What changed
The ICO finalised its guidance on storage and access technologies on 29 April 2026. The guidance explains how PECR, and where relevant UK GDPR, apply to cookies, tracking pixels, device fingerprinting, scripts, tags, web storage and similar technologies.
The final version followed two consultations and reflects changes introduced through the Data (Use and Access) Act. It also adds new clarification on areas such as what a “simple means of objecting” means and whether the same technology can be used for multiple purposes.
What are storage and access technologies?
In simple terms, storage and access technologies are tools that store information on, or access information from, someone’s device. This includes traditional cookies, but also tracking pixels, device fingerprinting, web storage, scripts, tags and similar technologies used on websites, apps and online services.
Why this matters
Many organisations still think about compliance mainly in terms of “cookie banners”, but the ICO’s guidance is broader than that. It applies to a wider range of tracking and access technologies used for analytics, advertising, personalisation, measurement and online service delivery.
This matters because website compliance is not only about having a banner. Organisations need to understand what technologies are being used, what they do, whether consent is needed, whether any exception applies, and whether users are given clear choices. For wider updates across privacy, marketing and data protection, see our Regulatory Updates page.
What organisations should do
Organisations should treat this as a prompt to review website and online tracking compliance, especially where analytics, advertising or third-party tools are used.
- Review what cookies, pixels, scripts, tags and similar technologies are active on the website or app.
- Check whether each technology stores information on, or accesses information from, a user’s device.
- Confirm whether consent is required or whether a specific PECR exception may apply.
- Review whether users are given clear information and a simple way to manage choices where required.
- Check whether website privacy notices and cookie information are still accurate and easy to understand.
Practical takeaway
Organisations should move beyond treating cookie compliance as a one-off banner exercise. The practical task is to understand what tracking and access technologies are actually being used, what purpose they serve, and whether users are being given the right information and choices.
Grounded in
ICO final guidance on storage and access technologies, published on 29 April 2026, including updates following consultation feedback and changes introduced through the Data (Use and Access) Act.
Sources
- Information Commissioner’s Office: final storage and access technologies guidance published , 29 April 2026.
- Information Commissioner’s Office: guidance on the use of storage and access technologies .