The UK's Information Commissioner's Office finalized its storage and access technologies guidance on April 29, 2026, following two consultations. Its publication announcement addresses technologies including cookies, tracking pixels and device fingerprinting. Reading that work simply as a change to cookie banners would narrow the subject beyond the regulator's stated scope.
A banner is an interface through which information and choices may be presented. A storage or access operation is an activity involving a device. The interface can describe the activity, but observing the interface does not by itself establish every operation that occurs. That distinction applies whether a banner is visually prominent, minimal or absent.
In its April announcement, the ICO also reported that 99 percent of the top 1,000 websites had compliant cookie banners. That is the regulator's dated statement about a defined group and a defined feature. It is not an independent September 2026 measurement by this publication, nor a claim that every part of those websites' information handling was compliant.
Define the object being measured
Imagine a fictional website whose banner accurately displays a user's choice, while a separate test examines when particular scripts run. A screenshot could document the available buttons and wording. A technical observation could document activity before and after a choice. One kind of evidence would not automatically establish the other.
This example makes no allegation about a real website. It explains why a banner metric and a measurement of underlying operations should not be combined into one result without showing how they relate. The same principle applies to dates: a satisfactory observation in April cannot prove that a later version of a site behaves identically.
The guidance's published structure and update history identify separate discussions of technology types, PECR rules, exceptions, UK GDPR interaction and practical consent management. Its April update also identifies clarification concerning a simple means of objecting and the use of one technology for multiple purposes. The guide treats these as distinct questions, rather than a single test based on the word cookie.
Purpose introduces another distinction. In a hypothetical service, an operation used for one function could also be described as serving another. A technology's name would not, by itself, establish which function is actually involved. Examining what happens, why it happens and which rule is being considered requires more information than an inventory of product labels.
The April announcement discussed further advertising-related regulatory work as a separate exercise. Its statement about that work at the time should not be read as evidence that any later review has finished. A finalized guidance document and a separately discussed review can occupy different procedural stages.
Both sources are ICO publications. They establish the regulator's guidance structure, publication history and attributed banner claim, not a fresh technical audit of individual services. This report does not determine whether a particular technology qualifies for an exception or whether a specific consent mechanism satisfies the law.
The central reading distinction is the scope of the evidence: which feature, which operation, which purpose and which date were examined? Without those details, a narrow banner observation can be mistaken for a much broader conclusion that the underlying record does not support.