THE RULE
Ask first, then set
The ICO says sites must get your consent for cookies that are not strictly necessary, and cannot set them before you have agreed.
Check a bannerCookie banners are asking for your permission.
UK rules say most cookies that are not essential to the page you asked for need your consent first, and that consent must be a clear, deliberate choice. Here is what that means when the banner pops up.
- Ask before setting
- Reject as easy as accept
- No pre-ticked boxes
- A choice, not a trick
THE SHORT ANSWER
Only you can
say yes.
Cookies that a site merely finds useful need your consent.
Cookies essential to what you asked for do not.
THE BUTTONS
Reject should be easy
In its review of the UK's top 1,000 websites the ICO tested whether rejecting advertising cookies was as easy as accepting them.
See the numbers
CHANGE YOUR MIND
A yes can be taken back
UK GDPR consent must be easy to withdraw at any time, and your browser can also delete or block cookies.
How to do it
FOUR HABITS TO TRY
Answer the banner,
on purpose.
None of this needs special software. It is about reading the first screen, using the buttons that should be there, and knowing where your browser settings live.
Look for the Reject button
A fair banner lets you refuse as easily as you accept. If refusing takes many more clicks, the ICO has said that falls short.
Untick what you did not choose
A box that arrives ticked is not your consent. Open the settings and switch off what you did not pick.
Change your mind later
Consent must be easy to withdraw. Most sites keep a cookie settings link, often at the foot of the page.
Use your browser controls
The ICO notes that browsers can delete or block cookies, block third-party cookies, or clear them when you close the browser.
TWO NUMBERS WORTH KNOWING
Banner design
changes our answers.
One figure from the regulator,
one from a study of how banners steer us.
979 of 1,000
Sites meeting the ICO's cookie checks
In December 2025 the ICO said 979 of the UK's top 1,000 websites met its checks at their latest test. 415 passed without help; 564 fixed their banners after the ICO stepped in.
TOP 1,000 UK SITES · ICO
22–23 points
Extra consent when Reject is hidden
A study of consent pop-ups found that removing the opt-out button from the first page raised consent by 22 to 23 percentage points. Only 11.8% of the UK banners it scraped met its minimal legal requirements.
BANNER DESIGN · CHI 2020 STUDY
The ICO says its cookie guidance is under review after the Data (Use and Access) Act, so some details may change. Check the ICO site for the latest version.
A QUICK BANNER CHECK
What did the
site just do?
Pick something a website does and see what ICO guidance says about it. The bar shows how strongly the guidance objects.
Based on ICO guidance on cookies and on valid consent. General information, not legal advice.
WHAT A COOKIE IS
A small file,
a big question.
The ICO describes a cookie as a small file of letters and numbers downloaded to your device when you visit a website. It can remember your preferences, hold what is in your basket or count visitors.
The rules sit in the Privacy and Electronic Communications Regulations 2003 (PECR) and also cover similar technologies such as device fingerprinting. If a site ignores your choice, the ICO asks people to report cookie complaints.
In conversation
Questions people ask
Do I have to accept cookies to use a website?
Not for cookies that are only useful to the site. The ICO says sites need your consent for cookies that are not strictly necessary, and the UK GDPR says people must be able to refuse consent without detriment.
Which cookies can be set without asking?
Cookies strictly necessary for a service you asked for, such as remembering your online basket or keeping online banking secure. Cookies that are only helpful or convenient still need consent.
Does carrying on browsing count as saying yes?
No. The ICO says consent must be a clear positive action and more than simply continuing to use the website.
Can I change my mind after clicking Accept?
Yes. UK GDPR consent can be withdrawn at any time and should be easy to withdraw. You can also delete cookies in your browser settings.
What if a site ignores my choice?
The ICO asks people to report cookie complaints through its website. It says it uses them to see how organisations are complying with the cookie rules.
Sources
Each figure on this page comes from the sources below.
- ICO: Cookies (for the public)
- ICO: Guide to PECR, cookies and similar technologies
- ICO: What is valid consent?
- ICO news: ICO action secures increased cookie compliance (4 December 2025)
- ICO news: ICO takes action to tackle cookie compliance across the UK's top 1,000 websites (23 January 2025)
- Nouwens et al. (2020), Dark Patterns after the GDPR, CHI '20 (arXiv)