ICO Updates Storage and Access Technologies Draft Guidance

Following the passage of the Data (Use and Access) Act (DUAA), the Information Commissioner’s Office (ICO) has updated its draft guidance on the use of storage and access technologies. This update reflects changes to the Privacy and Electronic Communications Regulations (PECR) through the DUAA.

The main change is a new chapter titled, ‘What are the exceptions?’, which outlines the exceptions to the prohibition on storing or accessing information on people’s devices. Alongside this, there are further minor changes throughout the guidance.

Key information:

In this new chapter, the ICO outline five exceptions to the prohibition on storing or accessing information on people’s devices:

  1. The ‘Communication’ Exception: For the sole purpose of the transmission of a communication.
  2. The ‘Strictly Necessary’ Exception: Strictly necessary to provide the service the subscriber or user requests.
  3. The ‘Statistical Purposes’ (or ‘Analytics’) Exception: For the sole purpose of collecting statistical information about visitors to a service, with a view to improving it.
  4. The ‘Appearance’ Exception: For the sole purpose of improving or adapting the appearance or functionality of the service to the subscriber or user’s preference.
  5. The ‘Emergency Assistance’ Exception: For the sole purpose of identifying the location of a subscriber or user who requires emergency assistance.

The chapter provides greater detail of these exceptions, providing two hypothetical examples to clarify the ‘statistical purposes’ exception and outlining specific activities that are or are not likely to meet certain exceptions. Of note is the ‘strictly necessary’ exception, which social media plugins or other tracking technologies, cross-device tracking, and, notably, online advertising are all deemed practices unlikely to meet this standard.

The ICO is now consulting on this updated section of the guidance with a deadline for responses of 26 September 2025. To share your views and feed into techUK’s response, please email Audre ([email protected]) and Dani ([email protected]).

Other relevant ICO consultations:

techUK’s insight on the changes to the ICO under the DUAA can be accessed here.


Samiah Anderson

Samiah Anderson

Head of Digital Regulation, techUK

Audre Verseckaite

Audre Verseckaite

Senior Policy Manager, Data & AI, techUK

Daniella Bennett Remington

Daniella Bennett Remington

Policy Manager - Digital Regulation, techUK

Oliver Alderson

Oliver Alderson

Junior Policy Manager, techUK


techUK's Policy and Public Affairs Programme activities

techUK helps our members understand, engage and influence the development of digital and tech policy in the UK and beyond. We support our members to understand some of the most complex and thorny policy questions that confront our sector. Visit the programme page here.

 

Upcoming events

Latest news and insights 

Learn more and get involved

 

Policy Pulse Newsletter

Sign-up to get the latest tech policy news and how you can get involved in techUK's policy work.

 

 

Here are the five reasons to join the Policy and Public Affairs programme

Download

Join techUK groups

techUK members can get involved in our work by joining our groups, and stay up to date with the latest meetings and opportunities in the programme.

Learn more

Become a techUK member

Our members develop strong networks, build meaningful partnerships and grow their businesses as we all work together to create a thriving environment where industry, government and stakeholders come together to realise the positive outcomes tech can deliver.

Learn more

Meet the team 

Antony Walker

Antony Walker

Deputy CEO, techUK

Alice Campbell

Alice Campbell

Head of Public Affairs, techUK

Edward Emerson

Edward Emerson

Head of Digital Economy, techUK

Samiah Anderson

Samiah Anderson

Head of Digital Regulation, techUK

Audre Verseckaite

Audre Verseckaite

Senior Policy Manager, Data & AI, techUK

Mia Haffety

Mia Haffety

Policy Manager - Digital Economy, techUK

Archie Breare

Archie Breare

Policy Manager - Skills & Digital Economy, techUK

Nimmi Patel

Nimmi Patel

Head of Skills, Talent and Diversity, techUK

Daniella Bennett Remington

Daniella Bennett Remington

Policy Manager - Digital Regulation, techUK

Oliver Alderson

Oliver Alderson

Junior Policy Manager, techUK

Tess Newton

Team Assistant, Policy and Public Affairs, techUK