Commissioner warns UK’s top websites to make cookie changes

• Regulator makes clear it should be as easy to “Reject All” cookies as it is to “Accept All” 

The Information Commissioner has warned some of the UK’s top websites they face enforcement action if they do not make changes to comply with data protection law. 

Some websites do not give users fair choices over whether or not to be tracked for personalised advertising. The ICO has previously issued clear guidance that organisations must make it as easy for users to “Reject All” advertising cookies as it is to “Accept All”. Websites can still display adverts when users reject all tracking, but must not tailor these to the person browsing. 

We have now written to companies running many of the UK’s most visited websites setting out our concerns and giving them 30 days to ensure their websites comply with the law.  

Stephen Almond, ICO Executive Director of Regulatory Risk, said: 

“We’ve all been surprised to see adverts online that seem designed specifically for us – an ad for a hotel when you’ve just booked a flight abroad, for instance. Our research shows that many people are concerned about companies using their personal information to target them with ads without their consent. 

“Gambling addicts may be targeted with betting offers based on their browsing record, women may be targeted with distressing baby adverts shortly after miscarriage and someone exploring their sexuality may be presented with ads that disclose their sexual orientation.  

“Many of the biggest websites have got this right. We’re giving companies who haven’t managed that yet a clear choice: make the changes now, or face the consequences.” 

The ICO will provide an update on this work in January, including details of companies that have not addressed our concerns. The action is part of our broader work to ensure that people’s rights are upheld by the online advertising industry.