The websites, which have not been named by the ICO, face enforcement action if they do not make cookie changes to comply with data protection law, the regulator said.

Part of the watchdog’s work on the online advertising industry, the ICO has issued the warning as it said some websites are not giving their users fair choices over whether or not to be tracked for personalised ads.

The rules on cookies are covered by the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR.

Organisations must tell people that cookies are being used, explain what the cookies are doing and why; and obtain the person’s consent to store a cookie on their device. Companies may need to obtain fresh consent if their use of cookies changes over time.

Guidance published by the ICO in August outlines that businesses must make it as easy to reject non-essential cookies as it is to accept them. The regulator said then that it would assess the cookie consent banners of the most frequently used websites, and take action where harmful design is affecting consumers.  

Stephen Almond, ICO executive director of regulatory risk, said: “We’ve all been surprised to see adverts online that seem designed specifically for us – an ad for a hotel when you’ve just booked a flight abroad, for instance. Our research shows that many people are concerned about companies using their personal information to target them with ads without their consent.

“Gambling addicts may be targeted with betting offers based on their browsing record, women may be targeted with distressing baby adverts shortly after miscarriage and someone exploring their sexuality may be presented with ads that disclose their sexual orientation.

“Many of the biggest websites have got this right. We’re giving companies who haven’t managed that yet a clear choice: make the changes now, or face the consequences."