Firms should make it as easy to “Reject All” cookies as it is to “Accept All.”

Cookies are used by many websites, including major financial websites and search engines, to track users website usage and some use the information to provide tailored advertising.

The ICO says some leading websites may face enforcement action if they do not make changes to comply with data protection law. 

The regulator says some websites do not give users “fair choices” over whether or not to be tracked for personalised advertising.

The ICO has previously issued guidance that organisations must make it as easy for users to “Reject All” advertising cookies as it is to “Accept All”. Websites can still display adverts when users reject all tracking but must not tailor these to the person browsing, the ICO said. 

The ICO has written to companies running many of the UK’s most visited websites to set out its concerns and giving them 30 days to ensure their websites comply with the law.  

Stephen Almond, ICO executive director of regulatory risk, said: “We’ve all been surprised to see adverts online that seem designed specifically for us – an ad for a hotel when you’ve just booked a flight abroad, for instance. Our research shows that many people are concerned about companies using their personal information to target them with ads without their consent. 

“Gambling addicts may be targeted with betting offers based on their browsing record, women may be targeted with distressing baby adverts shortly after miscarriage and someone exploring their sexuality may be presented with ads that disclose their sexual orientation.  

“Many of the biggest websites have got this right. We’re giving companies who haven’t managed that yet a clear choice: make the changes now, or face the consequences.” 

The ICO will provide an update on its work in January including details of companies that have not addressed its concerns. The action is part of work to ensure that people’s rights are upheld by the online advertising industry.