The UK Information Commissioner's Office (ICO) is set to start taking action against those companies who fail to comply with new regulations on collecting data from online customers.
The Financial Times, citing a report by KMPG, said around 65% of UK websites are still not notifying their customers before installing tracking cookies. The report said the move could force the firms to pay a fine of about £500,000.
According to the report, firms including Tesco, Sainsburys, the Daily Mail and government departments including the Department for Work and Pensions, have not modified their websites since the new laws were introduced four months ago.
KPMGs information protection practice partner Stephen Bonner said there is still a wait and see approach among companies.
"Given the time that has already been given to companies to comply, it is going to be very difficult for businesses explain why they have done nothing at all," Bonner said.
The ICO had received about 486 complaints regarding non-compliance and had increased its work force by 60% to 37 to examine violations, it said.
Since May 2012, firms have beeb required to obtain users' permission before using cookies. The ICO had also delayed enforcement of the rules for a year, to give firms time to adjust to the new rules.
Many online retailers have been unwilling to implement the new law as they fear that pop-up boxes with warnings would put customers off using their website.