Millions Gain Stronger Online Privacy Controls as ICO’s Cookie Crackdown Pays Off

Key Takeaways

• Major Compliance Shift: 979 of the UK’s top 1,000 websites now meet ICO cookie rules at the time of testing
• Stronger User Control: An estimated 40 million people over 14 in the UK now have greater choice over personalized advertising
• Enforcement Results: 564 websites improved only after ICO intervention, while 21 remain non-compliant with action ongoing

Deep Dive

After months of pressure on website operators, the Information Commissioner’s Office says more than 95% of the UK’s top 1,000 most-visited websites now meet legal requirements when asking users to consent to advertising cookies. It’s a shift the regulator estimates has given roughly 40 million people, about 80% of the population over 14, much more meaningful say over how companies can track their browsing for targeted ads.

The ICO’s compliance checks honed in on three major pain points that users have long complained about:

• Sites dropping ad cookies before anyone has a chance to say yes or no
• “Reject” options hidden behind extra clicks or confusing design
• Cookies being placed even when users refused consent

Most sites didn’t necessarily get it right on the first try. Of the 979 that ultimately passed, 564 improved their practices only after the ICO stepped in, including letters warning of non-compliance and, in 17 cases, preliminary enforcement notices. The remaining 415 passed upfront with no intervention.

Twenty-one websites are still failing the tests, and the regulator says enforcement isn’t letting up.

“We Delivered on That Promise”

Tim Capel, the ICO’s Interim Executive Director of Regulatory Supervision, said the progress marks delivery of a major commitment for 2025.

“We set ourselves the goal of giving people more meaningful control over how they were tracked online by the end of 2025. I can confidently say that we have delivered on that promise,” he said.

Capel stressed that the ICO isn’t declaring victory just yet. Websites that came into line shouldn’t expect to fly under the radar if they backslide, which the ICO plans to continue testing the top 1,000 sites periodically.

A Better Future for Advertising?

Alongside the clean-up effort, the regulator has been in talks with trade bodies and consent management platforms, which are the behind-the-scenes companies powering cookie banners on most major websites. Those platforms, used by nearly 80% of the top 500 sites, have now made compliance the default.

Looking ahead, the ICO is also exploring whether new, “privacy-friendly” advertising models could allow publishers to show ads while minimizing risk for those who don’t consent to tracking and how legislation might evolve to support that shift. An update on that part of the work is expected in 2026.

For now, the ICO says the web is already looking different, with more visible “reject all” buttons, fewer sneaky cookies, and a bit more respect for the people behind the clicks.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.