Understanding the ICO's guidance on anonymisation and pseudonymisation

On December 19, 2024, Information Commissioner’s Office (ICO) issued a statement addressing Google’s recent announcement regarding fingerprinting techniques in advertising.

Summary

The statement, announced by the ICO’s executive director of regulatory risk, Stephen Almond, confirmed that from February 16, 2025, Google will no longer prohibit organisations that use its advertising products from employing fingerprinting techniques (a process involving the collection of information about a device’s software or hardware, in order to uniquely identify a particular device and user).

ICO concerns

The ICO made clear in its statement that it considers Google’s change in position on the use of fingerprinting to be “irresponsible”, and that its concerns are largely due to Google’s significance in relation to both its position and scale in the online advertising sector. 

This is also due to the fact that the ICO considers:

• fingerprinting to not be a fair means of tracking users online on the basis that it is likely to reduce people’s choice and control over how their information is collected; and
• a shift in Google’s policy will likely mean that fingerprinting will replace the existing functions of third-party cookies, ultimately reducing a user’s ability to control  how their information is collected.

Requirements for organisations

Despite its disapproval of Google’s change in position, the statement confirms that the ICO remains steadfast on its position concerning the obligations of organisations in relation to fingerprinting and privacy. It makes clear the importance of organisations giving users a fair choice over whether or not they agree to being tracked before using fingerprinting technology, including obtaining consent from individuals where necessary.

Any organisation looking to utilise fingerprinting techniques as part of its methods of advertising are expected to demonstrate transparent behaviours to individuals, ensure fair processing, obtain freely given consent and uphold information rights.

Next steps

Accompanying its statement, the ICO published draft guidance on fingerprinting, which it confirmed forms part of its upcoming strategy on allowing individuals to have more “meaningful control” over how their information is used in order to show them personalised advertisements.

A consultation on the draft guidance opened on 20 December 2024 and remains open until Friday 14 March 2025. Responses to the draft guidance are strongly encouraged and can be submitted here.

We expect the ICO to announce further details on its plans in this space, early this year.