Privacy first measurement rules: five decisions before you launch

Privacy first measurement rules and ethics do not reduce to a cookie-banner setting. An organisation must examine what reaches a device, what personal data it uses, what an advert claims, what each supplier actually does and what the audience is told. Those are separate questions with different sources of authority.

This guide is framed for an organisation operating in England. The main privacy regimes discussed here apply across the UK, while a commercial agreement may choose the law and courts of England and Wales or another jurisdiction. The advertising codes have their own remit. A label such as "cookieless", "anonymous" or "first party" settles none of these points.

The underlying pages were reviewed on 5 September 2026. This is a desk-researched working guide, not legal advice or a finding that any system complies. The ICO marks some UK GDPR material as under review following the Data (Use and Access) Act 2025, so a qualified privacy lawyer or data protection professional must check the live design before approval.

What to take away

First separate the five decisions

The safest starting record is a data-flow diagram, not a vendor feature list. Trace the route from a person's action to the final report, including scripts, tags, device identifiers, account data, uploads, matching, modelling, retention, exports and onward sharing.

Then ask five questions in order:

The first question is about the Privacy and Electronic Communications Regulations 2003, commonly called PECR. The second concerns the UK GDPR and Data Protection Act 2018. The third can engage the CAP Code and consumer protection law. The fourth affects statutory roles and the contract. The fifth reaches privacy information, permission interfaces, marketing labels and methodology disclosures.

Know which geography you are describing

Do not write "UK law" as a shortcut for every issue. Record the actual territorial basis beside the rule.

The Data Protection Act 2018 explanatory notes state that, subject to minor exceptions, the Act extends and applies to the whole UK. That does not make civil contract analysis identical in England, Scotland and Northern Ireland. An England-based buyer should have counsel check its chosen law and forum rather than copying a supplier's default clause.

PECR asks what the technology does to the device

The current storage and access technologies guidance reached final form on 29 April 2026. It covers cookies, pixels, web storage, fingerprinting, scripts and tags. Regulation 6 can apply whether a deployment is called client side, server side, first party or third party.

Regulation 6 addresses storing information on, or gaining access to information stored on, a subscriber's or user's terminal equipment. Name the exact act and its purpose, because one tag may support essential service operation, statistical improvement and advertising measurement at once. Each purpose needs its own analysis.

Consent is not the only possible route. The Data (Use and Access) Act 2025 introduced additional exceptions, including a constrained statistical-purpose route. The government's PECR factsheet summarises the amendments, while the ICO explains the operational conditions.

Section 112 and Schedule 12 of the Data (Use and Access) Act 2025 contain the storage and access provisions. Record the assessment date and the version of guidance used, because an amended rule can leave an old checklist wrong even where its technology description still reads correctly.

The ICO's exceptions guidance says the statistical exception is limited to improving the service or website, requires clear information and a simple, free objection route, and does not cover online-advertising purposes.

That last boundary matters. An analytics tool might support service improvement in one configuration and advertising measurement in another. Review each purpose, destination and reuse. Never infer an exception from a product category.

The exception is conditional. The sole purpose must be statistics that improve the service or website, and the resulting information must be aggregate statistical information that cannot identify people.

If the service reaches into direct marketing, telecommunications or children's data, add the relevant specialist review rather than stretching this assessment.

UK GDPR analysis begins where personal information is handled

PECR and UK GDPR can apply together, but their tests are not interchangeable. A valid UK GDPR lawful basis does not by itself show whether device access needs PECR consent or meets an exception.

A PECR permission decision does not remove the need to identify a lawful basis, meet the principles and respect individual rights when processing personal information.

The ICO's lawful-basis guide says an organisation must choose and document the appropriate basis before handling personal information. It also warns against treating one basis as universally better. Record a separate purpose for reporting, audience creation, advertising activation, fraud work or product analysis rather than placing all activity beneath "analytics".

For every purpose, record the controller, recipients, fields, lawful basis, necessity reasoning, retention, access and relevant rights. A consent signal passed to a platform is an input to that record, not proof that each downstream use is lawful.

Apply the data-protection principles to the actual fields and joins. In practice, this means defining purpose, minimising collection, setting retention, checking accuracy, controlling access and demonstrating the decisions. Aggregation can reduce risk, but a dashboard total does not prove that the underlying event stream was anonymous.

