Most people experience data regulation pretty much every day through those insufferable cookie pop-ups. This tick box process of getting user consent ultimately benefited nobody while practically annoying everyone. Hundreds of millions of human hours have been spent clicking through those things on websites across the internet. The previous Conservative government promised to get rid of these as a Brexit benefit, and so has the European Union, though both struggled without untangling the underlying regulation.
The impact of the General Data Protection Regulation (GDPR), however, has actually been far broader and more pernicious than cookie pop-ups. Previous studies indicate that the new regulation had pretty damning consequences. One study found that over a third of apps left Google Play after GDPR, and new app entry fell by 47%, while others have highlighted how it led to the consolidation of the ad tech market in favour of bigger players, Google and Meta, reduced revenue for smaller e-commerce players and cut US venture capital deals in the EU by 21%. As a result of the regulation, thousands of websites became inaccessible to European users.
Two-thirds (69%) of the 113 data-intensive technology businesses surveyed reported that compliance costs have risen over the past 5-10 years, while none say they have fallen, despite government attempts to reduce the burden in recent years
Previous studies, however, didn’t capture the rolling impact on British businesses – until now. New research, conducted by Freshwater Strategy and commissioned by the Computer & Communications Industry Association (CCIA), finds that UK data regulation is costing British tech businesses an estimated £5.3 billion a year in compliance costs alone. This includes time spent building systems and tools, training staff, and hiring data and legal advisers. Two-thirds (69%) of the 113 data-intensive technology businesses surveyed reported that compliance costs have risen over the past 5-10 years, while none say they have fallen, despite government attempts to reduce the burden in recent years.
Importantly, the survey found that compliance is only one slice of the ultimate cost to the British economy. Half (52%) of the technology businesses surveyed reported not undertaking a business activity due to data regulation, including avoiding a beneficial use because of uncertainty, scaling back analytics, not adopting new technology like AI and delaying products, features and services. Businesses are also diverting technical staff, changing product roadmaps, and holding back AI features because of uncertainty around data protection.
‘The issue is that business are very frightened of falling into the trap of breaching regulations, so they do not pursue a project because of the risk,’ explained one respondent. ‘Overzealous regulation means that taking that route is simply not worth the risk capital to get the feature up and running – better to place bets elsewhere,’ said another.
Businesses are not, for the most part, strict libertarians. Most agreed that some regulation should exist, but they doubt the current approach. A strong majority (62%) said that uncertainty about enforcement is a bigger problem than the rules themselves. Two-thirds (68%) said that the risk of getting it wrong is out of proportion to the actual risk to individuals.
Businesses also reported that if the rules were loosened, they could use data more extensively, adopt new data and AI tools, and launch faster in the UK. We received reports of products and features, including AI agents, being launched offshore because of data regulation.
Stay informed with our free daily briefing.
So where to next? There is also strong support for lighter requirements for low risk uses of data, and an end to those repetitive cookie consent requests. But more than anything, businesses want much more clarity, including clearer, faster guidance and a more constructive approach from the regulator. The newly appointed independent board of the recently renamed Information Commissioner (still the ICO) now has an opportunity to shift culture, not just the letterhead.
Matthew Lesh is a Public Policy Fellow at the Institute of Economic Affairs and Country Manager at Freshwater Strategy.
More Technology
02 Oct 2026
Labour Market
Liya Palagashvili
Who needs a boss in the age of AI?
Britain is looking for the effects of artificial intelligence in all the obvious places: redundancies, vacancies and unemployment numbers. So far, there is little evidence of dramatic change in overall headcount. The Office for National Statistics reports that most British businesses using AI have not changed the size of their workforce, even as AI adoption […]
24 Sep 2026
Technology
James Price
The private sector can take Britain back to the stars
In the graphic novel ‘Ministry of Space’, an alternate history is imagined whereby Great Britain nabs the Nazi rocket scientists before the US or USSR. Churchill becomes, in addition to his other (real) accolades and achievements, the father of the British space programme that sees us win the space race. There is a particularly poignant […]
23 Sep 2026
Technology
Samuel Williamson
AI regulation offers Britain no safety
Sam Altman, CEO of OpenAI, and Dario Amodei, CEO of Anthropic, have called for increased regulation of AI to slow down the pace of development. They warn in apocalyptic terms of the dangers their own technology poses. After Jacob Coxon, a researcher, resigned from Anthropic, stating that he could no longer justify working on AI […]
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.