In December 2025 the ICO said 979 of the UK's 1,000 busiest websites now pass its cookie checks. So how do property websites compare?
The answer is: not well. Most of the property sites that could be tested kept sending data to advertising platforms after the visitor clicked "Reject all".
- 58%loaded advertising pixels before the visitor made any choice
- 70%kept tracking after "Reject all", of the 30 sites where it could be tested
- 31%of the banners found had no reject button on the first screen
- 23%fully honoured a rejection
How the scan worked.
The scan ran on 30 September 2026 from a UK connection, using the same engine as the free tracking checker. For each homepage it:
- opened the page in a fresh Chrome browser, with nothing accepted and nothing stored
- waited seven seconds and recorded every request, cookie and consent signal
- clicked "Reject all", or rejected through the consent platform where the first screen had no button
- reloaded the page and recorded what still fired
The list covered portals, estate agents, online agents, housebuilders and commercial agents. Current and past clients were left out.
Eleven sites showed the scanner no tracking of any kind, which almost always means they blocked the automated browser. They're excluded, along with one duplicate, leaving 38 sites. No site is named here: the point is the pattern.
Before any choice: advertising pixels load straight away.
22 of the 38 sites contacted at least one advertising platform before the visitor had touched the banner. Meta was the most common, on 16 sites, then Microsoft Advertising on 9, TikTok on 4 and LinkedIn on 3.
Google's tags are left out of that count. Many sites load them in Consent Mode, which sends Google a signal without cookies until the visitor agrees. That's how Google designed it, so it isn't counted as a failure here.
After "Reject all": most keep going.
Rejection could be tested on 30 of the 38 sites. On 21 of them, the page reloaded after "Reject all" still loaded advertising pixels, still set tracking cookies, or both.
Meta was again the most common, still firing on 13 sites after a rejection. The cookies included Meta's _fbp, TikTok's _ttp and Microsoft's _uetvid. On six sites, Google Analytics or Google advertising cookies were set too.
This looks like a build problem, not a missing banner. 19 of those 21 sites had a recognised consent platform in place. The usual cause is advertising tags that were never connected to it: they sit in Tag Manager on triggers that fire on every page, whatever the visitor chose.
A reject button you have to find.
The scan found a banner on 32 sites. On 10 of them, the scanner found no reject option on the first screen, so rejecting meant going into the settings. The ICO's checks look for exactly this: rejecting should be as easy as accepting.
Estate agents and housebuilders.
Estate agents made up most of the sample. On 13 of the 17 agent sites where rejection could be tested, tracking continued afterwards. Housebuilders were much the same, at 7 of 9. The portals that could be scanned were in better shape, but there were too few to draw a conclusion.
Server-side tagging turned up on 11 of the 38 sites, including 4 of the 9 housebuilders. It's a sound choice, but it doesn't handle consent by itself: 6 of those 11 sites, including all 4 housebuilders, still tracked after a rejection.
The data problems behind the consent problems.
The scan also picked up issues that affect the numbers these businesses make decisions on:
- Page views counted twice: 7 sites sent two page views to the same GA4 property on a single load, which inflates traffic and deflates engagement.
- More than one GA4 property: 10 sites sent the same visit to two or more properties. Sometimes that's deliberate, as a group-level roll-up. Often it's a leftover nobody switched off.
- More than one tag container: 5 sites ran two or more Tag Manager containers, a common source of duplicated tags and conflicting consent rules.
These tend to come together. A site where tags ignore consent is usually a site where nobody owns the container, and where duplicates build up for the same reason.
Why property sites struggle.
Property is a long, considered purchase. Sites lean heavily on retargeting to bring people back, so there are more advertising pixels to manage than on most sites. Many agents also run branch websites, franchise sites or several brands, each with its own tags and agencies.
That's the setting where consent breaks: a pixel added by an agency for a campaign, a second container for a microsite, a banner configured once and never tested again. Marc Alexander has seen the same pattern from the inside, running analytics across more than 50 international property websites at Knight Frank.
What this means.
For visitors, "Reject all" often doesn't mean what it says. For the businesses, it's a risk. The ICO has said it will keep testing the busiest websites so they don't slip back. Property sites may not be on that list today, but the checks it uses are the ones in this scan.
There's a data cost too. Tags that ignore consent collect data a business can't safely use, while the duplicates distort the data it can.
How to check your own site.
- Open your homepage in a private window, from the UK.
- Before touching the banner, open the developer tools and look at the network requests and cookies. Anything from
facebook,tiktok,bingorlinkedinis a problem. - Check "Reject all" is on the first screen, next to "Accept all".
- Click it, reload the page, and check those requests and cookies have gone.
The free tracking checker runs the first part of this for any page. The guide to testing Consent Mode v2 covers the rest.
The limits of this scan.
It looked at one homepage per site, on one visit, with an automated browser. Some sites treat automated browsers differently, and inner pages can behave differently from homepages.
The sample is small, so treat the percentages as a picture of the sector, not precise rates. The results describe what each browser sent. Whether any site breaks the law is for the ICO to decide.
Marc works with property businesses on exactly these problems: consent that works, one clean container and GA4 data that can be trusted. The GA4 mini audit checks your site against everything in this scan, and more.