LONDON — In a major push to overhaul the United Kingdom’s digital regulatory landscape, the Data & Marketing Association (DMA) has formally petitioned the UK Government to scrap mandatory consent requirements for low-risk cookies and equivalent tracking technologies.
The policy proposals, submitted directly to government officials on September 24, argue that the current regime of ubiquitous cookie banners has devolved into a redundant administrative burden that fails to achieve its intended privacy objectives. While the DMA’s public-facing announcements have primarily centered on website browsing experiences, the implications of their lobbying efforts extend far beyond web browsers. Because of how UK privacy laws are structured, any legislative or regulatory exemptions carved out for cookies will directly impact hidden tracking pixels and link-decoration tools utilized across the email marketing industry.
As government departments weigh how to implement newly granted legislative powers, digital marketers, privacy advocates, and legal experts are closely monitoring a debate that could redefine how brands measure engagement, manage customer relationship management (CRM) systems, and interact with the next generation of AI-driven web browsers.
1. Main Facts: The DMA’s Proposal and the Legislative Framework
At the core of the DMA’s campaign is an argument that the current consent architecture—dictated by the Privacy and Electronic Communications Regulations (PECR)—is fundamentally broken. According to DMA Chief Executive Rachel Aldighieri, the everyday internet user has been conditioned to click "Accept All" on cookie banners simply to access content, rendering the concept of "informed consent" legally and practically meaningless.
The Legislative Hook: The Data (Use and Access) Act 2025
The DMA’s intervention is not merely a theoretical critique; it is strategically timed to coincide with a golden window of regulatory reform. The passage of the Data (Use and Access) Act 2025 unlocked specific executive powers. Under this legislation, government ministers have been granted the authority to introduce targeted exemptions to the strict consent rules governing storage and access technologies under Regulation 6 of PECR.
Presently, officials across several key government bodies—including the Department for Culture, Media and Sport (DCMS), the Department for Business, Innovation, Science and Trade (DBIST), and the Cabinet Office—are drafting the statutory instruments that will determine how these exemptions are applied.
What the DMA is Demanding
Although the full policy paper submitted to government officials has not been made public, details shared with members and industry stakeholders indicate that the DMA is pushing for clear, carved-out exemptions for low-risk data processing activities. Specifically, the association wants the government to exempt:
- Routine website measurement and analytics that do not track individuals across third-party properties for behavioral advertising.
- Low-risk technologies deployed within established, trusted customer relationships.
- Loyalty schemes and CRM operations, provided they operate under strict internal safeguards and maintain consumer trust without invasive cross-site surveillance.
By removing the legal friction of consent banners for these routine business functions, the DMA argues that British businesses could save millions in compliance costs while improving the user experience on digital platforms.
2. Chronology: How We Arrived at the Current Regulatory Crossroads
To understand the weight of the DMA’s recent petition, it is essential to trace the legal and regulatory trajectory that brought the UK to this precise juncture.
- May 2018 (GDPR Implementation): The General Data Protection Regulation takes effect across Europe, radically altering how digital tracking is perceived. While the GDPR sets a high bar for consent, the accompanying ePrivacy Directive (transposed into UK law as PECR) governs the specific use of cookies and tracking tools on user devices.
- December 2018 – June 2023 (Guidance Evolution): The Information Commissioner’s Office (ICO) incrementally sharpens its enforcement posture. Following landmark fines and updated statutory guidance, the UK regulatory framework mandates that implied consent (such as continuing to scroll down a webpage) is no longer legally sufficient for non-essential cookies. Banners with equal "Accept" and "Reject" buttons become the de facto standard, blanketing the web in pop-ups.
- April 29, 2024 (ICO Finalises Storage and Access Guidance): The ICO publishes its finalized, comprehensive guidance on storage and access technologies. Crucially, this updated framework explicitly expands the legal definition of technologies requiring consent beyond standard cookies, bringing email tracking pixels and link decoration firmly under the microscope of Regulation 6 of PECR.
- 2025 (The Data [Use and Access] Act): Recognizing the administrative fatigue caused by blanket cookie rules, Parliament passes the Data (Use and Access) Act 2025. This act provides ministers with the direct mechanism to introduce pragmatic exemptions to PECR Regulation 6.
- September 24, 2025 (The DMA’s Formal Submission): Capitalizing on the new legislative powers, the DMA submits its private policy paper to government officials, demanding an end to cookie banners for low-risk uses, analytics, CRM operations, and loyalty programs.
3. Supporting Data: The Hidden Impact on Email Marketing
While the public debate invariably focuses on the irritating pop-ups encountered while browsing news websites or e-commerce stores, the technical mechanics of the law mean that email marketing is inextricably tied to the fate of cookie reform.
The ICO’s Stance on Tracking Pixels
In its definitive April guidance, the ICO clarified how storage and access technologies operate outside the traditional web browser environment. A prime example highlighted by the regulator is the marketing email embedded with a tracking pixel—a tiny, invisible graphic designed to load when an email is opened.
