Porn websites in the Netherlands
76% of the most popular porn websites in the Netherlands send visitor data to outside companies before consent.
De Telegraaf investigated with Nixon Digital how things stand. We scanned 49 of the 51 most visited porn websites among Dutch visitors, up to five pages per website, without clicking anything, and measured what loads before a visitor has made a choice. Two websites blocked our scan. Here are our own figures, without website names.
For this research we took every porn website that appeared in the top 1,000 most visited websites in the Netherlands in June, July and August 2026. That is 51 websites. De Telegraaf (article in Dutch) investigated this with Nixon Digital and published the findings on 5 November 2026. We scanned 49 of those websites, up to five pages per website, without clicking anything, not even on the cookie banner. Two websites blocked our scan. On 37 of the 49 websites, 76%, we found at least one high-risk finding before consent. On 33 websites, 67%, data went to ad networks or tracking services.
- 76% of the websites send visitor data to outside companies before consent. 37 of the 49 had at least one high-risk finding before the visitor made a choice.
- 67% share data with ad networks or tracking services. That is 33 websites. On 6 of those 33 there is a consent tool.
- 49% send a Google Analytics measurement before consent. That is 24 websites. On 47%, another company places a tracking cookie.
- Only 20% have a consent tool. On 70% of those websites there was still a high-risk finding. For websites without a tool it is 77%.
- Four websites, 8%, load a service from a Russian company. These are Yandex Metrica, Webvisor and LiveInternet.
- It is often more than one finding. 20 websites, 41%, have five or more high-risk findings. The highest number on a single website was 24.
01Why we did this research
What someone views on a porn website says something about their sex life. Under the GDPR (Article 9), data concerning a person’s sex life or sexual orientation is special category personal data, the most strictly protected category. In 2023 the Court of Justice of the EU (case C-252/21) ruled that collecting visits to websites that reveal something like this, through scripts and cookies, can fall under that category. What an advertiser or analytics company does with the data, we cannot see from the outside. What we can see is that the data has already been sent before the visitor has chosen anything.
We did not choose the websites ourselves. The selection follows from a public list: all porn websites in the Dutch top 1,000 of Google’s Chrome UX Report in June, July and August 2026. This is not a ranking. De Telegraaf names the high-risk websites in its own article. We do not name websites, because we measure the pattern and hold the rules next to it. How we scanned and classified is on the Methodology tab.
02How often it occurs
Of the 49 websites, 37 have at least one high-risk finding before consent: 76%. Another 11 websites, 22%, have only potential-risk findings and one website, 2%, turned out to be completely clean. We are strict about what we call high risk, so this is a conservative figure. The definition is on the Methodology tab.
The average website has 4.7 high-risk findings. For the websites affected, it is 6.3 on average. 12 websites, 24%, have none. On the other hand, 20 websites, 41%, have five or more, and the highest number we saw on a single website was 24.
Percentages are rounded and do not add up to exactly 100.
03Where the data goes
The most common finding is a Google Analytics measurement: 24 websites, 49%, sent one before consent. On 23 websites, 47%, another company placed a tracking cookie before consent. Ad networks follow. ExoClick is on 17 websites, 35%, TrafficStars on 10, 20%, and TrafficJunky, TwinRed and Google’s ad systems on 5 each, 10%.
External fonts are a minor factor here. 13 websites, 27%, load a font from an external server before consent. For 2 websites, 4%, a font is the only reason they are high risk.
A website can fall under more than one type. The ten most common types are in the chart.
04Ads and tracking services
33 websites, 67%, had an ad or tracking service active before the visitor had chosen anything. Under EU rules, ads are never strictly necessary, so they always need a yes first. Part of this is cookies that let ad parties recognise a visitor: 9 websites, 18%, have such ID-sync cookies before consent. Of the 33 websites, only 6, 18%, have a consent tool.
“If a website already connects to advertising or tracking services before you have given consent, those parties can receive information about your visit. Depending on the technology used, that information can be linked to earlier visits. Especially when someone visits a porn site, that can yield highly sensitive information.”
Marcel van Rijn, website privacy expert at Nixon Digital, in De Telegraaf (translated from Dutch)
On 4 of the 37 high-risk websites, 11%, the cause is a different service. On 2 of them that is only an external font, on the other 2 another service that is neither advertising nor social media.
05Services from Russian companies
Four websites, 8%, load a service from a Russian company before consent. Two of them use Yandex Metrica, an analytics service that places cookies. A third loads Webvisor, another Yandex service, and a fourth LiveInternet, a Russian visitor counter. What these parties do with the data, we cannot see from the outside.
06The consent tool
10 of the 49 websites, 20%, use a consent tool. For none of those 10 could our scanner name the tool. On 7 of those 10 websites, 70%, there was still a high-risk finding before the visitor answered the banner. For the 39 websites without a consent tool it was 30, 77%.
A group of 10 websites is only an indication. The picture does fit other studies in the Website Privacy Index: a banner says little about what loads. We only see the result and not the settings behind it, so we cannot say why.
07What it means and what you can do
In the Netherlands the cookie rule applies (Article 11.7a of the Telecommunications Act). Storing or reading information on a visitor’s device is only allowed after consent, unless it is strictly necessary. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) supervises this. If special category personal data is also involved, stricter rules apply under the GDPR. Whether that is the case for a given website is for a regulator or a court to judge. We measure what loads.
For visitors there is another common misunderstanding: that incognito mode makes you anonymous.
“Many people think that incognito mode lets them browse the internet anonymously, but that is a misconception. Incognito mainly prevents your browser from keeping your history and temporary cookies afterwards. During your visit, websites and external services can still receive data, such as your IP address and information about your browser. So incognito does not mean you are invisible.”
