Almost every UK online retailer this scan could test showed a cookie banner with a clear "Reject all" button. But on half of them, clicking it didn't stop the tracking.
In December 2025 the ICO said 979 of the UK's 1,000 busiest websites now pass its cookie checks. With Black Friday weeks away, one of the busiest times of year for retail advertising, this scan looked at what happens behind the banner.
- 52%kept tracking after "Reject all", of the 25 retailers that could be tested
- 36%loaded advertising pixels before the visitor made any choice
- 8%had no reject button on the first screen of the banner
- 32%fully honoured a rejection
How the scan worked.
The scan ran on 5 October 2026 from a UK connection, using the same engine as the free tracking checker and the same method as the scan of UK property websites. For each homepage it:
- opened the page in a fresh Chrome browser, with nothing accepted and nothing stored
- waited seven seconds and recorded every request, cookie and consent signal
- clicked "Reject all", or rejected through the consent platform where the first screen had no button
- reloaded the page and recorded what still fired
The list covered 57 well-known UK online retailers in fashion, department stores, beauty, home and DIY, electronics, grocery, sport, pets and gifts. Current and past clients were left out.
32 of the 57 showed the scanner no banner and no tracking of any kind, which almost always means they turned the automated browser away. Many of the largest retailers were among them.
So the results below describe the 25 retailers where the banner and the rejection could be tested, not every big name. No site is named here: the point is the pattern.
Before any choice: fewer pixels than property sites.
9 of the 25 retailers contacted at least one advertising platform before the visitor had touched the banner. Microsoft Advertising was the most common, on 8 sites, then Meta on 4, and TikTok and Pinterest on 3 each.
Counting affiliate tracking, which many retailers use to pay commission on sales, 12 of the 25 started tracking before any choice. Google's tags are left out of these counts. Many sites load them in Consent Mode, which sends Google a signal without cookies until the visitor agrees. That's how Google designed it, so it isn't counted as a failure here.
After "Reject all": half keep going.
Rejection was tested on all 25. On 13 of them, the page reloaded after "Reject all" still loaded advertising or affiliate tags, still set tracking cookies, or both.
Microsoft Advertising was again the most common, still firing on 8 sites after a rejection, then affiliate tracking on 6 and Meta on 4. The cookies included Meta's _fbp, TikTok's _ttp, Pinterest's and Contentsquare's, and on 2 sites Google Analytics cookies too.
On 4 more sites, the only thing still firing was a Google Ads request without Google's "denied" consent signal. That may be a fault, or Google passing the signal in a way the scanner doesn't read, so those sites aren't counted either way.
This is a build problem, not a missing banner. 11 of the 13 sites that kept tracking used a recognised consent platform. The usual cause is tags that were never connected to it: added for a campaign or an affiliate scheme, and set to fire on every page whatever the visitor chose.
The banner is the part retailers got right.
Every one of the 25 showed a banner, and only 2 lacked a reject option on the first screen. That's far better than property websites, where 10 of 32 banners hid it. The ICO's checks look for exactly this, and retailers have clearly responded. The trouble is what happens after the click.
Server-side tagging doesn't fix consent.
11 of the 25 retailers send at least some of their data through server-side tagging, more than on property websites, where it was 11 of 38. It's a sound choice for data quality and control. But it doesn't handle consent by itself: only 1 of those 11 fully honoured a rejection, and 9 kept tracking.
A server-side container passes on whatever the browser sends it. If the tags in the browser don't wait for consent, the server forwards the data anyway.
The data problems behind the consent problems.
A few sites also had issues that affect the numbers retailers make decisions on, just as advertising budgets peak:
- Page views counted twice: 2 sites sent two page views to the same GA4 property on a single load
- The same container loaded twice: 2 sites, a common source of duplicated tags
- TikTok purchases that can't be matched: 3 sites sent TikTok events without the ID needed to stop the same conversion being counted twice when it's also sent from the server
Compared with property websites.
Retailers do better at the front: fewer pixels before a choice, and banners that offer a real reject button. Behind it, the gap closes. The retail figure counts affiliate tracking, which the property scan didn't count. Leaving it out, 10 of the 25 retailers kept tracking.
Why Black Friday makes it worse.
Peak season is when tags get added in a hurry: a new pixel for a campaign, an affiliate partner for a promotion, a tracking script for a gift guide. Each one is a chance to bypass the consent platform, and most go live without anyone testing what they do after "Reject all".
The Black Friday GA4 checklist covers what to check before the busy weeks, including a change freeze.
How to check your own site.
- Open your homepage in a private window, from the UK
- Before touching the banner, open the developer tools and look at the network requests and cookies. Anything from
facebook,tiktok,bing,pinterestor your affiliate network is a problem. - Check "Reject all" is on the first screen, next to "Accept all"
- Click it, reload the page, and check those requests and cookies have gone, including on a product page
The free tracking checker runs the first part of this for any page. The guide to testing Consent Mode v2 covers the rest.
The limits of this scan.
It looked at one homepage per site, on one visit, with an automated browser. 32 of the 57 retailers couldn't be tested, and inner pages, such as product pages and checkout, can behave differently from homepages.
The sample is small, so treat the percentages as a picture of the sector, not precise rates, and it's too small to compare categories. The results describe what each browser sent. Whether any site breaks the law is for the ICO to decide.
Marc Alexander, a Google Tag Manager consultant, works with online retailers on exactly these problems: tags that wait for consent, one clean container and GA4 data that can be trusted. The GA4 mini audit checks your site against everything in this scan, and more.
Sources.
- ICO: ICO action secures increased cookie compliance, December 2025
- ICO: Guidance on the use of storage and access technologies
- Google: Consent mode overview
Checked on 31 October 2026.