Home / Cookies and website tracking – what should organisations review before year-end?
20th October 2026
Laura Crowe, Senior Associate
Cookies and tracking, including pixels, local storage, fingerprinting, scripts and tags, often span marketing, digital and legal teams. Year-end is therefore a useful time to check that website disclosures, consent records and actual tag behaviour remain aligned. PECR generally requires clear information and prior consent before these technologies store or access information on a user’s device, unless an exception applies; the UK GDPR also applies where personal data is processed.
Start with the live website. Check a range of pages and user journeys including landing pages, videos, payment processes and campaign sites to identify each tracking tool, when it activates, what it does, how long it operates and who receives the information. Test the site before a user chooses, after they reject tracking, after they make specific choices and after they withdraw consent, using relevant devices and browsers. This may reveal hidden or outdated tracking, tools that activate too early or inconsistent consent settings. Compare the results with the consent tool, cookie notice and supplier records. The ICO recommends regular checks, and organisations remain responsible for third-party tools used on their websites.
Classification should follow what a technology actually does, not a supplier’s label. Following the Data (Use and Access) Act 2025, PECR contains five exceptions: transmission of a communication; strictly necessary use for a requested service; statistical purposes; adapting appearance or functionality to a user’s preference; and emergency assistance. Each is purpose-limited, so any additional purpose must be assessed separately.
The statistical exception is narrow: the sole purpose must be gathering information about use of the service with a view to improving it. The appearance exception concerns adapting the service to a user’s preference. Both require clear information and a simple, free means of objecting. Neither covers behavioural advertising, cross-site profiling or repurposing analytics data for targeting. Document the conditions before moving any tool from opt-in to opt-out.
For technologies requiring consent, non-essential activity should remain blocked until the user makes an active, informed and specific choice. “Accept” and “reject” should avoid manipulative design or unnecessary friction; categories should be clear; and users should be able to revisit and withdraw their choice easily. Pre-ticked controls, continued browsing and vague labels are unlikely to meet the required standard.
Check that the cookie and privacy information matches the live configuration, identifies purposes and relevant third parties, explains retention and tells users how to change their preferences. The consent platform should record when and how consent was obtained and the wording or configuration presented at the time. Test that withdrawal reaches every relevant tag and that any statutory objection mechanism works without charge or avoidable steps.
A cookie register can be obsolete the day after approval, so the durable control is a release process. Each new tag or material change should have a named owner, documented purpose, data fields, recipients, retention, legal classification and consent category. Marketing should explain the objective; digital teams should validate activation (also known as firing) rules and data flows; procurement should address supplier terms and onward use; and privacy or legal teams should advise on the rule and risk.
Apply the same checks to tracking tools that operate in the browser (client-side) or on a server (server-side), as well as to consent tools and preference centres. Moving data collection to a server does not avoid PECR or UK GDPR requirements, and a “consent mode” setting does not by itself ensure compliance. Check what information is collected, where it goes, how it may be used, how tools are grouped, the default and regional settings, how tracking works across websites, and whether the tools are accessible and available in the right languages.
Website decisions should be traceable. Retain scan results, classification reasoning, consent-platform settings, test evidence, relevant contracts and approvals; assign an owner and review date for remediation. Profiling across services, combined identifiers, large-scale behavioural advertising, children’s access or sensitive inferences should trigger closer assessment rather than routine approval.
This is more than housekeeping. The ICO has focused on cookie banners, consent and online tracking; in April 2026 it reported that 99% of the UK’s top 1,000 websites now met its cookie-banner compliance standards after targeted work with industry, while signalling that intervention would continue.
A year-end review should leave organisations with a clear picture of what their website does, why each tool is used and who is responsible for keeping it compliant as the site changes.