FMCG websites in Europe
FMCG websites in Europe
We scanned the websites of 200 large food, drink and personal-care companies in Europe, and measured what they send to outside companies before a visitor has made a choice.
Open the website of a big food, drink or personal-care brand and, on 68% of them, something is already sending your data to an outside company, such as Google, Meta or LinkedIn, before you have touched the cookie banner. We scanned 200 FMCG websites across Europe. Even with a strict reading of the rules, 136 of them have at least one clear high-risk finding before consent.
- 68% of the websites send visitor data to outside companies before consent. 136 of 200 load advertising, analytics, tracking cookies or external fonts before the visitor has made a choice.
- A consent tool is not the answer by itself. 92% run one, and 68% of those, 126 of 184 websites, still have a high-risk finding.
- Google is the most common recipient. 85 websites, 42%, send data to Google’s analytics or advertising systems before consent. External fonts follow on 79 websites.
- The problem is concentrated. The 20 worst websites account for 43% of all findings. 13 websites have ten or more.
- One quick fix exists. 30 websites are high risk because of external fonts alone. Hosting those fonts locally removes them from the high-risk group.
- Where a website is based explains little. Websites on .com and on .nl domains both come out at 69%.
01Why we did this research
A cookie banner is a promise. It tells the visitor that they decide what happens to their data.
That promise deserves to be kept, not as a legal formality, but because the visitor has no way of checking it. So we measured what happens before anyone chooses. Not on one website, but across a whole group of websites, so it becomes visible how common it is and where it goes wrong.
We scanned 200 websites of food, beverage, household and personal-care companies with more than 1,000 employees that are active in Europe. For each website we opened up to five pages in a clean browser session, clicked nothing and recorded every request, cookie and font that loaded before a visitor could choose. How we selected and classified is on the Methodology tab. We do not publish company names.
Most of what we found is not deliberate. A tag that fires too early, a video that loads uninvited, a consent tool that does not block what it claims to block. That is not fixed with a fine. It is fixed with visibility.
02How common it is
Of the 200 websites, 136 have at least one high-risk finding before consent: 68%. Another 24.5% have only potential-risk findings, 5% only low-risk items and 2.5% are completely clean. We are deliberately strict about what counts as high risk, so this is a conservative figure. The definition is on the Methodology tab.
The average website has 2.9 high-risk findings. The websites that are affected have 4.3 on average, and a typical affected website shares data with three outside parties. That average hides a wide spread, because the findings are not evenly divided.
Percentages are rounded and do not add up to exactly 100.
The distribution has a long tail. 23% of the websites have five or more high-risk findings, and 13 websites have ten or more. The 20 worst websites, 10% of the research, account for 43% of all high-risk findings. For most companies the problem is one or two tags. For a small group it is a website that runs a full advertising stack before the visitor has said anything.
03Where the data goes
Google is the most common destination. On 75 websites a Google Analytics measurement is sent before consent, and on 52 websites a measurement for Google’s advertising systems. Taken together, 85 websites, 42% of the research, send data to Google in one of these two ways. Many of these are sent in Google’s consent mode: without cookies, but still with the visitor’s IP address, device and the page they are on.
External fonts follow on 79 websites. When a font is loaded from an outside server, that server receives the visitor’s IP address. A Munich court ruled in 2022 that this is unlawful without consent when the site could simply host the font itself.
On 44 websites another company sets a tracking cookie before consent. On 19 of them it comes from YouTube and can recognise the visitor for months; on 13 it comes from LinkedIn.
A website can appear under more than one type.
The mix of findings differs per website. 25% of the high-risk websites are flagged only because of tracking or advertising services. 22% are flagged only because of external fonts. 47% combine services with cookies or fonts. The remaining 6% are flagged for cookies alone, or cookies and fonts.
That second group matters because it is the easiest to fix. A website that is high risk because of fonts alone changes its outcome by hosting those fonts itself.
04Advertising and social media
On 82 websites, 41%, an advertising or social media tracker or cookie is active before consent: Google’s advertising systems, Meta, LinkedIn, TikTok, Microsoft and others. Under the EU rules, advertising never qualifies as strictly necessary. Meta is present on 15 websites and LinkedIn on 13, and the same names also turn up as third-party tracking cookies.
05The consent tool paradox
92% of these websites, 184 of 200, run some form of consent tool. OneTrust alone is on 33.5% of all websites, Cookiebot on another 14.5%.
Yet on 126 of those 184 websites there is still a high-risk finding before the visitor answers the banner. Having a consent tool is not the same as having it block anything.
The share of websites with a high-risk finding barely depends on which tool they run. Websites with OneTrust come out at 61%, with Cookiebot at 86%, and websites without any consent tool at 63%. The websites without a tool do not do worse than those with OneTrust. The groups are small, so we do not rank the tools. And the figures say something about how the tool is set up on these websites, not about the product itself: a consent tool blocks what it is configured to block, and a tag that is added to the page outside the tool is not blocked at all.
06What the clean websites have in common
64 websites, 32%, have no high-risk finding before consent. That group shows it can be done.
