UK cookie consent and online tracking statistics — how many websites pass the ICO's cookie checks, how many businesses set cookies, how UK adults respond to "consent or pay", and how the Data (Use and Access) Act 2025 has rewritten the PECR cookie rules, all sourced from official data.
Cookie banners are the most visible piece of data protection law that ordinary internet users meet every day, yet reliable numbers on them are scattered. This page pulls the key figures together from four official sources: the Information Commissioner's Office (ICO) cookie-compliance sweep of the UK's top 1,000 websites, the ICO's Public Attitudes to Information Rights (PAIR) Survey 2025, the government's UK Business Data Survey 2026, and the Data (Use and Access) Act 2025, whose PECR cookie provisions came into force on 5 February 2026.
Key facts and figures
- 99% of the UK’s top 1,000 websites met the ICO’s cookie checks at their most recent test, according to its Annual Report 2025/26.
- 979 of the top 1,000 websites passed in the earlier December 2025 snapshot; the detailed breakdown below relates to that date.
- 40 million UK internet users over the age of 14 — an estimated 80% — gained greater control over tracking through the ICO programme (December 2025 estimate).
- 3,906 cookie concerns were submitted through the ICO’s online reporting tool in 2025/26, compared with 4,515 in 2024/25.
- 12% of UK businesses handling digitised personal data and operating a website said they acquired personal data through cookies (UK Business Data Survey 2026).
- 37% of the UK online adult population said they typically accepted free access with personalised ads in the 2025 PAIR survey; 7% said they paid.
- £17.5 million or 4% of worldwide annual turnover, whichever is higher, is the maximum PECR fine from 5 February 2026.
- 3 new categories of cookie became exempt from prior consent on 5 February 2026 under the DUAA 2025.
Checked on 15 October 2026. The latest annual headline comes from the ICO’s 2025/26 report; the detailed website breakdown remains the published December 2025 snapshot. Survey figures have their own populations and collection periods.
How many UK websites comply with the ICO's cookie rules?
The ICO’s Annual Report 2025/26 says 99% of the UK’s top 1,000 websites met its cookie checks at the time of their most recent test. The earlier December 2025 update gave an exact count of 979. These checks focused on advertising-cookie choice and behaviour; passing them is not a certification of every aspect of a website’s data protection compliance.
The December 2025 breakdown showed 415 sites passing without intervention and 564 improving following ICO engagement. Seventeen preliminary enforcement notices had been issued and 21 sites were still failing at that point. The table preserves that dated breakdown rather than implying these are the latest outstanding cases.
| Top-1,000 sweep: December 2025 snapshot | Number of sites | Period |
|---|---|---|
| Passed compliance checks | 979 | December 2025 |
| — of which, passed with no ICO intervention | 415 | December 2025 |
| — of which, improved after ICO engagement | 564 | December 2025 |
| Still failing at that test | 21 | December 2025 |
| Preliminary enforcement notices issued | 17 | By December 2025 |
The programme expanded from the most-used websites to the top 1,000. Its tests examined cookies before a choice, whether rejection was as easy as acceptance, and cookies after refusal. Periodic retesting is needed because website behaviour can change.
How did the ICO's cookie sweep scale up?
The January 2025 expansion followed assessments of the top 200 UK websites, with concerns communicated to 134 organisations. This was a targeted review of popular sites, not a representative survey of all UK websites.
The ICO also worked with consent-management platforms supplying nearly 80% of the top 500 websites. Its December 2025 estimate was that the programme gave about 40 million UK internet users over the age of 14 greater control over personalised-advertising tracking.
What were users actually complaining about?
The ICO received 3,906 cookie concerns through its online reporting tool in 2025/26, down from 4,515 in 2024/25. These are reports to the regulator, not a count of unique websites, breaches or affected people.
Earlier work illustrates the problems being addressed. In February 2024, the ICO said it had identified 53 of the top 100 websites as potentially having non-compliant cookie banners. Thirty-eight had changed their banners and four had committed to do so. The regulator’s central expectation was that rejecting non-essential cookies should be as easy as accepting them.
How many UK businesses use cookies to collect data?
The UK Business Data Survey 2026 found that 12% of businesses handling digitised personal data and operating a website said they acquired personal data using cookies. This is a self-reported data-acquisition measure, not the percentage of all UK websites using any kind of cookie. Fieldwork ran from October 2025 to January 2026.
The size and sector comparison below uses a broader measure: acquiring personal data through cookies or app-based tracking, among businesses handling digitised personal data. It is 10% for sole traders, 13% for micro-businesses and 40% for large businesses; information and communication records 35%. These figures should not be substituted for the website-only cookie measure above.
| Business group | Acquire personal data via cookies or app tracking | Period |
|---|---|---|
| Sole traders | 10% | 2025–26 |
| Micro businesses | 13% | 2025–26 |
| Small businesses | 16% | 2025–26 |
| Medium businesses | 21% | 2025–26 |
| Large businesses | 40% | 2025–26 |
| Information and communication | 35% | 2025–26 |
PECR applies to storage and access technologies whether or not the information is personal data. Businesses of any size should check what their technologies do and whether consent or a specific exception applies; survey adoption rates do not measure compliance risk.
