Rules and ethics
Part of Privacy first measurement rules: five decisions before you launch
UK measurement rules start at the collection point, then follow the data
Map UK privacy measurement regulation by device access, personal-data use, marketing communication and location before approving any design.
UK measurement rules start at the collection point, then follow the data
The release ticket concerns a proposed tag with several intended uses: statistical improvement of a service, advertising measurement, and possible later use of information linked to an identifiable person, including email or text marketing. The review follows that operation from device contact through later handling, rather than relying on its dashboard label or delivery route.
The ticket starts with one mixed-purpose tag
The brief assigns the tag to service statistics and advertising measurement, while allowing collected or derived information to be used later in ways that may identify a person.
The potential email or text marketing use belongs in the same assessment trail, but it is not automatically cleared by the measurement purpose.
Inspect the device operation first
The first check is whether the technology stores information on a user's device or accesses information already there. PECR Regulation 6 addresses that operation; later handling may also engage UK GDPR and Data Protection Act 2018. The same event can therefore require assessment under both regimes.
Does PECR Reg 6 apply?
Is information stored on or accessed from terminal equipment?
PECR consent or exception analysis required
PECR storage and access rule does not apply
The ICO applies this test in first-party and third-party settings, including cookies, tracking pixels and device fingerprinting. First-party, third-party, client-side and server-side labels do not decide the result. Record the precise operation and why it runs, and apply the same device test to server-side tracking.
Read each purpose on its own
The review finds separate claimed purposes, not one undivided tag purpose. Test the PECR exception against each operation and purpose: one tag may support essential service operation, statistical improvement, advertising measurement, or a combination, but the exception must be justified for the specific purpose.
The ICO statistical purposes exception is available only where storage or access technology has the sole purpose of collecting information about use of a service for statistical purposes. It also requires clear, comprehensive information and a simple, free means to object. Those conditions do not extend to advertising measurement.
Online advertising is outside the exceptions, and technology used for it requires consent, including for ad measurement and performance. Where this tag serves both service statistics and advertising, the statistical exception cannot cover its advertising purpose, even if both uses share a tag. Separate configuration, documentation and testing are therefore needed.
That boundary also matters when a team measures social ROI without cookies; the advertising rules govern that side. Do not extend a statistical-purpose route to every tag output. Record the purpose-specific configuration, supporting documentation and test results before considering release.
Trace information into later handling
If collected or derived information relates to an identifiable person, the review follows each later use under UK GDPR and Data Protection Act 2018 as well as the device question. A lawful basis must be determined and documented before personal information is used, using the ICO's lawful basis guide.
No lawful basis ranks above another, and most require necessity. The record should identify, for each purpose, the controller, recipients, fields, lawful basis and necessity reasoning, plus retention, access and rights. A consent signal sent to a platform is one input to that record, not proof that every downstream use is lawful.
Keep that evidence with the data protection file. A platform's receipt of a signal does not replace purpose-by-purpose documentation. Follow collected and derived information into subsequent uses, checking whether a person remains identifiable and noting which purpose is being assessed.
Settle who receives marketing messages
The proposed later use for email or text marketing needs a separate PECR assessment. The route depends on whether the recipient is a corporate subscriber or a sole trader, so establish subscriber status before analytics information is joined to any marketing contact record.
The ICO states that PECR's electronic mail marketing rule does not apply to corporate subscribers, while sole traders are treated as individuals. Keep marketing contact lists apart from analytics data until the recipient decision is recorded; subscriber status determines the consent route for this use.
Make the release call from the record
At this point, the mixed-purpose tag cannot be approved merely from its vendor label. Hold deployment unless the record identifies the device act, the PECR route for each purpose, any later personal-information use and its lawful basis, and the current guidance and legislation checked by a qualified reviewer.
| Check | Evidence to retain |
|---|---|
| Device act | Exact operation, purpose, and what is stored or accessed on which device. |
| PECR route | Consent route or exception claimed for every purpose, with separate advertising configuration, documentation and testing. |
| Later handling | Whether personal information is used, the documented lawful basis, controller, recipients, fields, necessity, retention, access and rights. |
| Review | Current ICO guidance and legislative provisions checked by a qualified reviewer, with assessment date and guidance version. |
| Changes | Revisit the assessment when a tag destination, purpose, model, retention period or supplier changes. |
Keep the assessment date and guidance version: an outdated checklist can state the wrong rule even if its description of the technology remains accurate. Check current ICO guidance for the technology in use, and retain the legislative provisions checked by the qualified reviewer.
Reopen the record if a tag destination, purpose, model, retention period or supplier changes; a tool's privacy label cannot carry the decision forward automatically. Use the selection checklist to compare suppliers and test analytics tools against the same release questions. Any listed change means reassessing the record.
Rules carried forward from this case
The reusable sequence is to test what the technology does to the device, separate each purpose, trace identifiable information through later handling, and resolve the recipient route before release.
If the service also involves direct marketing, telecommunications or children's data, obtain relevant specialist review rather than stretching this scenario's checks beyond their scope.