Where a planned use is likely to create high risk for people, conduct and retain a data protection impact assessment before processing. The ICO's DPIA checklist expects clear data flows, role relationships, lawful-basis reasoning, risks and less intrusive alternatives. A template with empty risk analysis is not evidence of a completed assessment.

Advertising approval is a different gate

Measurement can be lawful to collect yet misleading to advertise. Claims such as "100% privacy safe", "fully anonymous" or "proves incremental sales" need their own evidence and scope. The CAP Code misleading-advertising section says marketing communications must not materially mislead and must not omit material information. It also directs attention to the overall impression, not merely the advertiser's intention.

Before release, connect every numerical or privacy claim to a dated evidence file. State whether a result is observed, attributed, modelled or estimated. Explain population, period, exclusions and material uncertainty close to the figure. If the system has not been independently tested, do not imply that it has.

Commercial relationships require separate visibility. The CAP Code recognition rules require marketing communications to be identifiable and advertorials to be made clear.

For consumer-facing practices from 6 April 2025, the CMA's unfair commercial practices guidance explains the DMCC Act framework. These advertising and consumer rules do not replace the privacy analysis.

A contract allocates tasks, not legal status

Write the responsibility matrix before negotiating warranties. Identify who chooses each purpose, who selects essential means, who receives the data and who can reuse it. The ICO's controller and processor guidance makes the decision depend on real functions. Calling a provider a processor in a schedule does not make it one if its conduct points elsewhere.

Where the relationship is controller to processor, the UK GDPR requires specified contract content. The ICO's contracts and liabilities guidance covers instructions, confidentiality, security, sub-processors, assistance, deletion or return, and audits. The ICO explicitly says that this is not a guide to commercial contract negotiation and recommends professional advice where needed.

Add operational terms the team can verify: service description, permission-state behaviour, change notification, incident routes, data locations, sub-processor approval, export format, deletion evidence, audit access and ownership of derived outputs. Liability caps, indemnities, intellectual property, termination and governing law need commercial counsel. They do not rewrite the parties' regulatory duties.

Build a release record that can survive scrutiny

A useful approval pack is short enough to maintain and specific enough to test. It should contain:

Revisit the pack when a tag destination, purpose, model, retention period or supplier changes. A product's privacy label cannot carry that decision forward on its own.

The disclosure layer must match the system. The ICO's right-to-be-informed guidance covers purposes, retention and sharing in privacy information. It does not replace clear PECR information at the point of device access, an obvious advertising label, or a methodology note beside a result.

Stop conditions for the launch meeting

Pause release if the team cannot explain where an identifier travels, if a refusal still activates advertising tags, or if a supplier reserves an unexamined reuse right. Stop as well when evidence does not support the headline claim, the public disclosure contradicts the contract, or an England-and-Wales contract term has been presented as a universal UK position.

Final sign-off needs people with authority over the actual risks. These are the data controller's accountable owner, a technical lead who has inspected the deployment, and an advertising reviewer for public claims.

Procurement or commercial counsel for the agreement and a qualified privacy reviewer must also approve.

Approvals must be dated and scoped, and never described as a guarantee that future operation stays compliant.

Before you act

Common questions

What does the PECR statistical exception actually cover?

The ICO says it is limited to improving the service or website, requires clear information and a simple, free objection route, and does not cover online-advertising purposes. An analytics tool might support service improvement in one configuration and advertising measurement in another, so review each purpose, destination and reuse.

Can a valid UK GDPR lawful basis settle the PECR question?

No. A valid UK GDPR lawful basis does not by itself answer whether device access needs PECR consent or meets an exception. Equally, a PECR permission decision does not remove the need to identify a lawful basis, meet the principles and respect individual rights when personal information is processed.

When is a data protection impact assessment needed?

Where a planned use is likely to create high risk for people, conduct and retain a data protection impact assessment before processing. The ICO expects clear data flows, role relationships, lawful-basis reasoning, risks and less intrusive alternatives. A template with empty risk analysis is not evidence of a completed assessment.

Who decides the PECR exception for each purpose?

Nobody can decide it from a product label. The sole purpose must be statistics that improve the service or website, and the output must be aggregate statistical information that cannot identify people. If one technology also supports advertising, that purpose sits outside the exception.

What changes force a fresh assessment?

Revisit the record when a tag destination, purpose, model, retention period or supplier changes. Preserve the assessment date and the version of guidance used, because an amended rule can leave an old checklist wrong even where its technology description still reads correctly.