The Data & Marketing Association has asked the UK Government to remove the consent requirement for low-risk cookies and similar technologies. Its announcement, published on 24 September, does not mention email. Tracking pixels in marketing email fall under the same rule. The paper itself has gone to officials and has not been published.
What the DMA wants
The Data (Use and Access) Act 2025 gave ministers the power to add exemptions to the consent rule in the Privacy and Electronic Communications Regulations (PECR). Officials at the Department for Culture, Media and Sport, the Department for Business, Innovation, Science and Trade and the Cabinet Office are now deciding how to use it.
The DMA wants the Government to:
- adopt the ICO’s recommended advertising exemptions as a minimum
- exempt low-risk uses such as service delivery, security, fraud and bot detection, measurement, and accessibility and language settings
- allow advertising and measurement inside a company’s own customer relationship, with no selling or reuse of data, short retention, a simple opt-out and an audit trail
- treat pseudonymisation and other privacy-enhancing technologies as a route to low-risk status
- keep consent for sensitive data, for profiling children and for tracking people across unrelated websites
It wants loyalty schemes and CRM included too, where they use the same methods under the same safeguards. DMA chief executive Rachel Aldighieri said almost nobody reads a cookie banner, and that the law treats a click on accept as informed consent when it is no such thing.
Where email comes in
The ICO’s guidance on storage and access technologies, finalised on 29 April, lists tracking pixels alongside cookies. Its worked example is a marketing email with a pixel that records when, where and on what device it was opened.
The ICO says most email marketing falls under regulation 22 of PECR. Where a pixel stores or reads information on the recipient’s device, regulation 6 applies to that processing. Regulation 6 is the consent rule ministers can now amend. A sender relying on the soft opt-in to mail existing customers has no equivalent permission for the pixel.
The same guidance covers link decoration, using a newsletter link tagged with its email source as an example. Regulation 6 applies where that tagging stores or reads information on a device.
Two of the DMA’s asks could reach this. An exemption for measurement, or for advertising and measurement inside an existing customer relationship, might take routine open and click tracking out of the consent requirement. Whether it would depends on drafting nobody outside the departments has seen.
What happens next
Nothing has changed yet and the current rules apply. The DMA gave no timetable. It is collecting examples from members of banners that add cost without protecting anyone, and says it will keep working with officials on the drafting.
The paper also asks what consent means when an AI agent browses for a person, citing research that some agents accept every banner by default.
Whatever ministers exempt will apply to pixels in email as it does to cookies on websites, whether or not email is named.
