Information Commissioner's Office

A key area of focus for the ICO is the protection of children’s privacy online. The DUAA introduces ‘higher protection matters’ that must be considered by providers of online services likely to be accessed by children. These providers must consider how best to protect and support children who may be less aware of the risks and consequences of data processing and have different needs at various stages of development. However, exactly what this will mean in practice is so far unclear. The ICO is committed to ensuring that children are appropriately protected while maintaining the same underlying data protection principles for both children and adults.

The ICO aims to ensure that people have meaningful control over how they are tracked online. After finding concerns with 134 of the UK’s top 200 websites, the ICO plans to bring the top 1,000 into compliance through advice, guidance, and enforcement where necessary. It has also published guidance on ‘consent or pay’ advertising to support this. Under its 'Taking Control' strategy, the ICO will promote compliance with cookie and tracking laws, ensure users can control their data, and focus compliance improvements on the top 1,000 UK websites.

The ICO seeks to facilitate the transformative potential of AI, while addressing its potential risks to individual rights and freedoms. Its main aim at the moment is to provide regulatory certainty through published guidance on rights in relation to AI, and an AI and biometrics strategy announced in June. This strategy includes increased scrutiny and the development of a statutory code of practice for organisations developing or deploying AI.

The ICO has developed regulatory sandboxes and innovation hubs to support organisations in developing new products and services in a compliant manner. These initiatives are likely to expand, particularly in areas such as AI, health data, and digital identity, helping to foster innovation while ensuring privacy protections are maintained.

The ICO is currently consulting on draft guidance to its data protection enforcement. The guidance aims to provide increased clarity about how the ICO will use its enforcement powers – including powers introduced in the DUAA – in non-criminal cases. It sets out the ICO’s approach in much greater detail than the 2018 Regulatory Action Policy it will replace. While there may be changes when the final form of the guidance is published, some businesses are already reviewing their compliance strategy and processes in the light of the ICO’s proposals.