The Information Commissioner has warned some of the UK’s top websites they face enforcement action if they do not make changes to comply with data protection law.

The ICO says that some websites do not give users fair choices over whether or not to be tracked for personalised advertising and has previously issued guidance that organisations must make it as easy for users to ‘reject all’ advertising cookies as it is to ‘accept all’. Websites can still display adverts when users reject all tracking, but must not tailor these to the person browsing.

The ICO has written to companies running many of the UK’s most visited websites setting out the concerns and giving them 30 days to ensure their websites comply with the law.

Stephen Almond, the ICO’s executive director of regulatory risk, said: “We’ve all been surprised to see adverts online that seem designed specifically for us – an ad for a hotel when you’ve just booked a flight abroad, for instance. Our research shows that many people are concerned about companies using their personal information to target them with ads without their consent.

“Gambling addicts may be targeted with betting offers based on their browsing record, women may be targeted with distressing baby adverts shortly after miscarriage and someone exploring their sexuality may be presented with ads that disclose their sexual orientation.

“Many of the biggest websites have got this right. We’re giving companies who haven’t managed that yet a clear choice: make the changes now, or face the consequences.”

The ICO will provide an update on this work in January, including details of companies that have not addressed its concerns, as part of wider work to ensure that people’s rights are upheld by the online advertising industry.

---