The Information Commissioner's Office (ICO) said on 29 April 2026 that 99% of the UK's top 1,000 websites now meet its compliance standards for cookie banners. That figure is the result of a campaign of warning letters, investigations and, in 17 cases, preliminary enforcement notices against high-traffic UK websites that set tracking cookies without a fair choice. The campaign targeted large sites, but the standards it enforced apply to every UK business website.
This is general information about the regulator's activity, not legal advice.
Key takeaways
- The ICO says 99% of the UK's top 1,000 websites now meet its cookie banner standards after letters and enforcement notices.
- PECR and UK GDPR apply to all UK websites, and complaints can prompt the ICO to look at any organisation.
- Rejecting cookies must be as easy as accepting, with no advertising cookies set before a visitor agrees.
- PECR fines of up to £17.5 million or 4% of global turnover have been possible since 5 February 2026.
What happened
The ICO's cookie campaign has run in stages since late 2023:
| Date | ICO action |
|---|---|
| 31 January 2024 | Reported writing to 53 of the UK's top 100 websites about non-compliant cookie banners; 38 changed their banners and 4 committed to change within a month |
| 23 January 2025 | Published its 2025 online tracking strategy, widening the review from the top 200 to the top 1,000 UK websites |
| 4 December 2025 | Reported that 979 of the top 1,000 sites passed its most recent tests; 21 were still failing |
| 5 February 2026 | Higher PECR fines (up to £17.5 million or 4% of global turnover) came into force under the Data (Use and Access) Act 2025 |
| 29 April 2026 | Published final storage and access technologies guidance and said 99% of the top 1,000 sites now meet its banner standards |
| 18 May 2026 | Published its advice to government on possible changes to the consent rules for low-risk online advertising |
The December 2025 update gives the clearest picture of how the ICO enforces. Of the top 1,000 sites, 415 passed without any intervention and 564 fixed their banners after initially failing and being contacted by the ICO. The regulator's approach was to write to operators first, open investigations where letters did not work, and issue preliminary enforcement notices in 17 cases. It said it would continue action against the 21 sites that had not passed and keep testing the top 1,000 periodically.
In that announcement, Tim Capel, the ICO's Interim Executive Director of Regulatory Supervision, said: "Our work does not stop here."
In April 2026, William Malcolm, Executive Director of Regulatory Risk and Innovation, said the 99% figure was "owing to focused ICO work with industry" and that there is still more to do.
What comes next
The ICO's April 2026 update to its online tracking strategy, as summarised by law firm Wiggin, lists the next steps: advice to government on low-risk advertising (published in May), final guidance on consumer Internet of Things products, engagement with connected TV manufacturers during 2026, continued monitoring of adtech compliance, and an impact review of the strategy later in the year.
The May 2026 advice proposes that some low-risk, context-based advertising could run without consent. The ICO was clear that "nothing has changed at this stage" and that the existing PECR rules still apply until government decides whether to amend them through secondary legislation. As of 13 October 2026, we could not find any amending regulations on legislation.gov.uk.
We found no published ICO fine against a UK website specifically for cookie banner failings in 2026. The regulator's record on cookies so far has been letters, investigations and preliminary notices rather than monetary penalties, but the higher fining ceiling now gives it a much bigger tool.
What this means for UK businesses
If you run a small or medium-sized site, you are unlikely to receive one of the ICO's top-1,000 letters. That does not put you outside the law. PECR and UK GDPR apply to all UK websites, and complaints from visitors can prompt the ICO to look at any organisation.
The campaign also shows what the regulator treats as a pass. Its final guidance expects consent for non-essential cookies to be freely given, with rejecting as easy as accepting, and no advertising or profiling cookies set before a visitor has agreed. Since 5 February 2026, some analytics and preference cookies can be set without consent, but only if visitors are told and can object easily; see our explainer on the Data (Use and Access) Act cookie changes.
The cookie consent landscape in the UK is likely to shift again if government acts on the ICO's advertising advice. Until then, the current consent requirements stand.
What to do now
- Test your banner as a visitor would. Open your site in a private window. Check that nothing non-essential loads before you choose, and that "Reject all" is as visible and easy as "Accept all".
- Check what actually fires. Use your browser's developer tools or your consent platform's scan to see which cookies and pixels are set before and after consent.
- Review your consent management platform settings. The ICO has engaged directly with consent platform providers; make sure your setup uses current defaults and is not set to auto-accept.
- Inventory third-party tools. A free website audit from MakeItFlow detects the technologies a page loads, such as analytics and tag managers, which helps you see what needs a consent decision. It does not check cookie consent itself, so pair it with a dedicated cookie scanner.
- Tighten the cookies you do set. Our guide to secure cookie flags covers Secure, HttpOnly and SameSite, and the MakeItFlow security headers checker shows how the rest of your HTTP headers look.
- Keep records. Note what you changed and when. If a visitor complains, a clear record of your decisions helps.
Frequently asked questions
Is the ICO only checking the top 1,000 websites?
That has been the focus of its proactive testing. Smaller sites are still covered by PECR, and the ICO can act on complaints about any organisation.
Has the ICO fined anyone for cookie banners in 2026?
We could not find a published 2026 monetary penalty against a website for cookie banner failings. Enforcement has relied on letters, investigations and preliminary enforcement notices, but fines of up to £17.5 million or 4% of global turnover are now possible for PECR breaches.
Can I stop asking consent for advertising cookies now?
No. The ICO's May 2026 advice to government is a proposal only. Advertising cookies still require consent under PECR.
Sources
- ICO: ICO action secures increased cookie compliance (4 December 2025)
- ICO: Final storage and access technologies guidance published (29 April 2026)
- ICO: Our advice to government on potential changes to online advertising rules (18 May 2026)
- ICO: Our strategy for levelling the playing field for online tracking in 2025
- ICO: ICO warns organisations to proactively make advertising cookies compliant (31 January 2024)
- Wiggin: Online tracking, ICO issues update on strategy
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
