The Impact of ICO’s Enforcement Action on Cookie Consent Compliance and Online Advertising

The Information Commissioner’s Office (ICO) has issued a warning to some of the UK’s most visited websites regarding their cookie consent mechanisms. Personalised advertising, which tailors online adverts to specific users based on their online behavior, requires consent to place non-essential cookies on a user’s device.

On 15 November 2023, the ICO sent letters to top websites, stating that enforcement action would be taken if changes were not made to comply with data protection law. The ICO found that over half of the websites sampled were not compliant, as they did not provide users with a fair choice to reject tracking by non-essential cookies for targeted advertising.

Stephen Almond, the ICO’s Executive Director of Regulatory Risk, expressed concern about companies using personal information for targeted ads without consent. The ICO’s guidance emphasized the need for an equal prominence “reject all” option alongside an “accept all” option in cookie consent banners.

The impact on content providers, especially in the news publishing sector, is significant. Publishers must offer users a genuine choice to accept or reject non-essential cookies, which could affect revenue from programmatic advertising. The ICO’s enforcement actions signal a change in approach, with potential consequences for companies that do not comply with cookie consent requirements.

Overall, the ICO’s focus on cookie consent compliance is expected to expand to other websites in the coming months. This development underscores the importance of data protection and privacy in the online advertising industry.