When a user opens a marketing email containing a pixel, information regarding when, where, and on what device the email was opened is transmitted back to the sender. According to the ICO:
- Regulation 22 of PECR typically governs direct marketing sent via electronic mail. If a brand relies on the "soft opt-in" rule to email existing customers who bought similar products, they have satisfied the direct marketing transmission rules.
- Regulation 6 of PECR, however, is an entirely different legal hurdle. Because the tracking pixel downloads content and stores/reads information on the recipient’s device, it triggers the strict device-access rules.
Crucially, the soft opt-in for direct marketing does not grant an automatic waiver for Regulation 6 pixel tracking. Under current interpretations, senders technically need separate, explicit consent to deploy tracking pixels in emails—a requirement that virtually no email marketer currently operationalizes via an upfront consent banner in every inbox.
Furthermore, the ICO’s guidance targets link decoration—the practice of tagging URLs within a newsletter (e.g., adding tracking parameters like ?utm_source=newsletter) to monitor engagement. If that tagging process reads or writes data onto the user’s device in a way that falls foul of current rules, it faces the same regulatory vulnerability.
How the DMA’s Demands Affect Email
If the government accepts the DMA’s proposals, the impact on email service providers (ESPs) and digital marketers could be transformative:
- Exemptions for Measurement: If ministers carve out an exemption for basic website and digital measurement, email open-rate and click-rate analytics could be safely secured without requiring explicit upfront consent.
- Customer Relationship Exemptions: If exemptions are extended to cover activities within an existing customer relationship (such as a retail brand emailing a registered account holder), routine CRM email metrics would similarly be protected from severe legal liability.
However, because the official DMA policy paper remains confidential and no draft statutory language has been released to the public, email marketers remain in a state of regulatory limbo, unable to confirm whether their preferred metrics will be saved by the proposed reforms.
4. Official Responses and Industry Perspectives
The campaign to dismantle cookie banners has garnered vocal support from commercial sectors, but it also faces sharp scrutiny from privacy advocates who warn against weakening consumer protections.
The Industry View: Relief and Pragmatism
Trade bodies and commercial leaders have rallied behind the DMA’s stance, emphasizing that the current legal framework is penalizing legitimate businesses while failing to protect consumers.
DMA Chief Executive Rachel Aldighieri pulled no punches in her critique of the status quo:
"Almost nobody reads a cookie banner. The law currently treats a click on ‘Accept’ as informed consent when it is no such thing. It trains consumers to blindly click away security warnings, which paradoxically makes the digital ecosystem less secure, not more."
Proponents argue that British businesses are currently operating at a competitive disadvantage, bogged down by compliance overheads that do little to stop genuine bad actors while suffocating small-to-medium enterprises (SMEs) with legal uncertainty. By focusing enforcement on high-risk profiling and intrusive cross-site behavioral tracking—rather than first-party analytics and basic operational tools—the government could restore common sense to digital regulation.
The Privacy and Regulatory View: Caution and Accountability
Conversely, data privacy experts and consumer advocates urge ministers to proceed with extreme caution. The ICO has historically maintained that transparency is non-negotiable. Even if tracking pixels and basic analytics are deemed "low-risk" by industry standards, privacy advocates argue that consumers have an inherent right to know when their reading habits, device types, and physical locations are being logged by commercial entities.
Moreover, the rise of automated technologies has introduced an entirely new philosophical dilemma into the consent debate.
5. Implications: AI Agents, Future Workloads, and Next Steps
Looking beyond traditional web browsers and standard email inboxes, the DMA’s policy paper raises a profound forward-looking question: What does "consent" even mean in an era of artificial intelligence?
The AI Agent Dilemma
As artificial intelligence rapidly evolves, autonomous AI agents are increasingly browsing the web on behalf of human users—performing research, comparing prices, and filling out forms. Research cited in the DMA’s submission highlights a startling compliance loophole: many AI agents are programmed to automatically accept every cookie banner and privacy pop-up they encounter by default.
When an algorithm gives blanket, unthinking consent on behalf of a human user to bypass friction, the foundational legal premise of "informed, specific, and freely given consent" collapses entirely. Regulators will eventually be forced to address whether automated banner-clicking constitutes valid legal authorization under PECR and GDPR—a challenge that goes far beyond simple website pop-ups.
What Happens Next?
As of late 2025, no laws have changed, and all existing PECR rules remain fully in force. The ICO’s April guidance on storage, access technologies, and tracking pixels remains the operative standard for businesses operating in the UK.
The DMA has not provided a definitive timetable for when the government might formally respond to its proposals or publish draft legislation based on the Data (Use and Access) Act 2025. In the interim, the DMA is actively gathering case studies and cost-benefit examples from its member base—highlighting specific instances where convoluted banner mandates impose financial costs without providing tangible safety benefits to citizens.
For digital marketers, email senders, and compliance officers, the immediate directive is clear: maintain strict adherence to current ICO guidance while monitoring Westminster. Whether ministers choose to exempt email tracking pixels and CRM analytics alongside website cookies will depend entirely on the final, unseen drafting of upcoming statutory instruments—a regulatory pivot that will shape the future of British digital marketing for the next decade.
