Measurement
Part of Measuring creative advertising software from approved asset to audience outcome
Which creative attribution methods need consent: ICO rules for pixels, tags, link decoration and ad measurement
Map attribution methods used with creative tools to the ICO's storage and access rules: pixels, tags, link decoration, fingerprinting, analytics and profiling.
What to take away
- Storage and access technologies used for online advertising require consent. That includes advertising measurement.
- Measurement does not need a separate consent when the consent for advertising already covers it.
- Third parties that process ad interactions for tracking or profiling need separate consent.
- The statistical purposes exception applies only where statistics about use of the service are the sole purpose. It does not cover online advertising.
- Device fingerprinting for advertising needs consent.
Why the attribution method sets the legal question
Creative tools produce and version adverts. The attribution method decides what data is collected around each variant: a click, a view, a purchase, a device. Some methods store or read information on the visitor's device. That triggers regulation 6 of the Privacy and Electronic Communications Regulations (PECR).
Ranking methods by how well they prove cause is a separate question. It sits in work on measurement mistakes and in the measurement and reporting guide.
What counts as a storage and access technology
Under the ICO's storage and access technologies, PECR applies to any technology that stores information, or accesses information stored, on a subscriber's or user's terminal equipment. The list is cookies, tracking pixels, link decoration and navigational tracking, web storage, fingerprinting techniques, and scripts and tags.
The rules apply to any use of these technologies, including on mobile apps and connected devices. So a creative preview app or an in-app ad tag falls under them, not only a website.
Attribution methods against the ICO rules
| Method | Technology it typically uses | Position in the ICO guidance |
|---|---|---|
| Pixel or tag conversion tracking | Tracking pixels, scripts and tags | Consent needed where used for online advertising; measurement sits within that consent |
| Affiliate or click-based credit | Tracking pixel on the confirmation page, click ID stored in the browser | Used by the ICO as its example of attributing a sale to an affiliate partner; PECR applies to the stored click information |
| Link decoration | Parameters added to links | Listed among the technologies PECR covers |
| On-site analytics | Cookies, scripts | Statistical purposes exception only if that is the sole purpose |
| Device fingerprinting | Device characteristics | Consent needed for online advertising purposes |
| Third-party profiling from ad interactions | Data shared with partners | Separate consent needed |
Measurement is part of the advertising consent
Advertising measurement does not require a separate consent, because measuring campaign effectiveness is intrinsically linked to the purpose of online advertising. As long as the use is based on the user's consent, no additional consent is needed for measurement purposes.
The limit follows at once. If the information is used for other purposes that are not intrinsically linked to the original purpose, separate consent is required. That is the case where third parties process a user's interaction with the advert for tracking or profiling people.
The analytics exception does not stretch to advertising
The statistical purposes exception applies when the sole purpose of the storage or access is to collect information for statistical purposes about the use of a service. It also does not apply to things like online advertising.
A team that reads creative performance from its own site analytics can use the exception only if no advertising purpose rides on the same cookie or script. That splits one tag into two decisions: how the site is used, and how an advert performed. Where one tag serves both, the advertising purpose decides the consent rule.
Consent across the chain
Where consent is the basis and data passes to others, the rules reach the whole supply chain. When asking for consent, a team must clearly explain who it will share the data with, for what purpose, and how people can exercise control.
If a business collected the consent, it is responsible for telling the third parties when the consent is no longer valid. A creative tool that exports audience data to a platform therefore needs a withdrawal route in both directions.
The consent standard and enforcement
The rules on cookies are in regulation 6, which states that consent should be obtained from the subscriber or user. Where personal data is involved, the UK GDPR standard for consent applies: consent requires a positive opt-in, with no pre-ticked boxes or other default consent.
On enforcement, the Data (Use and Access) Act 2025 brings the PECR enforcement powers into line with UK GDPR, so that enforcement mechanisms and penalties are the same in most cases. The ICO takes a risk-based approach, weighing the level of intrusion, the efforts made to provide clear information and get consent, and consumer concern.
A short check for each attribution method
- List every pixel, tag, script, link parameter and identifier the method relies on.
- For each, write the purposesite statistics, advertising measurement or profiling.
- Check that the consent wording names the recipients, the purpose and the control.
- Record how a withdrawal reaches each third party.
- Reconcile what the creative advertising dashboard shows with what consent allowed.
The wider duties sit in the key metrics set and in the data protection data-flow map. For rules beyond data, see the rules and ethics guide.
