Key Takeaways
- UK websites that drop cookies without consent are in breach of the Privacy and Electronic Communications Regulations (PECR) and UK GDPR, exposing themselves to significant penalties.
- Websites must obtain clear and informed consent from users before placing most cookies, with “strictly necessary” cookies being the main exemption.
- Failing to comply with cookie consent rules may lead to ICO investigations, fines, and reputational damage for businesses.
- Consent must be given by a clear positive action, such as clicking “accept”. Pre-ticked boxes and implied consent do not meet legal standards in England and Wales.
- Illegal cookie activity should not be ignored. Failure to address non-compliance can trigger enforcement action and potential legal claims by affected users.
- Anyone who believes a website has dropped cookies without valid consent may complain to the Information Commissioner’s Office and seek legal advice.
- Businesses should regularly review their cookie banners and policies to align with the latest compliance requirements, especially after ICO updates and the new Data (Use and Access) Act.
- If a website drops cookies without your consent, legal remedies may be available, including claims for breach of data protection law.
- Website owners who promptly address non-compliance can avoid large fines and protect both their business reputation and customer trust.
If you need legal support regarding cookies or consent issues, book a free consultation with our team.
When Are UK Websites Illegally Dropping Cookies Without Consent?
Many UK websites continue to place tracking cookies on users’ devices without proper consent. The law in England and Wales, as explained by the ICO, is clear: placing cookies or similar technologies without a user’s clear, informed agreement is a legal breach and exposes the operator to significant penalties and potential claims.
Our solicitors explain when a website’s use of cookies crosses into illegality. You will learn which cookies require explicit consent, frequent compliance mistakes, what valid consent looks like, and practical actions you can take if your data rights are ignored. We include the latest requirements, exemptions for “strictly necessary” cookies, and the risks of ignoring enforcement, with tailored advice for website owners and affected users.
If you are unsure about your compliance or believe your data has been used unlawfully, our solicitors can assess your options and help protect your rights. Call 0207 459 4037 or book a free consultation with our London-based team.
What Does It Mean for UK Websites to Illegally Drop Cookies Without Consent?
Illegally dropping cookies without consent means a website stores or reads tracking information on your device before you have given active agreement, in direct violation of requirements in England and Wales. According to ICO guidance, except for a narrow exemption, every website must obtain your clear, informed, and freely given consent before setting most types of cookies or similar technologies. Ignoring this duty is a breach and may result in sanctions or legal proceedings.
What Counts as a Cookie and Which Technologies Are Covered?
A cookie is a small file placed by a website to record your actions, preferences, or device identity. Under ICO guidance, “cookies” is a catch-all term covering a broad range of device-based tracking and storage technologies, not just browser cookies.
Are Similar Tracking Technologies Also Included?
The rules apply to any technology that stores or accesses information on a user’s device. This includes cookies, local storage, web beacons, pixel tags, device fingerprinting, and analytics scripts. If you or your business uses a method that reads from or writes to a visitor’s device for any reason other than those strictly necessary for a requested service, those are treated as cookies under the ICO’s rules.
When Is Consent Required for Cookies on UK Websites?
Consent is required for nearly all cookies and similar storage technologies except for a few, well-defined cases. The ICO’s guidance makes clear that before any non-essential cookie is placed or accessed, the website must inform users of the type and purpose and obtain the user’s active, opt-in agreement.
Which Cookies Need Consent and Which Are Exempt?
ICO guidance provides two main exemptions:
- Transmission cookies: Used solely to carry out communication over an electronic network.
- Strictly necessary cookies: Essential for a user-requested service, such as maintaining a shopping basket or enabling a secure payment.
All other cookies—including those for analytics, advertising, social media, or third-party tracking—require clear, informed, and active user consent.
How Must Consent Be Collected to Be Legal?
Legal consent for cookies in England and Wales must be given through a positive, informed action by the user. The website must clearly explain what is being set and why. Passive or disguised methods are not valid.
What Does Valid Cookie Consent Look Like in England and Wales?
Valid consent under ICO guidance is:
- Freely given: There is a real choice with no adverse consequences for refusing.
- Specific: Consent is given for each category or purpose.
- Informed: Users know what the cookie is, what it does, and who uses it.
- Unambiguous: Consent comes from a clear action. Simply scrolling, closing a banner, or inactivity does not qualify.
Common Mistakes That Invalidate Cookie Consent
Frequent mistakes include setting cookies upon page load, pre-ticking consent boxes, or relying on banners that claim consent is given by continued browsing.
If your site’s consent mechanism may breach these rules, our solicitors can assess compliance risks and advise you on solutions.
What Are the Legal and Commercial Risks for Website Owners?
Ignoring ICO guidance and dropping cookies without consent subjects a business to significant risk—not only from the regulator but also from affected users, clients, or competitors.
ICO Investigations, Fines, and Reputational Damage
The ICO can issue warnings, require remediation, impose fines for serious or repeated breaches, and name businesses in regulatory reports. The reputational damage from public enforcement can be extensive and last longer than financial penalties.
Potential Civil Claims by Users or Competitors
Breaches do not only risk regulator action. Commercial claimants may also seek damages or an injunction if they have suffered loss or a competitive disadvantage from unlawful tracking or profiling.
