In June 2025, the Data (Use and Access) Act received Royal Assent, marking a pivotal moment for B2B marketers navigating an increasingly complex data environment. This legislation goes beyond mere compliance. It fundamentally reshapes how data-driven marketing operates across the UK and beyond.
While we already shared key insights about the impact of the new bill on B2B marketing at the end of last year, the final version of the act provides much-needed clarity on longstanding issues like legitimate interest marketing and consent frameworks.
Its practical provisions address the realities of modern digital engagement, from cookie management to AI-powered profiling, presenting not only compliance requirements but new opportunities to innovate and differentiate.
In order to stay competitive, B2B marketing leaders need to integrate this evolving regulatory landscape into their strategic planning, operational processes and technology investments.
A Win for Legitimate Interest and Consent Models
One of the most impactful clarifications in the new act focuses on the use of legitimate interest as a legal basis for direct marketing. While this basis already existed under the previous GDPR-aligned rules, its interpretation was murky, and many companies (erroneously) continued to request explicit consent for every engagement.
Tony Lamb, our Propolis Data and Insight Expert, stresses that the act now explicitly addresses legitimate interest as a valid legal ground for direct marketing. This removes a key area of ambiguity that previously led to over-cautious practices, such as unnecessary consent pop-ups or fragmented data collection flows.
For B2B marketers, this means revisiting consent strategies. If your team has been defaulting to consent where legitimate interest applies, it’s time to update your approach. However, Tony cautions that any changes should be reviewed with legal advisors:
“You can do less now, but that doesn’t mean doing nothing. Review what ‘less’ actually looks like in your operational context with legal advisors. In any case, it’s now in the act that you can use legitimate interest for direct marketing. There should be no ambiguity about that.”
Toward a More Frictionless Web Experience
The act’s treatment of cookies represents another step toward making things simpler, though not as far-reaching as some initially hoped. Early drafts suggested a radical reduction in consent requirements, but the final version is more measured.
Crucially for B2B websites, certain non-essential cookies, especially those used for statistical tracking or aligning content with user preferences, no longer require explicit opt-in.
Tony explains that the new law reduces friction around statistical cookies and user tracking, confirming a reduced need for intrusive pop-ups:
“The bill provides exemptions from the requirement to seek consent for certain non-essential cookies and similar tracking technologies. For example, consent was previously required for non-essential cookies used for statistical purposes. That is no longer the case.”
This is especially good news for marketers focused on user experience and conversion optimisation. Frequent cookie pop-ups have long been a point of friction in digital journeys, particularly for returning users.
Under the new regime, data such as session duration, video engagement and page navigation patterns can be collected more seamlessly, provided it’s not used in ways that intrude on user privacy.
Marketers should work closely with web developers and legal teams to update cookie banners and consent scripts. Many organisations can now simplify, or in some cases, remove pop-ups for performance cookies without breaching the law.
International Data Transfers: Uncertainty Abroad
The bill modernises domestic data governance but leaves open questions regarding international data transfers. This is a critical issue for global B2B firms using cloud-based martech solutions.
As Tony explained, the previous GDPR framework did not reflect the reality of modern, distributed cloud computing, where data can be stored and moved dynamically across multiple regions.
He says the act brings greater clarity domestically but there’s still uncertainty around how it will align with international regimes, including EU laws: “How it interfaces with overseas regulation still needs to be worked through.”
While the new act may improve clarity for UK-based processing, it remains unclear whether it will be recognised by other jurisdictions, particularly the EU.
For B2B marketers using offshore CRM systems, marketing automation tools or analytics platforms, it’s essential to maintain a close collaboration with legal and IT teams to avoid compliance blind spots.
In the near term, businesses may need to rely on standard contractual clauses (SCCs) or updated international data transfer agreements until reciprocal recognition is established between the UK and its trading partners.
AI, Profiling and Predictive Analytics
One of the most forward-looking aspects of the new law is its approach to AI and data-driven profiling. Under the previous legislation, virtually all forms of profiling theoretically required consent.
