YLB ScoreAsk for yours

Part IV, Are you inside the rules?

Tracking starts before anyone is asked

A visitor lands on your homepage and, before they have read a word, your analytics has started counting them. The rules ask you to ask first, for anything that is not strictly needed to show the page. Since February 2026 the maximum penalty has been very much larger than it was, though the regulator's interest is in the sites that never ask at all.

The fix is an afternoon: a consent tool that holds the trackers back until the visitor says yes. A banner on its own is not enough; if the tracker still loads underneath it, nothing has been asked. Or run no trackers, and need no banner: a site that tracks nobody is not marked on this either way.

Worth about 3 points of your 100 for a typical businessAbout afternoon, by you

See for yourself

Open your site in a private window. If nothing asks you anything and analytics is running, this is the finding. The ICO's guidance explains what counts.

How to fix it

  1. Decide whether you need the trackers at all. Many small sites never read the numbers.
  2. If you keep them, install a consent tool and set it to block until consent.
  3. Test in a private window: nothing should load until you say yes.
The technical version, for your web person

PECR, CMP. Tracker scripts present (Google Analytics, Tag Manager, Meta Pixel, Clarity and others) with no known consent-management script loaded, or with one loaded while a tracker is still wired as an ordinary script outside its control. A banner that does not hold the trackers back is not consent. A site that runs no trackers and has no tool is not scored on this at all. Since 5 February 2026 the PECR maximum is £17.5m or 4% of turnover; the figure is here, not in the plain layer, on purpose.

What the check reads. Three states (HC-48, 15/09/2026). Earned: a known CMP tool (28 named vendors) is loaded via a script/link/iframe src or an inline loader stub AND no tracker script/iframe on the page runs unconditionally (a tracker held by the tool has type=text/plain or a vendor data-* attribute; <noscript> fallbacks do not count). Lost, with a finding: trackers with no tool, or a tool present while a tracker is still wired as an ordinary script. Not applicable: nothing tracks and no tool is installed — the row becomes an info row worth 0 and leaves the denominator (4.0 instead of 5.5).

This is one of the checks in a YLB Score report. Every report is free, read by a person before it goes out, and written so that you can act on it without us. Ask for yours.