Most top UK websites still breaching cookie regulations

The majority of the UK’s biggest websites are still dropping tracking cookies on users without consent, despite the Information Commissioner’s Office claiming it has successfully cracked down on the practice.

So says the “UK Website Health Check 2026” study from Birmingham-based ALT Agency, which audited 200 household-name websites across 20 sectors and claims that 120 out of them are setting tracking cookies before users have given consent.

Each site was tested in a clean browser with no prior cookies or consent. Analytics and marketing cookies were found running before the consent banner had been interacted with on the majority of sites tested.

ALT Agency managing director Craig Murphy said: “Most businesses think they’re covered because they’ve got a cookie banner on their site. They’re not. We found that the majority of the UK’s biggest brands have banners that don’t actually block anything. The tracking is already running before you’ve been asked.”

In 2024, the ICO warned online companies they faced tough sanctions if found to be unlawfully processing people’s data through advertising cookies without their consent after taking action against Bonne Terre, trading as Sky Betting & Gaming.

However, in December last year, the regulator insisted it had brought the vast majority of the UK’s most used websites into compliance with rules on the use of advertising trackers.

The ICO claimed its action had given an estimated 80% of UK Internet users over the age of 14, equating to around 40 million people, greater control over how they are tracked for personalised advertising.

As a result of this work, 979 of the top 1,000 websites met the ICO’s compliance checks at the time of their most recent test, with only 21 websites identified as still failing.

Even so, the ALT Agency report insists that the issue is still rife, highlighting how 100% of telecoms firms, 90% of news and publishing sites and 80% of insurance, healthcare, comparison, property and streaming sites are still breaking the rules.

Across all 200 sites, 1,731 individual cookies were identified and classified. Of those, 670 (39%) were analytics or marketing trackers with no legitimate basis for running before consent.

Craig Murphy added: “A year ago, you might have gotten away with this kind of thing. Not anymore. The ICO has ramped up their reviews of websites, they’ve issued enforcement notices, and their fines have gone up sevenfold in a single year. This isn’t theoretical anymore.

“The fix is not complicated or expensive. For most websites, it’s a configuration change that takes a few hours. But businesses need to act now, not after they’ve received a letter from the ICO.”