We opened the homepage of 2,298 online shops across Europe and clicked nothing, not even the cookie banner. Then we checked what had already left the browser. On 1,727 shops, 75%, we found at least one high-risk finding before consent. Of those 1,727 shops, 85% run a consent tool.

01Why we did this research

An online shop is where a visitor’s data is most useful to advertisers, and it is where marketing teams add tools one at a time: a pixel here, a tag there. Each one is a decision made on its own. Nobody sees the sum.

So we measured the sum. Not on one shop, but across 2,298 of them, so it becomes visible how common this is and where it goes wrong. We cannot see intent or settings. We see what loads before a visitor has chosen anything.

The shops come from the most visited websites in each EU and EEA country, according to Google’s public Chrome UX Report. We selected 2,455 online shops. 157 of them blocked our scan, so everything on this page is about the 2,298 we could read. We publish the rules, not the list of companies. How we selected, scanned and classified is on the Methodology tab.

02How common it is

Of the 2,298 shops, 1,727 have at least one high-risk finding before consent: 75%. Another 22% have only potential-risk findings, 2% only low-risk items, and 13 shops, 0.6%, came out completely clean. We are strict about what counts as high risk, so this is a conservative figure. The definition is on the Methodology tab.

The average shop has 3.7 high-risk findings. The shops that are affected have 4.9 on average. 25% of the shops, 571, have none. At the other end, 623 shops have five or more, and the highest count we saw was 53.

03Where the data goes

Google comes first. On 1,123 shops, 49%, a measurement went to Google’s advertising systems before consent. On 924, 40%, a Google Analytics measurement did. Many of those arrive in Google’s consent mode. That means no cookie, but the visitor’s IP address, device and the page they are on still go along.

Fonts are the quiet one. On 1,058 shops, 46%, a font loads from an outside server, and that server gets the visitor’s IP address. A Munich court ruled in January 2022 against a website that did this with Google Fonts without consent. The site could have hosted the font itself.

On 459 shops, 20%, another company set a tracking cookie before consent. On 51 of those it came from YouTube, and it can recognise a visitor for months. On 5 it came from LinkedIn.

Behind these numbers sit a few causes. For 198 shops, 9% of all and 11% of the high-risk ones, a font is the only reason. For 113 more, 7% of the high-risk ones, it is another service without advertising or social media. For 1,416 shops, 82% of the high-risk ones, an advertising or social media tracker is involved.

04Advertising and social media

Add it all up and 1,416 shops, 62%, had an advertising or social media tracker or cookie running before the visitor chose anything. Advertising is never strictly necessary under EU rules, so it always needs a yes first.

It is not only Google. Meta is on 22% of the shops, Microsoft’s advertising on 11%, TikTok on 6%. The shops that run such a tracker mostly do have a consent tool: 1,257 of the 1,416, 89%. Only 159 have none. For most shops, then, the question is not whether there is a banner. It is what the banner actually holds back.

05The consent tool question

1,815 of the 2,298 shops, 79%, run a consent tool. We expected those to be in better shape. They were not: 1,476 of them, 81%, still had a high-risk finding before the visitor answered the banner.

The 483 shops with no consent tool at all did better, with 251 of them, 52%. We did not expect that. We only see the result, not the settings behind it, so we cannot say why. A banner that loads a second too late, or a tool that blocks only part of what the shop runs, could both do it.

Whether the tool is a well-known one makes little difference to the picture. Among the 1,015 shops with a named tool, 79% had a high-risk finding. Among the 800 with a tool we could not identify, 84%. We do not rank the products, because what we measure is how a tool is set up on a shop, not how good the product is.

06Results by country

We grouped the shops by the country extension of their domain. The share of shops with a high-risk finding ranges from 44% in Austria and 45% in Germany to 86% in Denmark and 88% in Greece. The Netherlands is at 74%. We do not know what causes these differences. The data only shows them.

The extension shows where a domain is registered or aimed at, not always where the company is based. Groups of a few dozen shops are only an indication.

07What it means, and what to do

Regulators enforce exactly this pattern. In September 2025 the French regulator CNIL fined an international online retailer 150 million euros for placing cookies without consent. The Dutch Data Protection Authority looks at around 10,000 websites, wants to warn 500 organisations a year about their cookie banners, and opens investigations into the ones that do not fix them.

For most shops the fix is not a new tool. It is finding out what the existing one holds back. Three groups can act on this research.

Curious where your own shop lands? Run a free website privacy scan and compare it with these numbers. And if you want to know how your shop did in this research, you can request your confidential result at the bottom of the Findings tab. We only share it with the company concerned.