Sky, one of the UK’s largest broadcasters and internet providers, has come under renewed scrutiny for its approach to digital consent after users reported growing concerns about how the company and its 197 trusted partners collect, store, and use personal data for advertising. The company’s latest privacy prompts, which appear across its news and entertainment sites, highlight an increasingly contentious debate about consumer choice, personalised advertising, and the balance between business models and user rights.
At the centre of the issue is the familiar prompt: “Accept cookies to see more relevant adverts.” On the surface, the message seems straightforward. But behind the language lies a complex network of advertising technology providers, data brokers, and analytics firms that rely on extensive personal data to target users more precisely. Sky insists that its system is transparent and in line with UK and EU privacy laws. Critics, however, say that the process often nudges users into giving consent without fully understanding what they are agreeing to.
How Sky’s Cookie Policy Works
When users access Sky News or related platforms, they are met with an option to accept all cookies, reject all but essential cookies, or manage their preferences through a detailed settings menu. The company explains that essential cookies ensure the website functions, while non-essential ones allow for personalised advertising, audience research, and content measurement.
Importantly, Sky also notes that where users are existing Sky customers, advertising may be further personalised using account and product data already held by the company. This means browsing behaviour could be combined with subscription data to deliver more targeted messages, raising additional questions about how consent is managed across different data sets.
The policy aligns with requirements set out by the UK’s Information Commissioner’s Office (ICO), which stipulates that companies must provide clear options and respect user choices. Yet, digital rights groups argue that the default design—where “accept all” is the most prominent button—creates a form of “dark pattern” design, subtly steering users toward broader data sharing.
The Trusted Partners Question
Sky discloses that it works with 197 partners, ranging from global advertising networks to niche analytics firms. This broad ecosystem allows advertisers to bid in real time for ad space, tailoring content to the user’s profile.
However, the sheer scale of the network raises accountability concerns. If a single user’s data flows across hundreds of companies, tracking how it is used, stored, or shared becomes difficult. The ICO has previously warned that companies relying on such complex supply chains must still ensure compliance with GDPR and UK Data Protection Act principles.
Privacy researchers at University College London (UCL) have also pointed out that many users may not even recognise the names of the third-party companies involved. This lack of visibility, they argue, undermines informed consent and leaves consumers with little practical control over where their information ends up.
Industry Norms Versus Public Expectations
Sky is not alone. Media giants from the BBC to ITV, as well as global platforms such as Google and Meta, use similar cookie consent frameworks. In fact, personalised advertising remains the backbone of digital publishing revenue, accounting for over 70% of online ad spending in the UK according to figures from the Internet Advertising Bureau (IAB).
But consumer expectations are shifting. A 2024 survey by YouGov found that 58% of UK internet users feel they have “little or no control” over how their online data is used. Another 42% reported that they routinely select “reject all” options when available, showing growing discomfort with behavioural tracking.
This tension has sparked debate among policymakers. Some MPs have suggested the UK consider stricter rules similar to those recently introduced in France, where regulators have fined companies that use interface designs that make rejecting cookies harder than accepting them.
The Legal Landscape
Under the General Data Protection Regulation (GDPR) and its UK equivalent, companies must demonstrate that consent is freely given, informed, and specific. This means that pre-ticked boxes, vague explanations, or bundled permissions are not permitted.
Sky’s approach—providing an “essential cookies only” option alongside detailed settings—meets the letter of the law. Yet, critics argue that the reliance on lengthy menus filled with technical jargon undermines the spirit of informed consent.
In 2023, the ICO fined several smaller publishers for similar practices, though large players like Sky, BT, and Virgin Media have largely avoided penalties, in part because they have invested heavily in compliance systems. Whether regulators will turn their focus to larger firms remains to be seen.
Risks for Consumers
For everyday users, the risks of broad cookie acceptance range from minor annoyances to serious privacy breaches. Personalised ads may feel intrusive, and continuous tracking across devices can create detailed behavioural profiles. In extreme cases, data leaks from one partner in the chain could expose sensitive information about browsing habits, financial interests, or even health-related searches.
Cybersecurity experts emphasise that while most advertising partners are reputable, the sheer volume of companies increases the likelihood of weak links. A 2022 report from the UK’s National Cyber Security Centre (NCSC) warned that advertising networks were becoming increasingly attractive targets for hackers, as they provide access to vast amounts of personal data.
What Consumers Can Do
For users concerned about their privacy, experts recommend several steps:
- Use the “Essential cookies only” option. This reduces tracking to a minimum, though some non-personalised adverts will still appear.
- Review the partner list. While lengthy, the list offers insight into who might access your data. Some settings allow opting out of specific companies.
- Install browser-level protections. Tools like Firefox’s Enhanced Tracking Protection or extensions like Privacy Badger can block third-party trackers.
- Regularly clear cookies. Deleting stored cookies resets tracking identifiers, though it may also log you out of sites.
- Consider subscription models. Some platforms are experimenting with ad-free subscriptions as an alternative to data-driven advertising.
The Business Case for Personalisation
Sky argues that personalised advertising benefits both users and advertisers. Users see more relevant promotions, while businesses can reach audiences more efficiently, reducing wasted spend. In 2024 alone, Sky Media reported that targeted advertising improved campaign performance by 35% compared with generic ads, citing case studies from retail and automotive brands.
This efficiency, however, comes at the cost of consumer data. Whether users accept that trade-off depends on their trust in the company and the transparency of its policies.
A Broader Shift in Digital Advertising
The debate over cookies is part of a wider shift. Google plans to phase out third-party cookies on Chrome, the UK’s most widely used browser, by 2026. In their place, Google is trialling “Privacy Sandbox” technologies that aim to deliver relevant ads without exposing individual browsing histories.
If successful, these changes could reduce reliance on large-scale partner networks like the one Sky uses. However, advertisers remain cautious, fearing that new systems may reduce targeting accuracy and drive up costs.
Meanwhile, regulators continue to push for a model where users have clearer, simpler choices. The EU’s Digital Services Act (DSA), which took effect in 2024, requires large platforms to provide at least one version of their service without personalised tracking. Though the UK has not adopted the law post-Brexit, campaigners are urging ministers to consider similar protections.
The Future of Consent
For Sky, the challenge lies in balancing legal compliance, business needs, and user trust. If too many consumers reject cookies, advertising revenue may fall. Yet, if the company fails to demonstrate clear respect for user choice, it risks regulatory fines and reputational damage.
The company has already signalled that it is exploring alternative models. In 2025, Sky began testing contextual advertising on its streaming platforms, where ads are based on the content being viewed rather than the viewer’s browsing history. While less precise, this approach avoids the privacy concerns tied to personal data.
Conclusion: A Moment of Choice
The cookie prompt may appear mundane, but it symbolises a much larger struggle over digital rights, business sustainability, and the future of online media. Every time a user clicks “accept all” or “essential only,” they are participating in a system that balances privacy against convenience, corporate profit against consumer protection.
Sky’s reliance on nearly 200 partners shows the scale of modern digital advertising—and the difficulty of keeping it transparent. For now, consumers remain caught in the middle: able to opt out, but often nudged to give away more than they might realise.
The coming years, shaped by regulatory changes, technological shifts, and consumer awareness, will determine whether the industry can move toward a more balanced model. Until then, each cookie consent banner is more than just a formality—it is a test of how much control individuals truly have over their digital lives.
