The UK ICO criticizes Google as “irresponsible” after the company announced plans to let advertisers employ fingerprinting techniques from February 16, 2025
ICO says allowing advertisers to track digital ‘fingerprints’ will undermine consumers' control over information
Context & Ripple Effects
The ICO has repeatedly treated advertising-data practices as a privacy enforcement problem, from its finding that real-time bidding failed to protect sensitive data to its Age Appropriate Design Code’s limits on children’s data use. Google had also previously advanced anti-fingerprinting controls in Chrome, making the new position a notable reversal in the regulator’s view.
The dispute also follows the ICO’s assessment that Privacy Sandbox left routes to weaken anonymity. It turns fingerprinting into a test of whether Google’s privacy architecture can prevent substitute tracking methods rather than merely retire older ones.
First-order effects
- Google’s planned policy change immediately puts UK privacy compliance and its relationship with the ICO under sharper scrutiny, while giving advertisers a prospective additional way to identify devices or browsers.
- Consumers’ ability to control information about them is the direct issue identified by the ICO; fingerprinting can operate without relying on conventional cookie-based choices.
Second-order effects
- Advertisers and ad-tech intermediaries may reassess measurement and audience-identification plans around fingerprinting, while publishers face pressure to understand which tracking methods their advertising partners deploy.
- The criticism raises the compliance risk of treating Google platform permission as sufficient privacy clearance, particularly in an ad market the ICO had already faulted over real-time bidding’s handling of sensitive data.
Third-order effects
- If regulators continue to challenge replacement identifiers, privacy competition will shift from blocking individual tracking technologies toward proving that an entire ad-measurement design preserves meaningful user control.
- Divergent regulatory expectations could make tracking features more jurisdiction-specific, increasing the value of product designs that can apply different privacy rules across markets.
The trend: The story is part of a broader shift in which privacy regulators judge ad-tech reforms by whether they prevent circumvention through alternative identifiers, not by the retirement of cookies alone.