Website privacy matters. But if we want to improve it, we first need to understand what’s actually happening. Not just on individual websites, but across entire industries.
That’s why today, we’re introducing the Privacy Index, a new initiative by Nixon Digital to systematically measure website privacy, uncover recurring risks and help industries learn, improve and take action.
Our ambition is simple: to contribute to a more privacy-friendly web, one industry at a time.
Why we’re launching the Privacy Index
Every day, millions of people visit websites, interact with digital services and trust organisations to handle their data responsibly.
Over the years, companies have invested heavily in privacy policies, cookie banners and consent management platforms. Yet having these measures in place doesn’t necessarily mean everything behind the scenes works as intended.
Websites constantly evolve. Marketing teams launch campaigns, agencies add tracking pixels, developers introduce new functionality and third-party services are integrated. Each change can introduce new privacy risks, often without anyone noticing.
We’ve developed technology that allows us to analyse what websites actually do: which cookies are placed, which trackers become active and which third parties receive data, including before visitors have made a consent choice.
And that made us ask ourselves a question: If we have the technology to identify these risks, why limit those insights to individual websites and customers?
That’s how the Privacy Index was born.
Turning website privacy into actionable industry insights
The Privacy Index is a recurring research initiative in which we systematically examine the website privacy practices of a different industry.
Instead of looking at a handful of websites, we apply a consistent methodology across a large group of organisations within each sector.
We analyse what happens when someone visits a website, before interacting with the cookie banner. Our technology records cookies, trackers, external resources and connections to third parties.
We then classify our findings by risk level, identify recurring patterns and translate the results into practical insights.
Each edition of the Privacy Index will provide:
- Industry-wide findings: An overview of how websites across a sector perform and which privacy risks appear most frequently.
- Recurring risk patterns: Insight into the technologies, integrations and configurations that commonly introduce privacy risks.
- Practical recommendations: Guidance on what organisations should look out for and how they can improve.
- A consistent methodology: Transparent criteria that make the research understandable and allow meaningful comparisons.
Our goal is to create a valuable, publicly available resource for privacy professionals, IT teams, marketers, compliance officers and anyone who wants to better understand website privacy.
Because awareness is important. But awareness combined with actionable insights is what drives improvement.
Not naming and shaming. Learning and improving.
One important principle behind the Privacy Index is that we deliberately don’t publish individual company names or publicly rank organisations.
We believe the greatest value comes from understanding what goes wrong across an industry, rather than pointing fingers at individual companies. Most website privacy issues aren’t necessarily deliberate. They can result from a marketing tag that’s incorrectly configured, a third-party integration that bypasses consent settings or a website that simply hasn’t been tested since its last update.
By making these recurring issues visible, we want to help organisations recognise potential risks on their own websites and take appropriate action.
That doesn’t mean hiding the findings. Quite the opposite. We openly share the results, the types of technologies involved, our methodology and recommendations for improvement.
And organisations included in the research can confidentially request their own results to understand exactly what we observed on their website.
The goal isn’t to expose individual companies. It’s to help entire industries get better.
First up: the FMCG industry
For our first edition, we chose the fast-moving consumer goods (FMCG) industry.
These are the food, beverage, household and personal-care brands we interact with every day. Large, established organisations with professional digital teams, significant marketing investments and dedicated privacy tools.
You might expect website privacy to be well under control. But our research across 200 FMCG websites revealed a different picture:
- 80% share visitor data with technology companies such as Google, Meta and LinkedIn before consent.
- 68% have at least one high-risk privacy finding before the visitor makes a choice.
- 92% use a consent management tool, yet 126 of those 184 websites still show high-risk findings.
These results highlight an important lesson: having privacy technology in place doesn’t automatically mean a website behaves as intended. They also demonstrate why ongoing measurement matters.
The first FMCG edition includes a breakdown of the findings, the technologies involved, our research methodology and practical recommendations for organisations looking to improve.
For a detailed analysis of the results, read our full FMCG research article.
Building a more privacy-friendly web, together
FMCG is just the beginning. On a fixed schedule, we’ll turn our attention to another industry, building a growing body of research into how website privacy is managed across different sectors.
Over time, we want the Privacy Index to become a trusted reference point: a place where organisations can understand common risks, learn from industry findings and find practical guidance to improve their own websites.
And as our research expands, we’ll gain a clearer picture of where progress is being made and where more attention is needed.
We’re not claiming that measuring website privacy alone will solve every problem.
But we believe that making problems visible, sharing knowledge and encouraging organisations to act are important steps towards lasting improvement.
We have the technology to contribute to that effort. And we believe putting it to work beyond our own customers is the right thing to do.
One industry at a time, towards a more privacy-friendly web.
Frequently Asked Questions (FAQ)
What is the Privacy Index by Nixon Digital?
The Privacy Index is a recurring research initiative by Nixon Digital that measures website privacy across different industries. It identifies common privacy risks, examines how websites handle cookies and tracking before consent, and shares practical recommendations. The goal is to help organisations improve their website privacy and contribute to a more privacy-friendly web.
How does the Privacy Index measure website privacy?
The Privacy Index uses Nixon Digital’s website privacy scanning technology to analyse what happens when someone visits a website. Using a clean browser, it records cookies, tracking technologies and connections to third parties before visitors interact with the cookie banner. Findings are classified by risk level to identify common privacy issues across an industry.
What did the first Privacy Index reveal about FMCG websites?
The first Privacy Index examined 200 websites of large FMCG companies active in Europe. It found that 80% shared visitor data with technology companies before consent, while 68% had at least one high-risk privacy finding. Despite 92% using a consent management tool, 126 of those 184 websites still showed high-risk findings.
Does having a cookie banner mean a website is GDPR-compliant?
No. A cookie banner or consent management platform alone does not guarantee GDPR or ePrivacy compliance. Tracking pixels, analytics scripts and third-party services may still load before consent if they are incorrectly configured. Regular website privacy audits help organisations identify these issues and verify whether their consent management technology works as intended.
Can companies find out if their website was included in the Privacy Index?
Yes. Companies operating in a sector covered by the Privacy Index can request confirmation of whether their website was included. If it was, Nixon Digital can confidentially share their individual privacy findings, score and comparison with the sector. Individual company names and results are never published publicly.
