UK GDPR rather than replacing it. The ICO's Guide to Privacy and Electronic Communications Regulations | ICO explains how the cookie rules, email rules and phone marketing rules constrain tracking. Read it before you design a consent flow, not after.

The practical result for UK agencies is a two-limb test. First, do you have a UK GDPR lawful basis? Second, do you have PECR consent for storage or access? If either answer is no, the data cannot be used for bidding.

For a wider view of how these duties fit together, our UK regulations explained piece maps the regulators and the market.

The six lawful bases and why consent dominates UK ad tech bidding

UK GDPR gives six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Only two are realistic for programmatic advertising: consent and legitimate interests.

Contract is a poor fit. A user does not enter a contract with an ad tech vendor when a page loads, and the ICO has been clear that contract cannot be stretched to cover advertising. Legal obligation, vital interests and public task do not apply to commercial bidding.

Programmatic advertising involves publishers, SSPs, DSPs, DMPs, verification vendors and measurement partners. Examples include Index Exchange as an SSP, The Trade Desk as a DSP and Google Ad Manager as a publisher ad platform. Consent can be passed along that chain; legitimate interests must be assessed and documented by each controller.

The ICO's Lawful basis | ICO guidance sets out what each basis demands. It stresses that you must choose your basis before processing starts, tell people what it is, and not swap bases later because the first one became inconvenient.

Consent also has to be as easy to withdraw as to give. If a user can opt in with one click, they must be able to opt out with one click. For agencies reviewing their own arrangements, our note on when to review data protection covers the triggers that force a fresh look.

PECR regulation 6: storage and access technologies on publisher pages

PECR regulation 6 says you must not store information on, or gain access to information stored in, a user's terminal equipment unless the user has given consent, or the storage is strictly necessary to provide a service the user requested.

That covers cookies, local storage, device fingerprinting, pixels and SDK identifiers. The ICO's Guidance on the use of storage and access technologies | ICO treats these as equivalent: if it touches the device, regulation 6 applies.

The strictly necessary exemption is narrow. It covers things like remembering a shopping basket or a security token. It does not cover analytics, frequency capping, attribution, audience building or ad selection, even when those are described as essential to the service.

On publisher pages, the banner must fire before any non-essential tag loads. That means no pre-consent bid requests, no pre-consent pixels and no pre-consent audience syncs. If a tag fires on page load and only later checks a consent string, the breach has already happened.

A compliant flow looks like this:

PECR also restricts unsolicited electronic marketing. If your programmatic activity feeds retargeting lists or email audiences, check the marketing rules in the same guide.

Legitimate interest for programmatic advertising: what the ICO actually accepts

Legitimate interests is not banned in ad tech, but it is tightly bounded. The ICO expects a three-part test: identify the interest, show the processing is necessary for it, and balance it against the individual's rights and expectations.

The interest must be real and specific. "Improving advertising" is too vague. "Measuring whether a campaign was seen by a logged-in user on our own site" is the kind of narrow purpose that can pass.

Necessity is where most bids fail. If consent is a workable alternative, the ICO will ask why you did not use it. For cross-site tracking, profiling and real-time bidding on third-party sites, consent is usually the only defensible route.

The balance test looks at the user's reasonable expectations. People do not expect a cookie dropped on one site to follow them across the web and shape prices or offers. That expectation gap is why legitimate interest rarely covers open-web programmatic advertising.

Where legitimate interests can work: first-party analytics that do not build cross-site profiles, fraud and invalid traffic detection, and security. Even then, document the test, offer an opt-out, and keep the data minimal. Our review of programmatic advertising rules and ethics sets out the pre-launch checks we recommend.

Consent management platforms, TCF signals and the IAB UK Gold Standard

A consent management platform (CMP) records and transmits consent. It does not create consent, and it cannot fix a banner that fails UK GDPR or PECR standards. The ICO has said as much about the Transparency and Consent Framework (TCF) and similar signals.

The TCF string is a signal, not a legal basis. If the banner does not meet UK GDPR consent standards, the string is invalid no matter how neatly it is encoded. If vendors are not named, or purposes are bundled, the signal carries no weight.

IAB UK's Gold Standard requires members to use a registered CMP and to meet certain disclosure and accountability criteria. It is a useful market signal, but it is not a substitute for regulatory compliance. The ICO does not approve frameworks. OneTrust and Sourcepoint are examples of CMP providers with TCF-enabled products; check IAB Europe's CMP register for the current registration status of the specific product.

A CMP checklist for UK programmatic advertising:

Documenting your lawful basis: records and DPIAs

Documentation is what separates a defensible flow from a lucky one. UK GDPR requires records of processing activities, and the ICO expects to see them when it asks.

Your record should state the purpose, the lawful basis, the categories of data, the recipients, the retention period and the safeguards. For programmatic advertising, recipients include SSPs, DSPs and measurement vendors, so list them by name.

A data protection impact assessment (DPIA) is required where processing is likely to result in a high risk. Large-scale profiling and systematic monitoring, which describe much of programmatic advertising, normally meet that threshold.

A worked example: a London publisher runs open-auction display with five SSPs and a DMP. Its DPIA identifies cross-site tracking as high risk, sets consent as the basis, limits data to what each vendor needs, and sets a 13-month retention cap. The CMP logs consent, and the publisher reviews vendor tags quarterly.

What ICO enforcement means for UK consent flows

The ICO's Enforcement action | ICO page is the best guide to what the regulator actually does, and it is worth reading before you sign off a banner. It lists fines, reprimands, enforcement notices and audits across sectors.

Patterns matter more than any single case. The ICO has repeatedly acted on cookie banners that made accepting easier than rejecting, on pre-ticked boxes, and on trackers that fired before consent. Those are the same failures that appear in ad tech audits.

Enforcement in ad tech has focused on the data supply chain: how personal data was obtained, whether consent was valid, and whether it was passed on lawfully. The lesson for UK agencies is that you cannot rely on a vendor's assurance that its data is consented.

After an enforcement action, the market usually shifts. Banners get rebuilt, vendor lists get trimmed, and pre-consent tags get removed. Expect the same after any future action that touches real-time bidding. For a fuller view of how ICO, CMA and ASA powers interact, see our UK regulations explainer.

Contract terms between controllers, processors and programmatic platforms

Contracts carry the compliance weight that banners cannot. UK GDPR requires a written agreement between controllers and processors, and joint controller arrangements need their own terms.

In programmatic advertising, roles are often unclear. A DSP may act as a processor for the advertiser and a controller for its own profiling. A DMP may be a joint controller with the publisher. Each role brings different obligations.

Your contract should set out:

Flow-down matters. If a publisher obtains consent for five purposes and the contract allows a vendor to use data for a sixth, the consent is invalid for that sixth purpose. Map every purpose in the contract to a purpose in the banner.

Review contracts when the law, the CMP or the vendor list changes. The Digital Markets, Competition and Consumers Act 2024 adds further duties in the wider digital market, and the CMA is watching how data and advertising markets interact.

Common questions