The UK Information Commissioner’s Office will require all news publishers doing business in Britain to display a “reject all cookies” button that is “as easily” used as the “accept all” option on most sites.
The ICO’s “reject all” action comes after a separate investigation of the top 50 websites in the UK in 2021. That investigation, named Operation Cobar, found “instances in which organisations have automatically opted-in individuals into marketing/personalisation/tracking cookies” when they should not have, the ICO said in response to a Freedom of Information Act request. Among the offenders were Autotrader, The Daily Mail, LadBible, Netflix, and The Guardian, the ICO said. It is not known who the ICO’s current targets are.
The Mail declined to comment. The Guardian said it was “always working with its consent management platform to provide greater transparency to its users on how the cookie banner operates”. Autotrader confirmed it has since added a “reject all” button. Other publishers named by the ICO did not respond to a request for comment.
In response to the ICO, publishers seem likely to force more readers to either “accept all” cookies or subscribe to read — what some are calling “consent or pay”.
“We have written to organisations, including some in the media industry, to set out that, under data protection law, website users should be given genuine choice and control over their personal data,” the ICO confirmed to Press Gazette.
“The law states that users must be able to reject non-essential advertising cookies as easily as they can accept them,” the ICO said. “We will take enforcement action where necessary to safeguard people from harm.”
The ICO prefers that news publishers comply voluntarily with its “guidance”. Abuses of consent regarding private data carry a fine of up to £17.5m or 4% of total worldwide annual turnover, in extreme cases.
The new rules have global consequences. The ICO claims jurisdiction over any site doing business in Britain. In 2021, it pursued enforcement action against the Washington Post in a related matter.
Cookie consent rules: Paying the price of rejection
News publishers believe up to 30% of readers would click “reject all” if it is offered at equal prominence to “accept all”. Currently, most news publishers offer readers a choice between “accept all” and “manage choices,” or some equivalent. If readers click the “manage” option, they typically get a more complicated menu in which they can make multiple choices. That menu will sometimes contain a “reject all” button, but often in a way that isn’t particularly prominent.
The new guidance “makes it more challenging to put the ‘reject all’ on that first page without having a clear understanding of how, if you’re going to lose up to 30% of your impressions to non-consenting users, then how do you continue to maintain economic viability when you have such a dependency on advertising in those instances?”, says Richard Reeves, managing director of the Association of Online Publishers. “It’s not feasible to provide access to ad-funded content without that consent.”
“This is potentially quite significant for publishers,” says Damon Reeve, CEO of The Ozone Project, an online ad sales marketplace that represents the Mail, The Guardian, The Telegraph and Reach. “Initial tests with publishers that we work with have indicated that up to 20-25% of users will click reject all, reducing publishers’ addressable web audience by that much.”
Some are considering “consent or pay” as their next step. In Germany, 80% of news brands now require either full consent to third-party advertising cookies or a paid subscription — because they won’t offer news for free, according to SourcePoint, a company that provides consent management software to publishers.
One controversy revolves around whether the ICO will want to see a “reject all” button sitting immediately beside the usual “accept all” function, or whether it will still be OK to place “reject all” behind a menu that requires two or more clicks. The ICO has said it wants to see “reject all” available in a “single step” but hasn’t defined whether the two options need to sit side by side.
“A lot of it depends on how big the buttons are, what colours they are using, what text they are using. As long as the users know that there is a second layer where they can exercise their right to withdraw and they’re not misled, they should be fine,” says Reed Smith lawyer Asélle Ibraimova, who has advised online news organisations.
ICO ‘reject all’ fines will be issued
Christie Dennehy-Neil, the IAB’s head of policy and regulatory affairs, says “it’s not an absolute requirement” for publishers to have “reject all” right next to “accept all”. But she said she believed the ICO is seeking something like that. “If you have an ability to accept everything in one go, you then have to also provide the same ability to reject everything with the same ease and in the same manner,” she said, when asked to interpret the ICO’s “as easily” guidance.
The ICO has been building up steam to enforce a “reject all” button since the summer of last year. That was when Stephen Bonner, a deputy commissioner at the ICO, gave an interview to MLex, a legal publication, in which he said: “If you don’t have ‘reject all’ on your top level [cookie banner], you are breaking the law… There is no excuse for that. The ICO is paying attention in this area and will absolutely issue fines.”
News publishers are currently facing what some are describing as an addressability crisis as their ability to track readers using cookies is being downgraded. This, paired with steep falls in referral traffic for the big tech platforms, has led to sharp falls in online advertising revenue for news publishers last year – even as the overall market has grown.
Email pged@pressgazette.co.uk to point out mistakes, provide story tips or send in a letter for publication on our "Letters Page" blog
