Half of UK websites set cookies before anyone consents

The key findings

Across the 49 websites (most recent scan per domain, May–September 2026), our automated audit found:

• 49% set non-essential or unclassifiable cookies before any consent was given — the core breach of PECR Regulation 6, which requires consent before a cookie is placed, not after.
• 40% fired third-party tracking requests before showing a consent option (of the 30 sites where our network capture ran) — Google Analytics, Tag Manager, Hotjar and advertising pixels loading while the banner was still rendering.
• 29% had no cookie consent banner at all.
• 63% of sites where we could click "Reject" kept non-essential cookies anyway (10 of 16 testable sites — a small sample, but a striking one). The visitor said no; the cookies stayed.
• 50% failed WCAG AA accessibility checks (24 of 48 completed scans) — missing alt text, indistinguishable links and unlabelled buttons being the recurring offenders.
• The average compliance score was 61 out of 100; 37% of sites scored below 50, while 43% scored 80 or above.

Banner theatre: the compliance gap in one number

The most consistent pattern in the data is what we've come to call banner theatre: a consent banner is present, looks the part, and changes nothing. Of the sites that showed a banner, roughly one in three still set tracking cookies before the visitor could touch it. The banner asks a question the site has already answered on the visitor's behalf.

The rejection test makes the theatre explicit. Where our scanner could find and click a genuine reject control, 63% of sites carried on holding non-essential cookies afterwards. Consent management platforms were usually installed — the tag-firing rules behind them simply were never wired up. The CMP collects the choice; nothing reads it.

The third with no banner at all

29% of scanned sites showed no consent banner. That is not automatically a breach — a site setting only strictly necessary cookies needs no banner, and the cleanest fix we recommend to small businesses is often to remove the analytics nobody looks at rather than add a banner for it. But in our data, most bannerless sites were not cookie-free: they simply tracked without asking. Only a handful genuinely ran clean.

The other half of compliance nobody scans for

Half the sites failed WCAG AA automated checks. Accessibility rarely makes the compliance conversation for private-sector SMEs, but the Equality Act 2010 applies regardless of company size, and the failures we found are the boring, fixable kind: images without alt text (payment-method icon rows are a serial offender), links distinguishable only by colour, and icon buttons with no accessible name. None of these need a specialist — they need an afternoon.

Methodology, honestly stated

The dataset is every completed scan by our public UK compliance scanner between May and September 2026: 116 scans across 49 unique domains, counting only each domain's most recent result. The scanner loads each site in a real browser, records every cookie and network request before any interaction, locates the consent banner (visually, so shadow-DOM banners count), attempts a genuine reject click, and re-captures cookies afterwards. Accessibility findings come from axe-core run against WCAG 2.1 AA.

Caveats: the sample is self-selected — sites people chose to scan, plus domains we tested during development, including some large household names — so it is not a random sample of UK small businesses. Sub-checks have smaller denominators where a site's structure made a test impossible (you can't test the reject button on a site with no banner). We publish percentages, not names. And an automated scan is evidence, not a legal ruling.

If you run a UK website

Three checks cover most of what we found. Does anything load before the banner is answered? Open your site in a private window with the network tab open — analytics requests before your first click are the breach the ICO's cookie sweeps look for. Does reject actually work? Click it, then look at your cookie jar. And can a screen reader use your consent banner at all? If any of those answers surprise you, the free scan will show you the specifics in about two minutes, and the cookie banner checker tests the banner behaviour on its own.

Journalists and researchers: you're welcome to cite these figures with a link to this page. For methodology questions or a breakdown we haven't published, get in touch — the dataset grows with every scan, and we plan to re-run this analysis as it does.