The UK Cookie Compliance Index · 1 reading since 25 August 2026 · updated 26 August 2026
The state of UK cookie compliance
A standing panel of 62 UK websites across 7 sectors, re-scanned against PECR and UK GDPR and tracked over time. Each is loaded on a clean browser from a UK vantage point, recording everything stored before the visitor clicks anything. This is the first reading; the series starts here and is re-run weekly.
Three findings
- Refusing is still harder than accepting. 31 of 62 sites let you accept cookies in one click and offer no equivalent way to refuse. The ICO has been explicit for years that refusing must be as easy as accepting, and wrote to the UK’s most-visited sites about exactly this.
- Almost nothing waits for consent. Only 3 of 62 sites loaded nothing that tracks before the visitor had any say. PECR reg. 6 requires consent before storage, not after.
- Refusing does not always work. On 16 sites, trackers kept firing after we clicked the reject button. That is worse than having no banner: the site offers a choice, the visitor exercises it, and the tracking happens anyway.
By sector
| Sector | Sites | Median score | Trend | One-click refuse | Clean before consent |
|---|---|---|---|---|---|
| Public sector | 8 | 87 | first reading | 75% | 25% |
| Health | 8 | 60 | first reading | 63% | 13% |
| Finance & insurance | 8 | 54 | first reading | 63% | 0% |
| Retail & e-commerce | 13 | 42 | first reading | 23% | 0% |
| Technology | 8 | 39 | first reading | 25% | 0% |
| Travel & transport | 8 | 27 | first reading | 75% | 0% |
| Media & publishing | 9 | 26 | first reading | 44% | 0% |
Sector predicts compliance far more than size does. The gap between the best and worst sector median is 61 points. The two sectors with the most to lose commercially from refusal — retail and technology — are the ones making it hardest.
What loads before consent
Share of sites contacting each, before any consent interaction. Consent platforms are excluded — they have to load first to show the banner.
| Google Tag Manager | 68% | |
| Google AdSense | 37% | |
| Google Analytics | 32% | |
| Google Ads (DoubleClick) | 23% | |
| New Relic | 19% | |
| Adobe Tag Manager | 15% | |
| go-mpulse.net | 13% | |
| Adobe Audience Manager | 10% | |
| 10% | ||
| Comscore | 10% | |
| dotmetrics.net | 10% | |
| optimizely.com | 8% |
Consent platforms in use
Which platform each site uses to ask, where one was identified.
| OneTrust | 40% | |
| Civic Cookie Control | 11% | |
| Sourcepoint | 6% | |
| Ensighten Manage Consent | 5% | |
| Shopify Consent Banner | 2% | |
| Usercentrics | 2% | |
| TrustArc | 2% | |
| Quantcast (InMobi) CMP | 2% | |
| No platform identified | 29% |
Method, and what this is not
Each site was loaded in headless Chrome from a UK vantage point — en-GB, Europe/London — on a clean profile with no history and no prior consent. Three passes: touching nothing, after clicking refuse, and after clicking accept on a fresh profile. On shops we also walked a short customer journey to the basket, because conversion tags fire on the interaction rather than the page view. Requests were matched against EasyPrivacy and EasyList.
- A convenience sample, not a survey. Sites were chosen by hand for recognisability, not sampled randomly or weighted by traffic. Read a sector median as a sense of the field, not a population parameter.
- The scoring weights are ours. Deterministic and fully explainable — score = 100 minus the sum of visible penalties — but no external standard says a missing reject control is worth 14 points rather than 20.
- One page load per reading. Sites vary by geography, A/B bucket and time. Re-scanning this same panel a day later, 22 sites had changed — which is why it is tracked as a series rather than published once.
- Two sites could not be assessed because they block automated visitors. They are absent, not clean.
- We publish sector aggregates only. Per-site results are not published.
- This is not legal advice, and a good score means the cookie layer looks right — not that an organisation is compliant.
Check your own site
Free, no signup, about a minute. You get your score, how you compare with your sector, and every tracker that fires before consent — named.
Run a free check