What they have in common is not a tool. Around 90% of them also run a consent tool, just like the websites that have findings. What sets them apart is that the tool is connected to the tags: nothing marketing-related fires until the visitor agrees, fonts and libraries are served from the company’s own domain, and videos load only after a click. Where a website is based does not predict it either. Websites on .com domains and on .nl domains both come out at 69%, and the other domains are too small to compare.
07What it means, and what to do
Regulators enforce exactly this pattern. In September 2025 France’s CNIL fined Shein 150 million euros for placing cookies without consent. In the Netherlands, the Autoriteit Persoonsgegevens monitors around 10,000 websites, aims to warn 500 organisations a year about their cookie banners, and opens investigations into those that do not fix them.
For a brand, the cost is not only the fine. It is a visitor who said no, and was tracked anyway. Three groups can act on this research.
Privacy and legal
Do not accept that a consent tool is in place as proof. Ask for a test in a clean browser session that shows what loads before the visitor chooses.
Repeat that test after every release, because a new tag is enough to undo it.
Marketing
Go through the tag manager and remove tags nobody uses. Every tag that remains needs an owner and a rule that blocks it until consent is given.
New pixels get checked before they go live, not after.
Web and IT
Host fonts and libraries on your own domain. For 30 websites in this research that alone removes the high-risk finding.
Load video embeds only after a click, so no outside cookie is set beforehand.
Curious where your own website lands? Run a free website privacy scan and see what happens before your visitors get a say. And if you think your company is one of the 200 websites, you can request your confidential result at the bottom of the Findings tab. We only share it with the company concerned.
Groups are small, so we do not rank the tools. The result says how a tool is set up on these websites, not how good the product is.
Selection
The research covers 200 websites of food, beverage, household and personal-care companies with more than 1,000 employees that are active in the European market. We publish the selection criteria. We do not publish the list of companies.
Method
For each website we opened up to five pages, starting at the homepage, from a European location in a clean browser session with an empty cache and no stored cookies. We did not click anything, and recorded every request, cookie and font that loaded before the visitor made a choice. The scans ran in September 2026 with the Nixon scanner.
Classification
Every finding is rated against the rules below.
High risk
Before the visitor has made a choice, data goes to a party that uses it for advertising, social media or its own analytics, a third-party tracking cookie is set, or a font is loaded from an external server.
Potential risk
May be allowed, depending on a setup we cannot see from outside: analytics or monitoring run by a processor, security such as reCAPTCHA, or functional services such as chat and video.
Low risk
The consent tool, tag managers, the site’s own hosting and strictly necessary cookies. Not counted as a finding.
What we did not measure
- Public pages only. No logged-in areas, no customer portals, no apps.
- Up to five pages per website, not the full site.
- A single moment in time. Websites change.
- What third parties do with the data once they receive it.
- Whether any special category data is involved. Our scanner cannot see that.
Limits
Every browser-based measurement is a lower bound. What we did not observe is not proof that it does not happen. We also do not establish unlawfulness. We measure what happens and place the rule beside it. That judgment belongs to a regulator or a court.
Independence
Nixon Digital sells software that detects and resolves exactly the problems this research measures. We are not a neutral party and we are not going to pretend otherwise. This study was funded entirely by us and commissioned by no one. That is why we publish the method and the aggregate figures openly: you should be able to check our work rather than take our word for it.
Cite as: Nixon Digital, Website Privacy Index, FMCG websites in Europe (published 12 October 2026).
Aggregate figures and method are available under CC BY 4.0. Company-level data is not published.
Questions about the method, or curious about your own website? Request your confidential result if you think your company is included, or run a free website privacy scan.
Frequently asked questions
What is tracking before consent?
It means a website sends data to outside companies, or sets non-essential cookies, before the visitor has answered the cookie banner. Think of advertising pixels, analytics tags and fonts loaded from an external server. In this research, 68% of 200 FMCG websites did so.
Does a cookie banner stop tracking before consent?
Not by itself. A consent tool only blocks what it is configured to block. In this research 92% of the websites run one, and 126 of those 184 still have a high-risk finding before the visitor chooses.
What counts as high-risk tracking on a website?
We call it high risk when, before the visitor has made a choice, data goes to a party that uses it for advertising, social media or its own analytics, a third-party tracking cookie is set, or a font is loaded from an external server. The full rules are on the Methodology tab.
Are Google Fonts allowed without consent?
A Munich court ruled in 2022 that loading Google Fonts from Google's servers without consent is unlawful when the site could host the font itself, because the visitor's IP address is sent to Google. We classify external fonts as high risk, and 79 of the 200 websites load them before consent. The fix is simple: host fonts on your own domain. This is not legal advice.
Does tracking before consent break the GDPR?
We do not judge that. We measure what happens and place the rules beside it. In the EU, advertising cookies and most analytics need consent first, and regulators such as the French CNIL and the Dutch Autoriteit Persoonsgegevens enforce this. Whether a specific website is unlawful is for a regulator or a court to decide.
How can I check what my website loads before consent?
Run a free website privacy scan. It opens your pages in a clean browser session, the way this research did, and shows what loads before a visitor makes a choice. No technical setup is needed.
Is your company in this research?
We publish aggregate figures only and never name companies. If you think your company is one of the 200 websites, request your confidential result. We only share it with the company concerned.
Where does your website land?
Scan your website and see every privacy compliance issue before a regulator does.