Open the website of a big food, drink or personal-care brand and, on eight in ten of them, your data is on its way to Google, Meta, LinkedIn or another tech company before you have touched the cookie banner. We scanned 200 FMCG websites for this first edition of the Privacy Index. Even with a strict reading of the rules, 136 of them, 68%, have at least one clear high-risk finding before consent.

Why we measure this

A cookie banner is a promise. It tells the visitor that they decide what happens to their data.

That promise deserves to be kept, not as a legal formality, but because the visitor has no way of checking it. So we measure what happens before anyone chooses. Not on one website, but across a whole sector, on a fixed schedule, so it becomes visible whether things get better or worse.

Most of what we find is not deliberate. A tag that fires too early, a video that loads uninvited, a consent tool that does not block what it claims to block. That is not fixed with a fine. It is fixed with visibility.

What we measured

The cohort is food, beverage, household and personal-care companies with more than 1,000 employees that are active in the European market. We publish the criteria, not the list of companies.

For each website we opened up to five pages from a European location, without clicking anything, and recorded every request, cookie and font.

We are deliberately strict about what we call high risk. Tag managers, strictly necessary cookies for security or load balancing, and analytics or monitoring that a processor runs only for the site are not counted as high risk. A finding is high risk when, before the visitor has made a choice, data goes to a party that uses it for advertising, social media or its own analytics, a third-party tracking cookie is set, or a font is loaded from an external server. The full rules are on our methodology page.

Where the data goes

Google is the most common destination. On 75 sites, a Google Analytics measurement is sent before consent, and on 52 sites a measurement for Google’s advertising systems. Many of these are sent in Google’s consent mode: without cookies, but still with the visitor’s IP address, device and the page they are on.

External fonts follow on 79 sites. When a font is loaded from an outside server, that server receives the visitor’s IP address. A Munich court ruled in 2022 that this is unlawful without consent when the site could simply host the font itself.

On 44 sites, another company sets a tracking cookie before consent. On 19 of them it comes from YouTube and can recognise the visitor for months; on 13 it comes from LinkedIn.

Advertising and social media

On 82 sites, 41%, an advertising or social media tracker or cookie is active before consent: Google’s advertising systems, Meta, LinkedIn, TikTok, Microsoft and others. Under the EU rules, advertising never qualifies as strictly necessary.

The consent tool paradox

Nine in ten of these websites, 184 of 200, run some form of consent tool. OneTrust alone is on a third of them, Cookiebot on another 14.5%.

Yet on 126 of those 184 sites, there is still a high-risk finding before the visitor answers the banner. Having a consent tool is not the same as having it block anything.

Very few get it right

We also give every site a score from 0 to 100, based only on what happens before consent. The median site scores 38.

103 sites score 40 or lower. Only 27 sites, 13.5%, score 86 or higher, and that group shows it can be done.

Why this carries real risk

Regulators enforce exactly this pattern. In September 2025 France’s CNIL fined Shein 150 million euros for placing cookies without consent. In the Netherlands, the Autoriteit Persoonsgegevens monitors around 10,000 websites, aims to warn 500 organisations a year about their cookie banners, and opens investigations into those that do not fix them.

For a brand, the cost is not only the fine. It is a visitor who said no, and was tracked anyway.

What is next

This is the first edition of the FMCG benchmark. New sectors follow on a fixed schedule, and once we scan FMCG again we can show whether the sector is moving. Curious where your own website lands? Check it with Nixon Pro and see what happens before your visitors get a say.