A popular UK website used cookies to track me from the moment I visited their website, before their ‘consent’ popup was even shown. It was also harder to reject than to accept tracking cookies, because registration and payment were required to reject. Worse still, even after I’d paid to reject tracking cookies and have a ‘tracking-free’ experience, the website tracked me for behavioural advertising anyway: consent or pay had become consent AND pay. So I sent them a UK GDPR objection and a legal letter of claim, with the intention of taking them to court. The bungling ICO bizarrely refused to investigate my complaints until I sent them a formal legal letter threatening a judicial review, raising serious concerns about the ICO’s ability to regulate non-compliant ‘consent or pay’ models.
