UK GDPR and ICO consent rules for ecommerce SEO tracking

What to take away

Consent covers advertising cookies, remarketing and cross-site attribution.
Aggregate first-party measurement can rest on legitimate interests, recorded in an assessment.
UK GDPR principles and Article 30 records apply to every analytics, attribution and AI tool.
Banners need separate analytics and advertising choices, plus an equally prominent reject button.
The Data (Use and Access) Act 2025 allows consent exemptions for low-risk purposes, but only once regulations commence.

Which lawful basis covers each tracking purpose

Article 6 of the UK GDPR lists six bases. Three carry most SEO measurement.

Typical SEO use

Consent: Advertising and email analytics
Legitimate interests: Traffic and landing page reports
Contract: Order and delivery messages
Legal obligation: Tax and fraud records

What it requires

Consent: Clear affirmative action, easy withdrawal
Legitimate interests: Assessment, opt-out offered
Contract: Necessary to complete the sale
Legal obligation: A duty under UK law

Contract rarely covers marketing analytics, because tracking is not needed to complete a sale. The ICO's online tracking guidance covers cookies, pixels, local storage and device fingerprinting, so every tag needs its own basis.

Mapping bases to tools first makes the wider ecommerce SEO data protection in England work easier to evidence later.

What a compliant banner and consent mode setup includes

Consent mode links your banner to your tags. It does not replace the banner. Non-essential tags stay off until the shopper chooses, and rejecting must be as easy as accepting.

List every tag and cookie, including plugin additions.
Classify each as strictly necessary, analytics, advertising or personalisation.
Stop non-essential tags firing before consent.
Pass the correct state to each tag through consent mode.
Test the accept and reject paths, then log the results.

Strictly necessary cookies cover basket sessions and security tokens. Analytics and heatmap cookies are not strictly necessary.

Cookie consent vs strictly necessary

Strictly necessary

Consent needed: No
Example: Basket session
Fires before consent: Yes
Banner required: No

Analytics

Consent needed: Yes
Example: GA4 tag
Fires before consent: No
Banner required: Yes

Advertising

Consent needed: Yes
Example: Remarketing pixel
Fires before consent: No
Banner required: Yes

Guidance on storage and access technologies confirms that reading or storing information on a device needs consent unless it is strictly necessary.

Data minimisation in attribution

Data minimisation starts with a question: what decision does this field change? A session ID, a referrer and an order value answer most SEO questions about which landing pages earn revenue.

Our comparison of ecommerce SEO attribution methods shows where server-side and data-driven models sit against those limits.

Models built on cross-site tracking need consent. First-party aggregate reporting can sit under legitimate interests when the assessment explains why less intrusive data is enough.

What the Data (Use and Access) Act 2025 changes

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025.

It lets the Secretary of State exempt specified low-risk purposes from the cookie consent rule in regulation 6 of PECR.

Analytics and security cookies are the likely candidates, but nothing changes until those regulations commence.

The Act also raises PECR fines to 17.5 million pounds or 4 per cent of annual worldwide turnover, and adds a recognised legitimate interests list.

International transfers and processor locations

Most UK stores send analytics and AI data to US servers. A transfer needs an adequacy finding or a mechanism such as the UK International Data Transfer Agreement.

Some vendors rely instead on the UK extension to the EU-US Data Privacy Framework. Article 28 processor contracts must authorise sub-processors in advance and impose equivalent obligations on them, as set out on the ICO contracts page.

Example: compliant and non-compliant AI prompt workflows

Pasting customer reviews into a chatbot to draft product copy processes personal data whenever the text identifies someone.

Compliant and non-compliant AI prompt workflows

Advantages

Compliant: the team strips names and order numbers, then uses a contract that blocks training on its inputs.

Drawbacks

Non-compliant: an assistant pastes 4,000 named reviews into a public tool and keeps the output.

Our guide to when to review ecommerce SEO AI applications lists the checkpoints that keep content tooling inside ICO expectations.

Records to keep for ICO accountability

An Article 30 record naming each analytics, attribution and AI tool.
The lawful basis for each tool, with any legitimate interests assessment.
A retention schedule for raw events and aggregate reports.
A consent log showing what each shopper agreed to and when.
Processor contracts and transfer mechanisms for every vendor.

Common questions

Does consent mode remove the need for a cookie banner?

No. It changes how tags behave while consent is pending, but it does not authorise non-essential storage.

Who regulates ecommerce SEO tracking in the UK?

The Information Commissioner's Office enforces UK GDPR and PECR across the UK, including banners and analytics.

How long may we keep attribution data?

None is fixed. Keep raw events only as long as the stated purpose needs, then delete or aggregate them.