UK Data (Use and Access) Act Updates Privacy Laws and Cookie Consent Rules
· 2h ago · Originally reported by PPC Land
The UK's Data (Use and Access) Act, enacted in 2025, revises elements of UK GDPR and PECR, introduces new cookie consent exemptions, and changes the ICO into a commission. These updates reshape how data is accessed and used in digital advertising and related sectors.
Why it matters
This law changes the rules for how companies collect and use personal data for advertising, potentially affecting consent requirements and regulatory oversight in the UK.
Explain it like I’m new here
It's like changing the rules for how shops can use your information and who checks if they're following the rules.
Terms in this story
Go deeper
Related stories
Least-Privilege Access Principle Applied to Ad Accounts and AI Agents
The principle of least-privilege access, which restricts users and programs to only the permissions necessary for their tasks, is being implemented in ad accounts and AI agents. This approach aims to enhance security and reduce risks by…
Definition and Role of Data Controller in Ad Data Processing
A data controller is the entity that determines the purposes and means of processing personal data, holding main legal responsibility under GDPR for how advertising data is handled. This role is central to ensuring compliance in digital…
Profiling Defined as Core to Rules on Targeted Advertising
Profiling involves using automated systems to process personal data in order to assess or predict individuals' characteristics, interests, or behaviors. This practice is central to the legal frameworks governing targeted advertising.
Contextual Integrity Theory Applied to AI and Ad Targeting
Helen Nissenbaum's contextual integrity theory, which defines privacy as information sharing according to contextual norms, is now being used to evaluate AI agents and advertising targeting practices.
GDPR Article 25 Emphasizes Data Protection by Design and Default
GDPR Article 25 requires organizations to integrate data protection measures into their systems and processes from the outset and to limit data collection and processing to what is necessary for each specific purpose. This principle is…
GDPR's Purpose Limitation Rule Restricts Data Reuse for Incompatible Purposes
The GDPR's purpose limitation principle requires that personal data collected for one reason cannot be repurposed for another incompatible use. This rule is detailed in Article 6(4) of the regulation.