How We Score the Privacy Index
How We Score the Nixon Privacy Index
On a fixed schedule we scan company websites and measure how much of the web loads third-party trackers before a visitor gives consent. Here is exactly how a site ends up with its score.
How the scan works
What counts as a finding
Every finding is assessed against EU rules: Article 5(3) of the ePrivacy Directive and the GDPR. We deliberately do not apply national exemptions, so the same rules hold for every website in every edition. Cookies are checked against a reviewed database of strictly necessary cookies, and services against a reviewed vendor register. We only call something high risk when the rules clearly require consent for it, following the CJEU in Planet49 and Fashion ID, the EDPB Guidelines 2/2023 on the technical scope of Article 5(3), which cover tracking pixels and cookieless measurements, and the Munich Regional Court on Google Fonts.
In the UK, the ICO reviewed the top 200 websites and raised cookie concerns with 134 of the organisations behind them.
Source: CNIL, 2025 sanctions report and ICO, January 2025.
The headline number
The number we lead with is the share of websites with at least one high-risk finding. Next to it, a bar shows the split between high risk, potential risk, low risk and no risk found, so you see the shape of the problem, not just one figure. Here is what that looks like on a real card:
The Nixon Privacy Score
Every site also gets a score out of 100. We publish only how the scores spread across a sector, never the score of an individual website. The score is deliberately strict: two high-risk findings before consent are enough to halve it.
Scope
This is an automated technical scan, not a legal audit of any single website. We measure what happens before consent and place the EU rules beside it. A potential-risk finding is not proof of wrongdoing; a high-risk finding is what the rules and the courts say requires consent. The final judgment on an individual site belongs to a regulator or a court.
Each sector cohort is defined by published criteria, such as company size and presence in the European market. It is not an exhaustive list of every company in the sector.
Large companies often run a different site per country, and results can differ between them. We follow one fixed rule for every company: we scan the Netherlands-facing site if one exists, and the company’s default global or EU site if it does not. We never choose a country site because it scores better or worse. The rule is fixed before we scan, not after.
Method version 2026-Q3.2. Scans for the first edition ran from August to early October 2026.