This approach was increasingly out of step with the realities of modern marketing. Today’s martech ecosystem runs on profiling, from lead scoring and personalisation to content recommendations and predictive analytics.
The new bill is more pragmatic. Profiling can now be conducted without explicit consent, provided it doesn’t result in decisions with significant negative impact on individuals, such as services denial or legal consequences.
As Tony notes, “General profiling is a lot more relaxed now. So it gives more scope.” This shift opens the door for greater innovation in AI-driven marketing, including dynamic segmentation, account-based personalisation and behavioural targeting.
B2B marketers investing in AI tools can proceed with more confidence, provided that ethical frameworks and privacy-by-design principles remain embedded in development and deployment. The act doesn’t give carte blanche, but it brings regulation closer in line with real-world practice.
First-Party Data Strategies
With third-party cookies on the way out and first-party data more valuable than ever, the new legislation reaffirms the strategic importance of building direct, value-based relationships with audiences.
Collecting first-party data – through gated content, newsletter sign-ups and CRM-enriched lead forms – remains not only compliant but increasingly powerful.
While the act reduces some friction in consent requirements, it also strengthens the case for transparent, meaningful data exchanges. As Tony explains: “First party data is about creating a relationship with the individual by trying to create a value relationship there. That still stands true.”
B2B marketers should double down on value propositions that incentivise users to share their data willingly. Premium insights, ROI calculators or tailored reports can all serve this purpose. The goal isn’t just to remain compliant, it’s to build trust and loyalty in an environment where customer data becomes a critical competitive asset.
Operational Adjustments: What To Do Now?
The new bill provides marketing operations leaders with an opportunity to audit and streamline their data practices. Key areas to review include:
- Consent mechanisms: Update forms, pop-ups and backend logic to align with the clearer rules on legitimate interest and consent.
- Cookie scripts: Reconfigure or simplify cookie banners to reflect exemptions for non-intrusive tracking.
- CRM systems: Re-evaluate how segmentation and targeting logic aligns with profiling permissions.
- International hosting: Ensure any offshore data storage complies with still-evolving cross-border rules.
As Tony puts it, “If you were compliant before, life just got a little easier. But if you were over-complying out of caution, now’s the time to trim the excess. Overall it’s simpler and clearer… But still, if you’re using data for highly sensitive purposes you still have all the regulatory requirements.”
This is a good time to strengthen internal data governance policies, staff training and cross-functional collaboration between marketing, legal and IT teams.
Digital Verification and AI-Driven Fraud Protection
Finally, the new law introduces provisions around digital identity verification. This is an increasingly important topic in an era of AI-generated fraud, impersonation and data breaches.
While primarily aimed at consumer protection, this also affects B2B environments, particularly when verifying business contacts, customer authenticity or partnership integrity.
Tony emphasised how the Act supports secure, AI-resilient identity management practices: “Digital verification becomes very, very important… and this act actually enables more use of digital verification without needing to get additional permissions.”
As threats from deepfakes and spoofed identities grow, especially in sales and procurement channels, the ability to verify digital identities more robustly could become a key differentiator for secure B2B engagement.
Forward-thinking marketers should explore how digital identity tools can integrate with existing CRM systems or onboarding flows, not just for security, but to build credibility and trust in interactions.
Beyond Compliance: Toward Competitive Differentiation
The Data Protection and Digital Information Act is far more than a compliance update. By clarifying legitimate interest, reducing unnecessary consent friction and opening the door to responsible AI innovation, it empowers marketers to engage their audiences with greater confidence and efficiency.
While the legal landscape around international data transfers remains fluid, this legislation gives UK B2B marketing leaders the chance to optimise their data strategies. Those who proactively refine consent processes, improve user experiences and embed ethical AI-driven profiling will not only mitigate risk but stand out in an increasingly data-centric marketplace.
The true winners will be those who use the new legislation to build trust, deliver personalised value and make data governance a key part of their marketing playbook.
