Christopher BellOpen MailOnline on your phone this week and, before you have read a single headline, dozens of tracking technologies may already be trying to load in the background. The Daily Mail's website is one of the most visited news destinations in Britain, and in 2026 its cookie consent banner — like every other UK site's — is under closer scrutiny than ever. The Information Commissioner's Office (ICO) has spent the past two years forcing the country's biggest websites to give readers a genuine, one-click way to say no. Most people still click "Accept all" without thinking. IT and data-privacy experts say that single tap can hand advertising networks a detailed picture of who you are.
What actually happens when you land on the page
A news homepage is not just text and photos. Behind it sits an advertising ecosystem that uses small files — cookies — and similar "storage and access" technologies to recognise your device, remember your behaviour, and build an advertising profile. Some cookies are strictly necessary to make the site work. Many others exist purely to track you across pages and, in some cases, across other websites you visit later.
Under the Privacy and Electronic Communications Regulations (PECR), Regulation 6, a site must give you clear information about each non-essential cookie and obtain your consent before those cookies are placed. Consent has to be prior and active. In plain terms: the tracking is not supposed to start until you have actively agreed to it.
The rule that changed the banner
The reason the "Reject all" button now sits next to "Accept all" is the ICO's enforcement drive. The regulator has taken a firmer public position than most of its European counterparts, treating a first-layer reject-all option as a settled requirement: a compliant banner must present "Accept all" and "Reject all" with equal visual prominence, so refusing is exactly as easy as agreeing.
That pressure has worked. After the ICO wrote to 53 of the UK's top 100 websites in a November 2023 campaign, it reported that 38 had become compliant within weeks and others committed to change. The regulator now says roughly 99% of the UK's top 1,000 websites meet the standard. You can read the ICO's plain-English guide for the public on the Information Commissioner's Office website.
The stakes for publishers have risen too. Historically, PECR fines were capped at £500,000. The Data (Use and Access) Act has aligned PECR penalties with UK GDPR levels — up to £17.5 million or 4% of global annual turnover for serious breaches. That is the financial reality now pushing sites to make consent real rather than cosmetic.
Why this matters for you, not just the publisher
For the reader, the difference between "Accept all" and "Reject all" is not trivial. Accepting typically allows advertising and analytics partners to log the articles you read, infer your interests — money, health, politics, relationships — and match that profile against data held elsewhere. A single visit to a health scare story can, in theory, feed an "interested in medical conditions" audience segment used to target you later.
Rejecting non-essential cookies does not break the site. It simply limits the tracking to what is genuinely required to display the page. You will still see adverts; they will just be less precisely aimed at you.
This is the same tension IT specialists flag across the media you use every day, from streaming platforms to news apps. Our analysis of how HBO Max UK tracks its subscribers shows the pattern is industry-wide: the free or cheap experience is often subsidised by your data.
What IT experts recommend you do
The practical steps are straightforward, and none of them require technical skill:
- Read the banner before you tap. Choose "Reject all" or "Manage preferences" rather than reflexively accepting. On a compliant UK site both options should be equally visible.
- Refuse "legitimate interest" defaults. Some banners pre-tick advertising vendors under a "legitimate interests" tab. Toggle these off — for advertising purposes, the ICO's line is that you should be asked for consent, not opted in by default.
- Clear cookies periodically. In your browser's privacy settings, clearing cookies resets the profiles built about you and forces sites to ask again.
- Use browser-level protections. Most modern browsers can block third-party tracking cookies by default; turning this on adds a second layer regardless of what any single banner does.
- Consider your right of access. Under UK GDPR you can ask an organisation what personal data it holds about you and request deletion where the law allows it — the same "right to be forgotten" that applies when you want an old news story removed from search results.
When to bring in an expert
Most cookie decisions you can handle yourself in seconds. But there are moments when professional advice pays off. If you run a business and operate your own website, non-compliant tracking is now a live financial risk, and an IT or data-protection specialist can audit your consent set-up before the ICO does. If you believe a company has ignored a deletion request, mishandled your data, or continued tracking you after you refused, a data-privacy expert can help you frame a complaint to the ICO or escalate it.
The trend of 2026 is clear: regulators are done treating online tracking as an invisible cost of reading the news. The tools to protect yourself are already built into the pages you visit — starting with the button most people never press. The next time a familiar news site loads, take the extra second to look at the banner. Saying no has never been easier, or more worth it.
This article is general information, not legal advice. For guidance on a specific data-protection issue, consult a qualified IT or legal expert.
