ICO top 1,000 cookie review: the three tests UK sites must pass

Rather than pick one site, the ICO tested the 1,000 most visited UK websites against three questions: were advertising cookies stored before the visitor chose, was rejecting as easy as accepting, and were advertising cookies set without consent. Sites that failed got letters, and some got preliminary enforcement notices.

These are figures the ICO published about its own programme. They are not findings against any named site.

• In January 2025 the ICO had assessed the top 200 sites and contacted 134 of them about concerns.
• By December 2025, 979 of the 1,000 met its standards. 415 passed without intervention and 564 fixed problems after ICO letters or investigations. 17 had received preliminary enforcement notices and 21 were still failing.
• In April 2026 the ICO said 992 of the 1,000 passed, and published its final guidance on storage and access technologies.
• An FOI response of 29 May 2026 says 20 preliminary enforcement notices were issued, all in 2025. The ICO withheld them under section 31(1)(g) of the Freedom of Information Act.
• The ICO also worked with consent platform vendors, naming OneTrust, Usercentrics, Sourcepoint and InMobi, which changed their UK defaults.

Inth’s technical interpretation: all three tests can be run from a clean browser. The first and third are about what the network and cookie jar show in each consent state. The second is about the banner design itself.

1. 23 January 2025ICO announces the review; top 200 assessed, 134 contacted
2. 4 December 2025Update: 979 of 1,000 pass; 17 preliminary enforcement notices
3. 5 February 2026New PECR fining powers in the Data (Use and Access) Act 2025 come into force
4. 29 April 2026Update: 992 of 1,000 pass; final storage and access guidance published
5. 29 May 2026FOI response: 20 preliminary notices in total, withheld

No fines have been published. A preliminary enforcement notice is a warning of intended action, not a final decision. The ICO says it will keep testing sites periodically.

The fining position has changed. Commencement regulations brought section 115 and Schedule 13 of the Data (Use and Access) Act 2025 into force on 5 February 2026. Schedule 13 applies the Data Protection Act 2018 penalty regime to PECR and puts a breach of regulation 6, the cookie rule, under the "higher maximum amount" in section 157, the same cap used for the most serious UK GDPR breaches. Regulation 11 of the commencement regulations keeps the old regime for breaches before 5 February 2026.

No published fines. For the 564 sites that changed after contact, the cost was the fix and the regulator’s attention.

These are the UK regulator’s own pass or fail tests, so they work as a checklist. Most of the sites that failed fixed things after a letter, which suggests the problems were configuration, not policy. With higher PECR fines now in force, the next round may end differently.

• Website audit records what loaded before a choice and after Reject, with the page, time, region and consent state. That covers the ICO’s first and third tests.
• Consent banner: Accept and Reject get the same weight by default, and under the EU opt-in policy optional tags wait until the visitor chooses.
• Code audit flags a pull request that adds an advertising tag, ad-cookie write or storage write outside the consent check.

In the repository

• Check your consent platform’s UK settings; several vendors changed their defaults during the review.

In the browser and network

• Run the three ICO tests from a clean UK browser profile: before any choice, after Reject and after Accept.
• Compare the effort to reject with the effort to accept on the first layer.

With the people responsible

• Ask who would receive an ICO letter and how fast a fix could ship.

• ICO announcement, January 2025
• ICO update, December 2025
• ICO update and final guidance, April 2026
• ICO FOI response IC-509019 (PDF)
• ICO guidance on storage and access technologies
• Data (Use and Access) Act 2025, Schedule 13
• The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026

Source review: 20 October 2026. This page describes a regulator programme as the ICO reported it. It names no site and does not audit any site’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: Sky Betting and Gaming, German regulator website sweeps, GDPR and ePrivacy cookie rules