The Cookie Fine That Starts with an Unanswered Complaint, Not an Unlawful Banner

It began with what appeared to be a routine complaint.

A customer questioned why advertising cookies appeared to have been placed despite declining consent. Customer Services acknowledged the enquiry and passed it to Marketing. Marketing referred it to the Privacy team. A few weeks later, the regulator requested evidence.

Not simply a screenshot of the cookie banner.

The organisation was asked to demonstrate how the complaint had been handled, who investigated it, what evidence had been reviewed, what conclusions had been reached and whether its response followed a documented process.

For years, organisations have treated cookie compliance as a design exercise.

The discussion has revolved around banners, consent rates, button colours and whether a particular implementation satisfies regulatory expectations. Marketing teams focus on user experience. Privacy teams review the wording. Technical teams configure the consent management platform.

Today, that is only part of the picture.

Since 19 June 2026, UK organisations have been required to operate a formal, documented data protection complaints procedure under the Data (Use and Access) Act 2025. Alongside this, the maximum penalty available under the Privacy and Electronic Communications Regulations (PECR) has increased to £17.5 million or 4% of global annual turnover, whichever is higher.

Together, these changes fundamentally shift the operational focus of consent governance.

The greatest risk is no longer confined to whether the cookie banner is compliant.

It is whether the organisation can demonstrate that every complaint relating to consent has been handled through a documented, repeatable and defensible process.

This article explains what a complaints-ready consent programme looks like, where organisations most commonly fall short, and why the operating layer beneath the banner has become just as important as the banner itself.

The complaint is often where enforcement begins

A regulator rarely begins with the question:

“Show us your cookie banner.”

A more realistic sequence is:

• An individual raises a complaint.
• The organisation acknowledges it.
• An investigation begins.
• Evidence is requested.
• The regulator assesses both the consent implementation and how the organisation handled the complaint.

That distinction matters.

An organisation may have invested heavily in a modern Consent Management Platform (CMP), carefully configured consent categories and implemented preference centres across multiple websites.

But if it cannot demonstrate a documented, repeatable complaints process, it may struggle to show that its governance is operating effectively.

Increasingly, the operational evidence matters just as much as the technical implementation.

It flows more naturally.

What the ICO is likely to ask for

When investigating a complaint, regulators are interested in much more than a screenshot.

Typical evidence may include:

• when the complaint was received;
• how it was logged;
• who investigated it;
• what technical evidence was reviewed;
• whether consent records were examined;
• what conclusion was reached;
• how the individual was informed of the outcome; and
• whether corrective action was taken where appropriate.

The Data (Use and Access) Act requires organisations to have a formal process for handling data protection complaints. ICO guidance explains how that process should operate in practice, including providing a clear route for complaints, acknowledging them within 30 days, investigating them appropriately and communicating the outcome. In practice, this means organisations need evidence that their governance process works consistently.

Consent is now an operational discipline

Many organisations still think about consent as a website feature.

Increasingly, it should be viewed as an operational capability.

A complaints-ready consent programme brings together several disciplines:

• privacy governance;
• marketing operations;
• web development;
• legal;
• customer services; and
• information security.

Each team contributes part of the overall evidence trail.

Marketing may own campaign technologies.

IT may manage tag deployment.

Privacy may oversee regulatory compliance.

Customer services may receive the initial complaint.

Unless these activities are connected through documented processes, organisations can struggle to reconstruct what actually happened after the fact.

Where the biggest gaps usually appear

The banner itself is often not the weakest control.

Instead, organisations commonly discover weaknesses in the operational layer behind it.

Typical examples include:

No formal complaint workflow

Complaints arrive through general customer service channels with no documented escalation process for privacy issues.

Disconnected evidence

Consent logs, website configuration, CMP records and ticketing systems all exist, but nobody has established how they should be brought together during an investigation.

Unclear ownership

Marketing assumes Privacy owns complaints.

Privacy assumes Customer Services owns them.

Customer Services escalates inconsistently because responsibilities have never been clearly defined.

Poor documentation

Staff understand what they would probably do, but there is no documented procedure demonstrating that the organisation operates consistently.

No testing

The complaints procedure has never been exercised through realistic scenarios.

Like disaster recovery plans, complaint processes often reveal weaknesses only when used under pressure.

Marketing operations now have a larger role

This is no longer solely a privacy issue.

Marketing operations teams increasingly control:

• consent platforms;
• tracking technologies;
• analytics implementation;
• advertising tags;
• customer preference management; and
• website optimisation tools.

Many complaints originate from these environments.

Consequently, marketing leaders now play an important role in demonstrating that consent decisions are being implemented accurately and maintained over time.

Governance cannot stop at deployment.

It must continue throughout the operational lifecycle.

Technology is only part of the answer

Modern consent platforms provide valuable capabilities.

They can record consent events.

They can categorise cookies.

They can integrate with tag management systems.

They can maintain preference histories.

What they cannot do automatically is demonstrate that an organisation investigated a complaint appropriately.

Nor can software replace documented governance.

The strongest compliance programmes combine technology with operational discipline.

Technology produces the evidence. Governance determines whether that evidence stands up to scrutiny.

Building a complaints-ready consent programme

Organisations should be able to answer several practical questions.

• Can individuals easily submit a data protection complaint?
• Is there a documented procedure describing how complaints are handled?
• Are responsibilities clearly assigned?
• Can consent evidence be retrieved quickly?
• Are complaint investigations recorded consistently?
• Can corrective actions be demonstrated?
• Is the process periodically reviewed and tested?

If any of these questions produce uncertainty, the issue is unlikely to be the banner.

It is more likely to be the operating model supporting it.

The operating layer beneath the banner

The increase in PECR penalties naturally attracts attention.

So do discussions around cookie design and consent interfaces.

Those remain important.

However, the introduction of mandatory complaints procedures changes where operational maturity is assessed.

A compliant banner is no longer sufficient by itself.

Organisations must also demonstrate that complaints are handled consistently, investigated properly and supported by documented evidence.

That requires governance that extends well beyond website implementation.

It requires an operating layer capable of standing up to regulatory scrutiny.

For many organisations, that is now the real maturity challenge.

The DPG helps organisations assess the operational strength of their consent programmes through structured consent audits that examine not only the technical implementation of consent management platforms, but also the governance, documentation and complaints procedures that support them. As enforcement increasingly focuses on demonstrable operational maturity rather than technical implementation alone, the operating layer beneath the banner is becoming one of the most important parts of modern privacy governance.