Skip to main content
Home

ICO action secures increased cookie compliance, giving millions stronger control over their personal information online

  • Date 4 December 2025
  • Type News
  • The ICO’s action on cookie compliance means over 95% of the top 1,000 websites in the UK have met the ICO’s compliance checks at the time of testing.  
  • The ICO continues to monitor cookie compliance to ensure websites uphold their legal obligations.  
  • Industry growth and innovation remain a key priority, with the ICO aiming to help publishers adopt privacy-friendly online advertising models more easily.  

The Information Commissioner’s Office (ICO) has provided an update on its action to tackle cookie compliance, which has brought the vast majority of the UK’s most used websites into compliance with rules on the use of advertising cookies.  

This has given an estimated 80% of UK internet users over the age of 14 - equating to around 40 million people - greater control over how they are tracked for personalised advertising.

Our assessment focused on three key areas of compliance:  

  • Whether non-essential advertising cookies were stored on users’ devices before users could exercise their choice to accept or reject them.
  • Whether rejecting non-essential advertising cookies was as easy as accepting them.
  • Whether any non-essential advertising cookies were placed even though a user had not consented to them.  

As a result of this work, 979 of the top 1,000 websites met the ICO’s compliance checks at the time of their most recent test, with only 21 websites identified as still failing.  

Of the sites that were compliant with our testing criteria, 415 passed without any intervention. The remaining 564 improved their practices after initially failing, following direct engagement from the ICO. This involved sending letters to website operators highlighting their shortcomings in compliance and, where this did not lead to change, opening investigations and, in 17 cases, issuing preliminary enforcement notices (PENs). We are pleased that this threat of enforcement action has led to nearly all of the websites concerned bringing themselves into compliance.  

We continue with action in relation to the 21 websites that have still not passed our testing criteria.  

We are committed to upholding cookie compliance and will continue to periodically test the UK’s top 1,000 websites, ensuring they meet their legal requirements.

Tim Capel, Interim Executive Director of Regulatory Supervision, said:  

“We set ourselves the goal of giving people more meaningful control over how they were tracked online by the end of 2025. I can confidently say that we have delivered on that promise.  

“Our work does not stop here. We want to ensure that websites that we have brought into compliance with the cookie rules do not simply revert to their previously unlawful practices because they think it will go under the radar. We will continue to monitor compliance and engage with industry to ensure they uphold their legal obligations, while also supporting innovation that respects people’s privacy.”

Our action to tackle cookie compliance has seen significant changes that have improved user experiences online, including a greater prevalence of “reject” options on cookie banners and a lower prevalence of cookies being placed before consent has been given or after it has been refused.  

Alongside this work, we have also been encouraging better practices by engaging with trade bodies representing the majority of industries who appear in the top 1,000 websites and the consent management platforms (CMPs) that provide consent management solutions to nearly 80% of the top 500 websites. This has led to these CMPs making significant changes to ensure the cookie banner options they provide to their customers are compliant by default.

Going forward, following our consultation earlier this year, we are continuing to work with a range of stakeholders to help us understand whether publishers could deliver privacy-friendly online advertising to users who have not granted consent, where there is a low risk to their privacy. We are working with government to explore how it could amend legislation to reinforce this. The next update on our work will be provided in 2026.