UK ICO and Europe's mad affair with consent

I’m Alan Chapell. I’ve been working at the intersection of privacy, competition, advertising and music for decades and I’m now writing for The Monopoly Report. If you have a tip to share in confidence, ping me at my last name at Gmail or find me on Twitter or Bluesky.

Our latest Monopoly Report podcast is out with Arielle Garcia - COO at Check My Ads who shares her perspective on the impact of the Omnicom IPG merger.

ICO’s Consent Guidance

On January 23, 2025, the UK Information Commissioner’s Office (ICO) published guidance on “pay or consent” - the model where publishers present a choice to site visitors: (a) pay a fee, (b) accept cookies and/or use of personal data for ads, or (c) don’t use the site. I have Peter Craddock coming on the pod to talk about this concept more broadly in a few weeks. So I thought I’d share some thoughts.

Why Does Europe (including the UK) love Consent?

I’m over simplifying a bit here - and there’s no use trying to re-litigate the process that led the ads space to the TCF. So I’ll just say this…. Data protection law (GDPR) in Europe requires a legal basis for processing personal data. And even though the UK is no longer part of the EU, they were in the EU when lots of these rules were built. So I thought it helpful to share thoughts on the EU more generally. For most (let’s face it, pretty much all) digital advertising models, the only viable legal basis under GDPR is consent.

Europe has a separate law (i.e., the ePrivacy Directive) that says that if you place cookies or similar tech in the terminal equipment of a user, you also need consent. What does that mean in practice? It means that it’s pretty much illegal to serve a digital ad to a European User without their consent. Contextual Ads? Consent. Use the Privacy Sandbox tools? Consent.

European policymakers like consent as much as Christopher Walken loves the cowbell.

Moreover, Europe has set a particularly high bar when it comes to consent: it must be (1) specific, (2) informed, and (3) freely given. It’s a pretty high bar - arguably much higher than the traditional consent requirements in the U.S. for say, use of precise location data.

Does Freely Given = Free?

EU data protection regulators are focused on ensuring that consent is “freely given” --- which in many cases means that there can be no consequence to the data subject for failing to grant their consent. There are two immutable forces in play here:

• Publishers (and advertisers) really value targeted ads to the point where if they are turned off, publishers need a different way to subsidize revenues in order to keep their businesses open (and niche advertisers are disadvantaged as compared to larger incumbents).

• Data Subjects have a fundamental right to privacy, and that right is severely compromised if the only ones who get to exercise those rights are those who can afford subscription fees.

So…. which one prevails? I don’t think anyone has a great answer to that question.

EU regulators continue to conduct cookie sweeps and warn publishers to have better consent mechanisms. And perhaps reluctant to enforce against publishers, data protection regulators are increasingly coming after adtech companies. And then there’s the multi-year saga between the EU and Meta which probably warrants its own TMR article.

What did the ICO guidance say?

The UK Information Commissioner’s Office January 2025 guidance makes a few points:

1. pay or consent CAN be OK (but “cookie walls” that don’t provide the additional choice of payment are not OK),

2. In order to use pay or consent, you need to conduct an assessment (EU data protection law LOVES its paperwork),

3. The fee charged must be “reasonable” (which makes sense, but can be horribly subjective… and let’s face it, data protection regulators are not built to opine on subscription fee assessments),

4. You can’t be so big that there’s a power imbalance between you and users (see comments re: Meta above, but also see what happens if there are only a handful of news publishers left standing in a few years), and

5. You’re not supposed to serve targeted ads to those who pay the subscription fee (someone should probably mention this to the streaming services).

What’s Next?

An important and influential group of EU Regulators (the EDPB) is expected to weigh in on consent or pay soon. And we’re seeing a few countries (most notably Australia and Canada) flirt with EU-style consent approaches. And between CCPA, CIPA and VPPA, the U.S. ads space continues to move closer to a consent standard.

Say what you will about Europe’s ability to innovate, they are certainly winning when it comes to influencing the privacy and data protection landscape.

Happy Data Privacy Day! Be sure to hug your favorite privacy pro!

Alan’s Hot Takes…

Here are a few additional stories that hit me over the past week:

• Another take on DeepSeek? – Don’t worry, I’ll make this quick: (1) NOT having the AI market dominated by small group of companies is a much better outcome, (2) I hope publishers are paying attention to point #1 (e.g., I’d welcome a news LLM), (3) Ask your privacy lawyer about PADFA before providing browsing data to DeepSeek, (4) All innovation in the digital ads space gets increasingly more difficult absent a collective a re-imagination of the concept of personal data, and (5) the biggest “winner” in the ads space as a result of DeepSeek might be the Sandbox and similar browser ad tools on Edge and Mozilla as this might open the door to additional client side processing power.

• TPC Deprecation and Chrome Choice Prompts - I’ve been told that Google is using the IAB Leadership event as a vehicle to socialize the choice prompt concept for Chrome. Perhaps this go round is only the first step and the UK CMA will be facilitating a more formal mechanism to provide feedback. In my view, TPC deprecation via choice prompts is bit of a ruse designed to change a conversation that was not going very well for Google. The use of a choice prompt does not change any of the underlying competition concerns raised by the CMA. I recognize that the CMA is under pressure to move the UK economy forward, but I’m not sure getting the Sandbox debacle off their plate will necessarily achieve those goals. I hope they are still engaged.

If there’s an area that you want to see covered on these pages, if you agree/disagree with something I’ve written, if you want tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.