ICO Updates Storage and Access Technologies Draft Guidance
Following the passage of the Data (Use and Access) Act (DUAA), the Information Commissioner’s Office (ICO) has updated its draft guidance on the use of storage and access technologies. This update reflects changes to the Privacy and Electronic Communications Regulations (PECR) through the DUAA.
The main change is a new chapter titled, ‘What are the exceptions?’, which outlines the exceptions to the prohibition on storing or accessing information on people’s devices. Alongside this, there are further minor changes throughout the guidance.
Key information:
(Deadline: 26 September 2025)
New Chapter:
In this new chapter, the ICO outline five exceptions to the prohibition on storing or accessing information on people’s devices:
The ‘Communication’ Exception: For the sole purpose of the transmission of a communication.
The ‘Strictly Necessary’ Exception: Strictly necessary to provide the service the subscriber or user requests.
The ‘Statistical Purposes’ (or ‘Analytics’) Exception: For the sole purpose of collecting statistical information about visitors to a service, with a view to improving it.
The ‘Appearance’ Exception: For the sole purpose of improving or adapting the appearance or functionality of the service to the subscriber or user’s preference.
The ‘Emergency Assistance’ Exception: For the sole purpose of identifying the location of a subscriber or user who requires emergency assistance.
The chapter provides greater detail of these exceptions, providing two hypothetical examples to clarify the ‘statistical purposes’ exception and outlining specific activities that are or are not likely to meet certain exceptions. Of note is the ‘strictly necessary’ exception, which social media plugins or other tracking technologies, cross-device tracking, and, notably, online advertising are all deemed practices unlikely to meet this standard.
The ICO is now consulting on this updated section of the guidance with a deadline for responses of 26 September 2025. To share your views and feed into techUK’s response, please email Audre (audre.verseckaite@techuk.org) and Dani (daniella.bennettremington@techuk.org).
Other relevant ICO consultations:
ICO call for views on our approach to regulating online advertising.
ICO consultation on draft guidance on consumer Internet of Things products and services
;
techUK’s insight on the changes to the ICO under the DUAA can be accessed here.
