Kazap TechnologiesYLB ScoreYour Local Business Score

YLB Score › The checks, explained › Part IV, Are you inside the rules?

Tracking starts before anyone is asked

A visitor lands on your homepage and, before they have read a word, your analytics has started counting them. The rules ask you to ask first, for anything that is not strictly needed to show the page. Since February 2026 the maximum penalty has been very much larger than it was, though the regulator's interest is in the sites that never ask at all.

The fix is an afternoon: a consent tool that holds the trackers back until the visitor says yes. Or run no trackers, and need no banner.

Worth about 3 points of your 100 for a typical businessAbout 1 hour, by you

See for yourself

Open your site in a private window. If nothing asks you anything and analytics is running, this is the finding. The ICO's guidance explains what counts.

How to fix it

  1. Decide whether you need the trackers at all. Many small sites never read the numbers.
  2. If you keep them, install a consent tool and set it to block until consent.
  3. Test in a private window: nothing should load until you say yes.
The technical version, for your web person

PECR, CMP. Tracker scripts present (Google Analytics, Tag Manager, Meta Pixel, Clarity and others) with no known consent-management script loaded. Since 5 February 2026 the PECR maximum is £17.5m or 4% of turnover; the figure is here, not in the plain layer, on purpose.

What the check reads. A known CMP tool (25 named vendors — CookieYes, OneTrust, Cookiebot, etc.) loaded via a script/link/iframe src, or an inline loader stub, while trackers are present with no such tool.

This is one of the checks in a YLB Score report. Every report is free, read by a person before it goes out, and written so that you can act on it without us. Ask for yours.