ICO cookie guidance: tracking that carries on after reject or withdrawal

The rule

UK-04 asks what happens after a visitor has made a choice. The rule that decides whether a cookie may be set at all is covered in UK-01. This check covers whether the site respects a refusal, and whether it stops when consent is taken back.

The two narrow exceptions in Schedule A1, for collecting statistics about how a service is used and for adapting how a page looks to the user’s preferences, each carry a further condition. The user must be given “a simple means of objecting, free of charge”. So even a cookie under one of those two exceptions has to stop when the visitor objects.

How enforcement has treated this is clearest in the ICO’s own letters. On 21 November 2024 it wrote to website operators that it had tested whether non-essential advertising cookies were placed “even if the user did not consent to such cookies”. Where a site offered a consent mechanism but placed the cookies despite the visitor choosing reject all, the ICO said the later processing was likely to lack a lawful basis under Article 6 of the UK GDPR, was therefore likely to infringe Article 5(1)(a), and might also infringe PECR regulation 6. It set a deadline of 10 January 2025 and said it planned to publish the names of organisations that did not act.

Penalties moved on 5 February 2026. The ICO’s commencement statement says it can now issue fines of up to 17.5 million pounds or 4% of global turnover under PECR. UK GDPR Article 83(5)(a) already placed the conditions for consent, including Article 7, in that upper tier.

What PeekWell checks and how

UK-04 asks the same question as EU-02: after the visitor clicked Reject all, did anything non-essential still run? The method is the same reject-and-compare engine with the UK ruleset on top, so this section stays short.

The scan opens a public page in a fresh browser context, finds the Reject all button using common consent-tool selectors and label heuristics, and clicks it. It records every request and cookie that follows. A second clean visit clicks Accept all and records the same things. Any tracker from the maintained signature list that appears in the reject visit is a finding, and the exact requests are logged as evidence. Code makes that decision. A language model may help read an unusual label or write the explanation, and never decides that a tracker fired.

The title of this check says withdrawn consent, and the scan’s test is narrower. It tests a refusal on a first visit. It does not accept, then withdraw through a settings link, then record again, so it cannot say whether tracking stops after a later withdrawal. That sequence is worth checking by hand.

The scan has limits, and the report says so. It sees the public pages it visited and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. The button is found with common consent-tool selectors and label heuristics, so an unusual banner may not be recognised. Collection on a server or inside an app is outside a browser visit. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

Why it matters for a company

The ICO has made this a target. Its December 2025 release says it assessed whether any non-essential advertising cookies were placed even though a user had not consented, across the UK’s top 1,000 websites. It reports that 979 sites met its checks at the time of the latest test and 21 did not. Of the 979, 415 passed without intervention and 564 improved after initially failing; the other 21 did not meet its checks, and 17 received preliminary enforcement notices. The ICO says: “We are pleased that this threat of enforcement action has led to nearly all of the websites concerned bringing themselves into compliance.”

The ICO’s December 2025 release names no sites. A named outcome on cookies is the reprimand of Bonne Terre Limited, trading as Sky Betting and Gaming, on 17 September 2024. The ICO said the company’s advertising cookies and data sharing began before visitors could accept or reject, from 10 January to 3 March 2023, and that it changed its setup in March 2023 so people could reject before data was shared. That case is about the order of events. It still shows how the ICO reads the sequence: a choice offered after tracking starts is not treated as a choice.

The risk has changed since the ICO’s first letters. The ICO’s commencement statement says it can now issue fines of up to 17.5 million pounds or 4% of global turnover under PECR.

Smaller companies and larger companies

PECR and Article 7(3) have no size threshold. The ICO’s letters went to the most visited sites first, and its December 2025 results are all about the largest 1,000, but nothing in the rule exempts a smaller operator.

In a small company the banner usually comes from a plugin or a website builder’s built-in tool. The plugin records the choice but only controls the tags it knows about. A script pasted into the theme, a chat widget or an embedded video keeps running after reject. Nobody tests it, because the banner looks right and the button clicks.

In a larger company the work spreads over teams. A tag manager holds many tags, a release changes which fire, and the choice has to reach every domain and app. Withdrawal is harder than refusal at that scale, because tags that started after an earlier yes must be stopped and third parties told, as the ICO’s guidance asks.

How to fix it

1. Reproduce it. Open your site in a private window with the network tab open. Click Reject all, reload two or three pages, and write down every third-party request and cookie that appears afterwards.
2. Find what sits outside the banner tool. Scripts pasted into the theme, plugins that add their own tracking, embedded videos and chat widgets ignore the banner unless they are put behind it. Move them under the consent tool’s categories or remove them.
3. Start tags only from the accept event. In the tag manager, give each non-essential tag a trigger tied to the consent tool’s accept event, and leave a reject with none. Check that a saved Reject is honoured on the next page.
4. Add a way back. Put a permanent Cookie settings link in the footer. When a visitor withdraws, stop the tags, delete the cookies you set, and tell any vendor that needs to know, as the ICO’s guidance says.
5. Check the exceptions. If you rely on the statistics exception for analytics, check there is a simple, free way for visitors to object and that the objection stops the tag.
6. Re-scan. Clear cookies and storage, click Reject all, and run a scan again. Then accept, withdraw through the settings link, and check by hand that the requests stop.

Whether a particular setup satisfies the ICO is a question for your legal adviser, and Peeky reports only what it sees.