A third of local agent sites track visitors with no cookie banner

While scoring 192 agent websites this month we checked two things that go together: whether a site runs tracking scripts, and whether it asks before running them.

69 of the 192 run tracking with no cookie banner at all. Thirty-six per cent. In most cases it is Google Analytics or the Meta pixel, dropped in years ago by whoever built the site, quietly setting cookies on every visitor since.

A further 35 have no link to a privacy policy anywhere on the homepage.

What actually changed

Cookie rules are not new and everyone has banner fatigue. Two things are new enough to be worth two minutes.

The penalty ceiling moved. Until February 2026, breaching the Privacy and Electronic Communications Regulations topped out at £500,000. It is now aligned with UK GDPR: up to £17.5m or 4% of global turnover. For a firm your size the theoretical maximum was never the real risk, but the alignment signals how the ICO is treating this now.

And the ICO has been writing letters. It contacted 134 of the UK's top 200 websites about cookie compliance, then extended the campaign to the top 1,000. Small agencies are not on that list. The direction of travel is the point.

The bit people get wrong

The rule is not "have a banner". The rule is that non-essential cookies need consent before they are set.

A banner that says "by continuing to use this site you accept cookies" while Google Analytics has already loaded is not consent. Neither is a banner where "Accept" is a button and "Reject" is a link in the small print, or three clicks into a settings panel. Refusing has to be as easy as agreeing.

That is why a fair number of banners are worse than useless: they cost the visitor a click, annoy them, and do not achieve the thing they exist for.

What we could and could not see

We checked whether known tracking scripts were present, and whether any of the common consent tools were. We did not check whether a banner that exists actually blocks anything before you click it, which is where a lot of them fail. So the 69 is the obvious cases only. The real number is higher.

We will say plainly that our own site was in the wrong group until last week. The Google Ads tag was setting cookies with nothing asking first. We noticed while doing this work, and fixed it — analytics now runs with nothing stored on your device until you say yes, and if you say no it stays that way.

Easier to write that than to pretend we had always been tidy.

If you want to check your own

Three things, none of which need a developer:

Open your site in a private window. Before touching anything, open developer tools and look at the cookies. If there are any beginning _ga, _gid, _gcl or _fbp, they were set without asking.

If you have a banner, click Reject and look again. If the same cookies are still there, the banner is decorative.

Check you have a privacy policy and that it names what you actually run. A policy from 2014 listing tools you no longer use is its own small problem.

Whether your site runs tracking, whether it has a banner, and whether it has a privacy link are three of the checks in the free scorecard. Ask for yours.

This is not legal advice and we are not lawyers. It is what we found and what we did about our own site.