The UK Website Health Check 2026 audited 200 well-known websites across 20 sectors and found that 120 sites were placing analytics or marketing cookies before users had interacted with consent banners.

ALT Agency carried out the research in February 2026 using a clean browser environment to assess whether non-essential cookies were deployed before consent was given.

This breaches current data protection rules under the Data (Use and Access) Act 2025.

The telecoms sector recorded the worst performance, with a 100 per cent failure rate.

News and publishing followed at 90 per cent, while insurance, healthcare and property sectors also showed high levels of non-compliance.

In contrast, banking, government and supermarket websites performed best, each with a 20 per cent failure rate.

Across all sites tested, 1,731 cookies were identified, with 39 per cent classed as analytics or marketing trackers deployed without a valid legal basis prior to consent.

Craig Murphy (pictured), managing director at ALT Agency, said: “Most businesses think they’re covered because they’ve got a cookie banner on their site. They’re not.

“We found that many of the UK’s biggest brands have banners that don’t actually block anything, meaning tracking begins before users are asked.”

The findings come as regulatory pressure increases.

ICO fines reached £19.6 million in 2025, up from £2.7 million in 2024, while the maximum penalty has risen to £17.5 million or 4 per cent of global turnover.

Murphy added: “A year ago, some businesses may have overlooked this risk. That’s no longer the case. The ICO has stepped up enforcement, and fines have increased significantly. This is now a real and immediate issue for UK organisations.”

Murphy also emphasised that solutions are often straightforward.

He said: “For most websites, addressing this is a simple configuration change that can be completed in a matter of hours.

“The key is taking action before enforcement action is taken.”