28 April 2026 · Cookie Compliance
The ICO is actively fining businesses for cookie consent failures. Here is what the rules require and how to make sure your site complies.
Cookie consent is not optional. The UK's Privacy and Electronic Communications Regulations (PECR), working alongside the GDPR, set clear rules about when and how you can set cookies on a visitor's device. The Information Commissioner's Office (ICO) enforces these rules, and it has been stepping up enforcement significantly.
PECR implements the EU ePrivacy Directive in UK law. It requires that before you store or access information on a user's device (which includes setting cookies), you must provide clear and comprehensive information about what you are doing and obtain the user's consent.
The only exception is for cookies that are "strictly necessary" for the service the user has requested. A shopping cart cookie on an e-commerce site is strictly necessary. A Google Analytics cookie is not. A Facebook tracking pixel is not. These require informed consent before they are loaded.
The GDPR adds another layer: any personal data collected through cookies (and tracking cookies do collect personal data) must have a lawful basis for processing. For most tracking cookies, that lawful basis is consent. And under the GDPR, consent must be freely given, specific, informed, and unambiguous.
The ICO has moved beyond warnings. In recent years it has issued substantial fines and enforcement notices to organisations that failed to obtain proper cookie consent.
Between 2023 and 2025, the ICO issued fines to multiple companies for cookie consent failures. These cases shared common themes: cookies being set before the user interacted with a consent banner, "accept all" being presented as the only easy option, reject options being buried or requiring multiple clicks, and pre-ticked consent categories that users had to manually opt out of.
The maximum fine under PECR is £500,000. Under the GDPR, fines can reach £17.5 million or 4% of global annual turnover. While the ICO has not yet imposed the maximum for a cookie-only violation, the trajectory is clear: enforcement is increasing, and the regulator expects businesses to take this seriously.
Compliance is not complicated, but it requires attention to detail. Here is what the ICO expects:
After reviewing hundreds of UK websites, these are the most frequent compliance failures we see:
Consent walls — blocking access to the site entirely until the user accepts cookies. The ICO guidance is clear: you cannot make consent a condition of accessing your service unless cookies are strictly necessary for that service.
Necessary-only default — the correct approach is to load only strictly necessary cookies by default and let the user opt in to everything else. Many sites do the opposite: loading all cookies by default and requiring users to opt out.
Third-party iframes — embedded YouTube videos, Google Maps, and social media widgets set their own cookies. If these load before consent, you are in violation. Consider using click-to-load wrappers for embedded content.
If you are not sure whether your website is compliant, the first step is to find out what cookies your site actually sets. Many businesses are surprised to discover that their site loads tracking cookies, analytics scripts, and third-party pixels without a compliant consent mechanism.
A PulseShield cookie compliance audit scans your website for 20+ known tracking scripts and cookies, checks whether they load before consent, and tells you exactly what needs fixing. You get a professional report you can hand to your web developer or act on yourself.
The ICO has made its position clear: cookie consent is a compliance requirement, not a nice-to-have. With enforcement increasing and fines making headlines, there has never been a better time to check your site. Visit our pricing page for audit options starting at £29.
Run a cookie compliance audit and find out exactly what needs fixing. From £29.
Get a Compliance Audit