Our solicitors have also written about Defamation & Reputation Management, which may be useful if reputational issues arise from data protection failures.
Can I Take Legal Action If a Website Drops Cookies on My Device Without Consent?
Yes. Both individuals and businesses affected by unlawful placement of cookies or similar tracking technologies have options for legal and regulatory redress.
Who Can Bring a Claim and What Remedies Are Available?
Anyone whose privacy or business interests have been affected can:
- Submit a complaint to the ICO, prompting a regulatory investigation
- Bring a civil claim for damages or an injunction, or participate in group actions if appropriate
- Seek a court order to stop ongoing illegal tracking
What Evidence Is Needed to Prove Illegal Cookie Use?
Evidence is crucial in pursuing or defending claims or complaints about cookies. You need to show that non-essential cookies were set or accessed before consent.
How to Gather and Preserve Technical Proof for Claims or Defences
Useful steps include:
- Using browser tools or plugins to document all cookies, scripts, or trackers set before consent
- Taking timestamped screenshots or screen recordings of banners, consent flows, and user actions
- Saving browser logs that reveal tracking before consent
- Keeping records of targeted advertising or correspondence arising from collected data
If you need guidance on gathering technical evidence or building a claim, our solicitors can help review your findings and advise on next steps.
Step-by-Step: What to Do If You Discover Illegal Cookie Activity
For Individuals or Customers
- Gather evidence including screenshots, logs, or recordings of cookies set before you consented.
- Record site details: URL, page, time, device.
- Submit a complaint using the ICO’s online portal.
- If financial loss or business harm is involved, contact a solicitor for review and tailored advice.
For Businesses Notified of a Breach
- Initiate an immediate audit of your website and embedded scripts.
- Direct your technical team to halt all non-consented tracking.
- Update your cookie banner and policy to meet ICO requirements.
- Instruct a specialist solicitor to assess risk, compliance, and wider reputational or contractual issues.
What Do the Courts and Tribunals Say About Illegal Cookie Dropping?
There are currently no reported court or tribunal decisions in England and Wales specifically concerning illegal dropping of cookies or breaches of consent. This places greater importance on adhering to ICO guidance, which sets the benchmark for technical and legal compliance.
Our Winning Approach to Cookie Law Disputes and Claims
Our solicitors at Go Legal are recognised for their expertise in commercial, privacy, and technology litigation in England and Wales. We combine a proven track record in dispute resolution with deep technical knowledge of cookie implementation and up-to-date understanding of ICO guidance. We deliver strategic, tailored advice to businesses and individuals facing non-compliance or risks of claims, always ensuring communication is clear and practical.
If you need a risk audit, help defending a claim, or informed guidance on regulatory compliance, contact our team today.
Frequently Asked Questions
What does “illegally dropping cookies” actually mean for UK websites?
It means setting or accessing tracking technologies on a user’s device without first obtaining clear and positive consent, in breach of ICO guidance.
Which cookies are classed as strictly necessary under UK law?
Strictly necessary cookies are those required to provide a service specifically requested by the user, such as filling an online shopping basket or maintaining a secure login session. Analytical, advertising, and tracking cookies are not strictly necessary.
Do cookies set by third-party scripts still require user consent?
Yes. The ICO confirms that all cookies, including those set by third-party analytics or marketing scripts, need opt-in consent unless they are strictly necessary for the requested service.
What happens if I ignore a website using cookies without my consent?
You can raise a complaint with the ICO, bring a civil claim for damages if affected, or contact a solicitor to discuss your options.
Can competitors use illegal cookie activity as a basis for a commercial claim?
If unlawful tracking harms your business or puts you at a disadvantage, you may be able to pursue a claim. Our solicitors can explore possible commercial remedies with you.
What evidence should I keep if I want to challenge illegal cookie use?
Keep dated screenshots, browser logs, correspondence with the website or regulator, and evidence of harm or misuse.
Is it enough to just update my cookie banner to fix a compliance breach?
No. Updating the banner must be part of a broader review, including halting non-compliant cookies, auditing scripts, and updating all related internal policies.
Can group claims be brought against a business for illegal cookie use?
While not yet seen in reported decisions, group or representative actions could be possible where multiple parties are affected by unlawful cookies.
Does consent for cookies need to be renewed every visit?
The ICO requires that consent remains current and meaningful but does not set a specific interval. If there are major changes to cookies or their use, renewed consent is usually required.
How long do I have to bring a claim over unlawful cookies?
No verified source specifies a statutory time limit for cookie-related claims. Act promptly if you believe you have suffered loss, and seek legal advice early to protect your position.
Get Specialist Advice on Illegal Cookies and Consent Issues Today
Understanding your legal obligations regarding cookies and consent is essential for every website operator in England and Wales. This guide outlined the rules enforced by the ICO, the narrow scope of exemptions, and the real commercial and regulatory risks of failing to obtain valid consent.
Whether you are facing a complaint, wish to strengthen compliance, or believe your data privacy has been breached, our solicitors can assess your situation and provide the right legal strategy. Early action is vital for protecting your interests and avoiding further complications.
