ICO cookie guidance: reject as easy as accept

The rule

In the UK, cookies are governed by two instruments at once: the Privacy and Electronic Communications Regulations 2003 (PECR) for the storing and reading, and the UK GDPR for the consent that unlocks it.

Schedule A1 sets the exceptions. Storage that is strictly necessary for a service the visitor asked for is one. Collecting statistics to improve the service, and adapting the site’s appearance to the visitor’s preferences, are two others, and each is conditional on clear information and a simple, free means of objecting. Advertising cookies fit none of these, so consent is still the route for them, and that is where the shape of the banner matters.

The wording of Schedule A1 now in force asks for consent after clear and comprehensive information about the purpose, and does not itself refer to the UK GDPR. The ICO’s letters pre-date that text, so check its current guidance on whether it has restated the link.

The letters spell out the test the ICO applied. It asked whether users could “reject non-essential advertising cookies as easily as they can accept them”, and where a banner “contains a button allowing immediate consent to cookies” but does not give “similar means to refuse the storage of these cookies as easily or in one click”, the ICO was concerned that consent given on the first layer could not be regarded as freely given. It asked for a way of refusing at the same point consent is sought, “for example, by providing a button to ‘reject all’ or another equivalent and non-ambiguous solution that is equally prominent as the option to accept cookies.”

Penalties changed this year. Schedule 13 of the Data (Use and Access) Act 2025, in force from 5 February 2026, applies the provisions of the Data Protection Act 2018 on information notices, assessment notices, enforcement notices and penalties to PECR, and provides that the maximum penalty is the higher maximum amount.

What PeekWell checks and how

UK-02 asks one question: on the banner’s top layer, is rejecting non-essential cookies about as easy as accepting them? The scan answers it from the rendered page, in the same way as the EU check, with a UK rule set. EU-03 describes the engine in full.

The scan opens a public page in a fresh browser context with no saved choices. It finds the banner and lists the buttons and links on the top layer: whether there is an Accept all, whether there is a Reject all or an equivalent at the same level, and how the two compare in size and the number of clicks each takes. It then clicks the banner’s own controls, as a visitor could, and counts the steps needed to refuse everything non-essential and to accept. The click count is measured by code. Prominence is reported as measurements, not as a conclusion, because how much difference counts is for the reader and the ICO to weigh.

A language model may help only where a button label is ambiguous. It never decides the click count. The finding states what was seen, for example “Accept all on the top layer; Reject all after one further click on Manage preferences”, and not that the banner breaks a rule.

The scan has limits, and the report says so. It sees the public pages it visited and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. It tests the banner it was shown on the visit, so a banner that varies by visitor or device may look different elsewhere. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

Why it matters for a company

The ICO has made this one of its most visible cookie tests. In November 2023 it wrote to the operators of websites in its top 100 by UK user time after assessing their banners on 23 October 2023. The letter named three tests: advertising cookies before consent, rejection as easy as acceptance, and cookies placed despite a refusal. It asked for changes within one month and said operators who did not address its concerns could be named or face enforcement or penalty notices. A second round followed on 21 November 2024, covering a further 100 sites, with a deadline of 10 January 2025 and a request to say which consent management platform each used.

The work later widened to the top 1,000 sites. On 4 December 2025 the ICO reported that 979 of the 1,000 had met its testing criteria at their latest test. Of those, 415 passed without intervention and 564 improved after an initial failure. It issued preliminary enforcement notices in 17 cases and was continuing against 21 sites that had not passed. It said the threat of enforcement had led to nearly all of the sites concerned coming into line. No operator was named and no fine was published in that update.

The practical consequences are of three kinds. The ICO tests the same screen any visitor sees, so it needs no inside access. Consent obtained through a lopsided banner is consent the ICO said it was concerned could not be regarded as freely given, which colours what is collected afterwards. And since February 2026 PECR penalties for storing or accessing information on a device (regulation 6) are tied to the higher maximum amount.

Smaller companies and larger companies

PECR and the UK GDPR have no size threshold for this rule, but the ICO’s reviews were aimed at the biggest sites. No decision against a smaller company on banner asymmetry could be confirmed at the ICO’s own site, and the reviews are not a sign that smaller sites are outside the rule. The same screen is judged the same way.

In a smaller company the banner usually comes from a plugin or a site builder. The default has a bright Accept all and a plain Settings link, and the Reject all button is a setting somebody has to switch on. The fix is a setting, not a rebuild.

In a larger company the banner is often a managed product, run by a consent management platform and changed by a central team. Variants get tested for opt-in rates, regional rules are layered on top, and a redesign can slip a second click back in. The ICO’s 2024 letter asked each operator to say which platform it used, and a single configuration on a shared platform can apply to many pages at once.

How to fix it

The aim is a top layer where saying yes and saying no each take one action. These steps fit most consent tools.

1. Look at the top layer as a visitor. Open the site in a private window and write down the buttons. Count the clicks to accept everything and to reject everything non-essential. A difference is what a scan will report.
2. Put Reject all beside Accept all. Most platforms have a setting for a reject button on the first layer. Switch it on and use the same kind of control for both, the same size, in the same row.
3. Use plain labels. Say Accept all and Reject all. Avoid labels such as Continue or Got it, and avoid a refusal that exists only as a link in a paragraph.
4. Match colour, weight and contrast. Both buttons should be readable against their background. Matching them removes the argument about which one stands out.
5. Leave non-essential categories off by default. In the settings view, toggles for advertising and similar categories start off. Pre-ticked boxes do not count as a positive action.
6. Make a refusal stick. After Reject all, nothing non-essential should be stored or set. The ICO’s letters list cookies placed despite a refusal as a separate concern.
7. Re-scan. Clear cookies and storage, reload, and run a scan again. The finding should show the same number of clicks to reject and to accept.

If you use only cookies that Schedule A1 exempts, such as those strictly necessary for the service, you may not need a consent banner for them at all. Whether a given set of cookies falls inside an exception is a question for your legal adviser. Peeky reports what it saw.