How do UK adults respond to "consent or pay"?
In the ICO’s 2025 PAIR survey, 37% of the UK online adult population said they typically accepted free access with personalised advertising when faced with a consent-or-pay choice; 19% said they left and 7% said they paid. The online survey involved 8,019 adults. These are reported responses to the model, not observed acceptance rates for all cookie banners.
Among the same online adult population, 42% said they had some understanding but were not entirely sure what consent or pay meant. Nineteen per cent felt informed, 19% felt in control and 24% felt sceptical. Responses describe different attitudes and need not sum to 100%; 37% accepting the free option is not a majority.
| UK online adult response to consent or pay | Share | Period |
|---|---|---|
| Accept free access with personalised ads & cookies | 37% | 2025 |
| Leave the site | 19% | 2025 |
| Pay to remove personalised cookies | 7% | 2025 |
| Have some understanding but are unsure what it means | 42% | 2025 |
| Feel informed / feel in control | 19% / 19% | 2025 |
| Feel sceptical | 24% | 2025 |
What did the DUAA 2025 change for cookies?
From 5 February 2026, PECR added exceptions for specified statistical purposes, appearance or functionality preferences, and emergency assistance. Each has statutory conditions. The statistical and preference exceptions require clear information and a simple, free way to object. The emergency exception has different conditions and is not a general exemption for location tracking. Existing communication and strictly necessary exceptions also remain.
The maximum PECR penalty is now £17.5 million or 4% of worldwide annual turnover, whichever is higher, compared with the former £500,000 cap. This is a legal ceiling, not a standard penalty. The ICO considers the facts of each case. Our cookie consent guide explains the practical rules and our fines statistics page covers enforcement amounts.
One boundary worth stating plainly: PECR also governs nuisance calls, spam texts and marketing emails, but those enforcement volumes are covered separately and are not part of this cookies-and-tracking page.
Frequently asked questions
How many UK websites comply with ICO cookie rules?
The ICO’s Annual Report 2025/26 reports that 99% of the top 1,000 websites met its cookie checks at the latest test. The earlier December 2025 count was 979, including 415 passing without intervention and 564 improving after engagement. These are targeted advertising-cookie checks, not a whole-site compliance certificate.
What percentage of UK businesses use cookies to collect personal data?
The UK Business Data Survey 2026 reports 12% among businesses handling digitised personal data and operating a website. Its size breakdown uses cookies or app-based tracking among businesses handling digitised personal data: 10% of sole traders, 13% of micro-businesses and 40% of large businesses.
What are the new UK cookie rules under the Data (Use and Access) Act 2025?
From 5 February 2026, three additional PECR exceptions cover specified statistical purposes, appearance or functionality preferences, and emergency assistance. Conditions differ: the first two require clear information and a simple, free objection mechanism. The maximum PECR penalty also increased to £17.5 million or 4% of worldwide annual turnover, whichever is higher.
What is the maximum fine for breaching UK cookie (PECR) rules?
The higher PECR maximum is £17.5 million or 4% of an undertaking’s worldwide annual turnover, whichever is higher, from 5 February 2026. The fixed sterling cap is 35 times the previous £500,000 maximum. Conduct dates and transitional rules matter for individual cases.
Do most people accept cookies when asked?
The 2025 PAIR survey found 37% of the UK online adult population typically accepted free access with personalised advertising in a consent-or-pay scenario, 19% left and 7% paid. This is not a measure of all cookie-banner decisions or evidence that most people accept tracking.
How many cookie concerns does the ICO receive?
The ICO’s online reporting tool received 3,906 cookie concerns in 2025/26, compared with 4,515 in 2024/25. Reports can concern the same organisation and do not establish a legal breach on their own.
Related guides
- GDPR cookie consent in the UK: rules after the DUAA 2025
- GDPR Fines UK: ICO Fine & Enforcement Statistics
- ICO Complaints Statistics UK: Volumes, Outcomes & Response Times
- AI and Data Privacy Statistics UK
- GDPR consent and lawful basis: what UK organisations need to know
- What is GDPR? A UK guide to the General Data Protection Regulation
Sources & references
- ICO — Annual Report and Financial Statements 2025/26
- ICO — cookie compliance update, December 2025
- ICO — expansion of the cookie programme, January 2025
- ICO — initial top-100 cookie review, February 2024
- ICO — Public Attitudes to Information Rights Survey 2025
- DSIT — UK Business Data Survey 2026
- ICO — exceptions to consent for storage and access technologies
- ICO — PECR changes from 5 February 2026
Cookie banners are only the visible edge of PECR and UK GDPR — make sure your team understands the whole picture with accredited online training.
Explore the GDPR & Data Protection Course →
Mark writes about data protection, workplace compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.