Advertising cookies: ad-tech loading before consent

The rule

The instigating words are new. The text of regulation 6 as it stood on 4 February 2026 spoke only of a person who would “store or gain access to information” and contained no reference to instigating. The statute does not define the word and does not name advertising technology. That is why this check is flagged as an emerging duty, and why it asks a narrower question than UK-01.

The ICO’s finalised guidance of April 2026 gives the site operator the primary role. PECR says that “a person” must not store or access information, and the guidance says that, as the service provider, “you have the primary responsibility for compliance”, because you decide what storage and access technologies to use, “including whether your service incorporates third-party features or if you enable third-party storage and access technologies”. On third-party technologies it says: “As the online service provider, it is your responsibility to understand the technologies you intend to use and ensure you comply with PECR.” On the pages read for this article, the guidance does not discuss the instigating wording or say how it applies to an advertising vendor. No published decision applying it to a vendor was found.

On advertising itself the position is settled. The ICO’s guidance says that “the use of storage and access technologies for online advertising purposes requires consent”, covering “the technical processes involved in ad selection and delivery, as well as any associated tracking and profiling”. Advertising measurement is part of that consent and does not need a separate one. The statistics exception does not help: the guidance lists as needing consent “information on whether users viewed or clicked on an advert displayed to them, for the purpose of measuring the performance of the advert” and says the exception “does not apply to purposes related to online advertising”. Schedule A1 contains no advertising exception; paragraphs 2 to 7 cover consent, transmission, strict necessity, statistics, appearance and emergency location. In its letter of 5 March 2024 to IAB UK and the Association of Online Publishers, the ICO said that online advertising cookies “are not exempt from PECR’s consent requirements and never have been”, including third-party cookies used for “frequency capping, ad affiliation, click fraud detection, market research, product improvement, debugging and any other purpose”.

The guidance also sets out what has to happen along the chain. When consent is collected, the operator must say who data will be shared with, and for what purpose; “any third party who relies on the consent you obtain from your users must be able to demonstrate that your users understand you intend to share the data with them”. If a visitor withdraws consent, the one who collected it “you are responsible for telling the third parties”.

Section 112 also lets the Secretary of State add exceptions by regulations. This article states Schedule A1 as read on 7 October 2026.

What PeekWell checks and how

UK-05 asks one question: which advertising technology partners loaded on this page before the visitor had agreed? The method matches UK-01: a fresh browser context with no saved choices, every request and cookie recorded as the page loads, and no click on the banner.

What differs is the grouping. From the inventory of third-party requests and cookies, the scan tags each party that its maintained list marks as advertising technology, such as an ad exchange, a demand-side platform or a retargeting pixel, and checks whether it loaded before any consent event. The report lists each party seen, so you can see who is there, and marks the finding as an emerging-duty flag, since the instigating wording is new. Severity starts at medium for that reason.

The decision is made by code, from a mapping of domains to purposes and the timing of the requests. A language model never decides that a partner loaded.

The scan has limits, and the report says so. It sees which advertising domains a browser contacted, not who instigated the contact in the legal sense: that depends on contracts and on who configured what, and the scan does not read either. It sees the public pages it visited and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. A request that a vendor makes from its own servers, for example through server-side tagging, is outside what a browser visit can see. A list only knows the vendors on it. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

Why it matters for a company

A published ICO decision on a third-party advertising pixel shows what a regulator looks at. In its reprimand to Bonne Terre Limited, trading as Sky Betting and Gaming, the ICO found that MediaMath, an advertising platform contracted by the company, used a pixel embedded in skybet.com to set about 40 third-party marketing cookies before visitors had set preferences in the cookie banner. That ran from 10 January to 3 March 2023. The ICO alerted the company on 2 March; the company said it fixed the problem the next day.

The decision was addressed to the site operator. The ICO reasoned that the company “embeds third-party tracking technologies including cookies” and so “determines the purposes and means” of the processing. The advertising platform is named in the decision but was not its subject. The reprimand was issued under UK GDPR Articles 5(1)(a), 6(1)(a) and 7(1), not PECR, and it concerned a period before the instigating wording took effect. It shows how the ICO treats a vendor’s pixel on an operator’s site, not how it will apply the new wording.

For a company, three practical points follow. A vendor’s tag on your page is treated as your choice, so the list of vendors that load is a list you are answerable for. A contract with the vendor limits what it may do with data, and the ICO took such controls into account in assessing seriousness. And the new wording means a vendor may carry its own exposure for the cookies its code sets, so the duty may run in more than one direction.

Smaller companies and larger companies

The rule has no size threshold, and the ICO’s guidance applies to any organisation running an online service.

In a smaller company the ad technology arrives through a marketing plugin or a pasted pixel: a retargeting tag from an ad platform, a social network’s pixel, an affiliate script. Each one calls other partners, so a single pasted line can bring several vendors onto the page. We could not confirm a published ICO decision on this against a smaller company.

In a larger company the supply chain is longer. Media buyers, agencies and tag managers add partners, and each partner’s code may load further partners during the page load. The Bonne Terre reprimand notes the company’s statement that its demand-side platform worked under a master services agreement with contractual limits on its use of data, and the ICO took those limits into account in assessing seriousness. Contracts of that kind help with seriousness; they do not move the timing of the tag.

How to fix it

1. List the ad partners that load first. Open your site in a private window with the browser’s network tab open. Do not touch the banner. Write down every request to an advertising, retargeting or ad-measurement domain. One partner’s script can call others.
2. Decide who owns each one. For each partner, note the team, the contract and the purpose. If nobody can say why it is there, remove it.
3. Put every ad partner behind consent. In your consent tool, put advertising and ad measurement in a category that is off until the visitor accepts. The ICO says ad measurement is part of the advertising consent, so it does not need a separate one.
4. Start the tags from the accept event. In a tag manager, fire the ad tags on the consent tool’s accept event, not on page load. Pixels pasted into the theme or a plugin need the same treatment, or need to go. The mechanics match UK-01.
5. Name the partners in the banner. The ICO asks for the real names of third parties, not “partners”, and for control over each one.
6. Pass on a withdrawal. When a visitor withdraws consent, make sure your consent tool tells the partners and stops the tags. The reject and withdraw behaviour is covered in UK-04.
7. Re-scan. Clear cookies and storage, reload, and run a scan again. The partner list should be empty until a choice is made.

Whether a given arrangement satisfies the instigating wording is a question for your legal adviser. Peeky reports only what it sees.