Advertising cookies: ad-tech loading before consent

The rule

The instigating words are new. The text of regulation 6 as it stood on 4 February 2026 spoke only of a person who would “store or gain access to information” and contained no reference to instigating. The statute does not define the word and does not name advertising technology. That is why this check is flagged as an emerging duty, and why it asks a narrower question than UK-01.

The ICO’s finalised guidance of April 2026 gives the site operator the primary role. PECR says that “a person” must not store or access information, and the guidance says that, as the service provider, “you have the primary responsibility for compliance”, because you decide what storage and access technologies to use, “including whether your service incorporates third-party features or if you enable third-party storage and access technologies”. On third-party technologies it says: “As the online service provider, it is your responsibility to understand the technologies you intend to use and ensure you comply with PECR.” On the pages read for this article, the guidance does not discuss the instigating wording or say how it applies to an advertising vendor. No published decision applying it to a vendor was found.

On advertising itself the position is settled. The ICO’s guidance says that “the use of storage and access technologies for online advertising purposes requires consent”, covering “the technical processes involved in ad selection and delivery, as well as any associated tracking and profiling”. Advertising measurement is part of that consent and does not need a separate one. The statistics exception does not help: the guidance lists as needing consent “information on whether users viewed or clicked on an advert displayed to them, for the purpose of measuring the performance of the advert” and says the exception “does not apply to purposes related to online advertising”. Schedule A1 contains no advertising exception; paragraphs 2 to 7 cover consent, transmission, strict necessity, statistics, appearance and emergency location. In its letter of 5 March 2024 to IAB UK and the Association of Online Publishers, the ICO said that online advertising cookies “are not exempt from PECR’s consent requirements and never have been”, including third-party cookies used for “frequency capping, ad affiliation, click fraud detection, market research, product improvement, debugging and any other purpose”.

The guidance also sets out what has to happen along the chain. When consent is collected, the operator must say who data will be shared with, and for what purpose; “any third party who relies on the consent you obtain from your users must be able to demonstrate that your users understand you intend to share the data with them”. If a visitor withdraws consent, the one who collected it “you are responsible for telling the third parties”.

Section 112 also lets the Secretary of State add exceptions by regulations. This article states Schedule A1 as read on 7 October 2026.

What PeekWell checks and how

UK-05 asks one question: which advertising technology partners loaded on this page before the visitor had agreed? It looks at the same moment as UK-01, before anyone touches the banner.

The scan is automated. It opens your public pages the way a first-time visitor’s browser would, with no choice saved, and picks out the ad companies whose tools start early, such as an ad exchange, a demand-side platform or a retargeting pixel. The report names each one, so you can see who came in with your page. Because the instigating wording is new, the finding is marked as an emerging duty.

The scan has limits, and the report says so. It sees which ad companies a visitor’s browser reached, not who instigated the contact in the legal sense. That depends on contracts and on who set up what, and the scan reads neither. It sees the public pages it visited, and the members area when you give it a sign-in. It doesn’t port-scan, try to get in where it isn’t allowed, run any security test or open addresses nobody linked to. A request a vendor makes from its own servers, for example through server-side tagging, is outside what a browser visit can see. A Passed means the expected behaviour was observed on the pages scanned. It doesn’t say the site complies.

Why it matters for a company

A published ICO decision on a third-party advertising pixel shows what a regulator looks at. In its reprimand to Bonne Terre Limited, trading as Sky Betting and Gaming, the ICO found that MediaMath, an advertising platform contracted by the company, used a pixel embedded in skybet.com to set about 40 third-party marketing cookies before visitors had set preferences in the cookie banner. That ran from 10 January to 3 March 2023. The ICO alerted the company on 2 March; the company said it fixed the problem the next day.

The decision was addressed to the site operator. The ICO reasoned that the company “embeds third-party tracking technologies including cookies” and so “determines the purposes and means” of the processing. The advertising platform is named in the decision but was not its subject. The reprimand was issued under UK GDPR Articles 5(1)(a), 6(1)(a) and 7(1), not PECR, and it concerned a period before the instigating wording took effect. It shows how the ICO treats a vendor’s pixel on an operator’s site, not how it will apply the new wording.

For a company, three practical points follow. A vendor’s tag on your page is treated as your choice, so the list of vendors that load is a list you are answerable for. A contract with the vendor limits what it may do with data, and the ICO took such controls into account in assessing seriousness. And the new wording means a vendor may carry its own exposure for the cookies its code sets, so the duty may run in more than one direction.

Smaller companies and larger companies

The rule has no size threshold, and the ICO’s guidance applies to any organisation running an online service.

In a smaller company the ad technology arrives through a marketing plugin or a pasted pixel: a retargeting tag from an ad platform, a social network’s pixel, an affiliate script. Each one calls other partners, so a single pasted line can bring several vendors onto the page. We could not confirm a published ICO decision on this against a smaller company.

In a larger company the supply chain is longer. Media buyers, agencies and tag managers add partners, and each partner’s code may load further partners during the page load. The Bonne Terre reprimand notes the company’s statement that its demand-side platform worked under a master services agreement with contractual limits on its use of data, and the ICO took those limits into account in assessing seriousness. Contracts of that kind help with seriousness; they do not move the timing of the tag.

How to fix it

1. List the ad partners that load first. Open your site in a private window with the browser’s network tab open. Do not touch the banner. Write down every request to an advertising, retargeting or ad-measurement domain. One partner’s script can call others.
2. Decide who owns each one. For each partner, note the team, the contract and the purpose. If nobody can say why it is there, remove it.
3. Put every ad partner behind consent. In your consent tool, put advertising and ad measurement in a category that is off until the visitor accepts. The ICO says ad measurement is part of the advertising consent, so it does not need a separate one.
4. Start the tags from the accept event. In a tag manager, fire the ad tags on the consent tool’s accept event, not on page load. Pixels pasted into the theme or a plugin need the same treatment, or need to go. The mechanics match UK-01.
5. Name the partners in the banner. The ICO asks for the real names of third parties, not “partners”, and for control over each one.
6. Pass on a withdrawal. When a visitor withdraws consent, make sure your consent tool tells the partners and stops the tags. The reject and withdraw behaviour is covered in UK-04.
7. Re-scan. Clear cookies and storage, reload, and run a scan again. The partner list should be empty until a choice is made.

Whether a given arrangement satisfies the instigating wording is a question for your legal adviser. Peeky reports only what it sees.