Marcel van Rijn, website privacy expert at Nixon Digital, in De Telegraaf (translated from Dutch)
For most websites the solution is not a new tool. It is finding out what the existing tool lets through, or putting a working choice in place first. Three groups can get started with this research.
Owners and privacy officers
Do not take the existence of a banner as proof. Ask for a test in a clean browser session that shows what loads before a visitor chooses.
Repeat that test after every release and after every new advertising partner.
Marketing and advertising partners
Go through all advertising and tracking services that have been added over the years. In this research they are the biggest cause.
Make sure every service only fires after the visitor has said yes.
IT and agencies
Test the consent tool’s settings, not just whether a banner appears.
Host fonts on your own domain. That removes the high-risk finding for some websites right away.
Curious where your own website stands? Run a free privacy scan of your website and compare the result with these figures. And was your website part of this research and do you want to know how it did? Then at the bottom of the Findings tab you can request your confidential result. We only share that with the organisation itself.
A group of 10 websites with a tool is only an indication. We do not rank the tools.
Selection
The research covers all porn websites that appeared in the top 1,000 most visited websites in the Netherlands in June, July and August 2026, according to Google’s Chrome UX Report. That is 51 websites. The selection follows from that public list and was not made by us. We scanned 49 websites. The other 2 blocked our scan and we could not assess them. We publish the selection criteria. We do not publish website names.
Method
For each website we opened up to five pages, starting with the homepage, from a Dutch IP address in a clean Google Chrome session with an empty cache and no stored cookies. We clicked nothing and recorded every request, cookie and font that loaded before the visitor made a choice. The scans ran on 29 and 30 September 2026 with the Nixon scanner.
Classification
Each finding is assessed according to the rules below.
High risk
Before the visitor has made a choice, data goes to a party that uses it for advertising, social media or its own analytics, a third-party tracking cookie is placed, or a font is loaded from an external server.
Potential risk
May be allowed, depending on a setup we cannot see from the outside: analytics or monitoring by a processor, security such as reCAPTCHA, or functional services such as chat and video.
Low risk
The consent tool, tag managers, the website’s own hosting and strictly necessary cookies. Does not count as a finding.
What we did not measure
- Up to five pages per website, not the whole website. No logged-in environments or apps.
- Only what loads before the visitor chooses. We did not click reject or accept.
- One moment in time. Websites change.
- What third parties do with the data after they have received it.
- Whether special category personal data is involved. Our scanner cannot see that.
Limitations
Every measurement through a browser is a lower bound. What we did not observe is no proof that it does not happen. The 2 websites that blocked our scan could not be assessed, so the results concern the 49 websites we could read. We also do not establish unlawfulness. We measure what happens and hold the rule next to it. That judgement is for a regulator or a court.
Collaboration with De Telegraaf
The research was carried out by De Telegraaf (article in Dutch) with Nixon Digital’s privacy scan tool. De Telegraaf published the findings and the high-risk websites under its own name and put the findings to those websites. On this page we publish our own aggregate figures from the scans, without website names.
Independence
Nixon Digital sells software that detects and fixes exactly the problems this research measures. We are not a neutral party and do not pretend to be. That is why we publish the method and the aggregate figures openly: you should be able to check our work rather than take our word for it.
Cite as: Nixon Digital, Website Privacy Index, porn websites in the Netherlands (scanned in September 2026).
Aggregate figures and method are available under CC BY 4.0. Data per website is not published.
Questions about the method, or curious about your own website? Request your confidential result if your website was part of this research, or run a free privacy scan of your website.
Frequently asked questions
What is tracking before consent?
It means a website sends data to outside companies, or places non-essential cookies, before the visitor has made a choice. Typical examples are a measurement from Google Analytics or from advertising systems, a font loaded from an external server, or a tracking cookie from another company.
Does a cookie banner prevent tracking before consent?
Not automatically. A consent tool only blocks what it is set up to block. In this research 20% of the websites have a consent tool, and on 70% of those there was still a high-risk finding before the visitor answered the banner. Websites without a tool: 77%. A group of 10 websites is only an indication.
What counts as high-risk tracking on a website?
We call something high risk when, before the visitor has made a choice, data goes to a party that uses it for advertising, social media or its own analytics, a third-party tracking cookie is placed, or a font is loaded from an external server. Services that are allowed under certain conditions, such as analytics by a processor, fall under potential risk and do not count.
Does incognito mode help?
Not for this problem. Incognito mainly makes your browser not keep your history and temporary cookies afterwards. During your visit, websites and external services can still receive data, such as your IP address and information about your browser. What we measure is what loads as soon as a page opens, before the visitor chooses anything.
Is tracking before consent against the law?
We do not judge that. We measure what happens and hold the rules next to it. In the Netherlands, information on a visitor's device may only be stored or read after consent, unless it is strictly necessary (Article 11.7a of the Telecommunications Act). If special category personal data is involved, such as data about sex life or sexual orientation, stricter rules apply under the GDPR. Whether something is lawful is for a regulator or a court to decide. In the Netherlands that is the Dutch Data Protection Authority.
How do I check what my website loads before consent?
Run a free privacy scan of your website. It opens your pages in a clean browser session, as this research did, and shows what loads before a visitor has made a choice. Was your website part of this research? Then at the bottom of the Findings tab you can also request your confidential result.
Was your website part of this research?
We only publish aggregate figures and never name websites. Was your website part of this research and do you want to know how it did? Request your confidential result. We only share it with the organisation itself.
Where does your website stand?
Scan your website and see every privacy compliance issue before a regulator does.