The site makes "Accept All" obvious and hides the rejection option three screens deep. UK privacy rules do not treat scrolling, silence or a pre-ticked choice as valid consent for non-essential cookies.
Continuing to Browse Is Not Consent
The ICO's current guidance states that consent for non-exempt storage and access technologies must involve an unambiguous positive action. Simply continuing to use a website is not enough.
Non-essential cookies and similar technologies generally cannot be set before the user has given valid consent under PECR.
"Reject All" Should Be as Easy as "Accept All"
The ICO expects consent mechanisms to make refusal as easy as acceptance. Its current practical guidance gives equally prominent "accept all" and "reject all", or an equivalent non-ambiguous alternative, as the compliant model.
This does not mean the buttons must literally be identical colours. The legal and regulatory point is that the options should be equally prominent and that the interface must not nudge users toward acceptance by making refusal materially harder.
Pre-Ticked Boxes and Inactivity Are Not Valid Opt-In Consent
The ICO says consent requires clear affirmative action. Silence, inactivity, pre-ticked boxes, opt-out boxes and blanket acceptance of terms and conditions cannot be relied upon as valid consent where consent is the required legal basis.
Scrolling through an article, clicking away a banner without choosing a consent option, or simply remaining on a webpage therefore should not be treated as consent to non-essential tracking.
What About "Consent or Pay"?
Some publishers are experimenting with models that offer personalised advertising or a paid alternative. The ICO has been considering the data-protection implications of "consent or pay" models. The existence of such models means you should not reduce every paid alternative to "illegal cookie wall" without examining the specific design and legal basis.
Audit a Cookie Banner Like Evidence, Not Like a Feeling
- Screenshot the first-layer banner.
- Record whether reject is available immediately.
- Record how many clicks are required to refuse non-essential cookies.
- Capture the visual prominence of the choices.
- Check whether non-essential cookies are already present before consent.
- Reject them and test whether they actually stay off.
- Save the privacy/cookie policy and date.
The ICO Has Already Taken Enforcement-Style Action on Cookie Consent
In its 2024 intervention involving Sky Betting and Gaming, the ICO said that websites needed a meaningful choice over advertising cookies and highlighted the importance of making "accept all" and "reject all" equally prominent where rejection is offered.
The ICO has also written to organisations where non-essential advertising cookies were placed despite a user selecting rejection, warning that this can breach PECR and UK GDPR.
How to Complain
Start by preserving the evidence and, where appropriate, contact the website operator. If you believe its use of cookies or similar technologies breaches PECR or data-protection law, you can report the concern to the ICO.
A strong complaint identifies what technology was used, what the banner presented, what choice you made and what the website did afterwards.
What This Means Practically
- Scrolling is not valid consent for non-essential cookies.
- Pre-ticked or default opt-in choices are not valid consent where consent is required.
- Reject should be as easy and prominent as accept.
- "Same colour" is not the legal test; equal prominence and genuine choice are.
- Test what cookies are actually set after rejection.
Related Kibbo Tools
Sources
- ICO — Cookies and similar technologies. ico.org.uk
- ICO — Managing consent in practice, current guidance. ico.org.uk
- ICO — Action taken against Sky Betting and Gaming for cookies without consent, September 2024. ico.org.uk