The UK’s Information Commissioner’s Office has three strategic priorities in 2025, and, you guessed it, online tracking is one of them.
The other two priorities are children’s privacy and updating the commission’s guidance on AI and automated decision-making.
But “it’s a really big year for online tracking at the ICO,” said Florence Greatrix, the data protection regulator’s principal policy advisor for online tracking technology, innovation and enterprise, speaking at an IAB Tech Lab privacy event in New York City last week.
And if it’s a “really big year for online tracking at the ICO,” then it should also be a really big priority for advertisers, publishers and their ad tech partners to prioritize compliance with data protection regulations – especially regarding consent.
Through its research, the ICO has found that people actually value personalized online advertising because they like the services they get in exchange. Who doesn’t like free stuff?
“But they don’t always feel like they’re in control when they’re shown adverts that are targeted to them or not, and that’s what they want,” Greatrix said. “They want control and choice, and the law should allow them to have that.”
‘Meaningful choice’
But making a choice is one thing; manifesting it is another, and the latter ain’t easy, especially online. (Looking at you, ad tech 🤷♀️.)
Which is why the ICO is centering its 2025 privacy road map on ensuring people have what it calls “meaningful choice.” Because there are a heck of a lot of ways to underline a person’s preferences online.
Some sites, for example, don’t offer the option to reject nonessential tracking. Others offer the option, but then ignore opt-outs and continue tracking regardless. In other cases, a person might want to withdraw consent they’d previously given, only to find there’s no way to effectively transmit that signal through the supply chain, Greatrix said.
“There are a lot of issues around consent we want to tackle this year,” she said.
PET theories
But it is possible to strike a balance between privacy and addressability, said IAB Tech Lab CEO Tony Katsur, who was interviewing Greatrix on stage at the event.
One way to walk that line, he said, is through the use of privacy-enhancing technologies, which the Tech Lab has been evangelizing through the PETs Working Group it launched in early 2022.
The group has developed several technical specs for integrating PETs into ad tech, namely seller-defined audiences and PAIR. It also released recommended practices for using data clean rooms, a Privacy Sandbox use case assessment (which was rather spicy) and a review of ID-less solutions.
But now it’s time to “transition these guidelines into hands-on PETs experimentation for the industry,” Katsur said.
In other words, to put the “lab” back into “Tech Lab,” he said.
Last week, the IAB announced plans to launch a “Privacy Lab” within the Tech Lab where ad tech vendors and publishers run live tests on different PETs, including differential privacy, secure multiparty computation and homomorphic encryption.
The Privacy Lab, which will be open to all Tech Lab member companies sometime later this summer, is also hosting the prototype of the Tech Lab’s new open-source trusted server for programmatic advertising, which it announced last week.
“Our goal is to enable the ecosystem to test data sets and the usefulness of PETs in your individual software or the ecosystem overall,” Katsur said.
But it’s also important to remember that, while PETs can be a useful tool to help with compliance, the ICO is “quite clear that they’re not a silver bullet,” Greatrix said.
“They’re not just going to solve all of your problems instantly,” she said, “but they can help you with taking a data-protection-by-design approach.”
