What did the study measure?

Three checks on each retailer’s homepage, before any consent interaction: whether the cookie banner offers a first-layer reject option, whether third-party tracking requests fire before consent, and whether Google Consent Mode (where present) defaults to denied. All three map to failures European regulators have actually enforced against.

Why does a missing first-layer reject button matter?

Because making refusal harder than acceptance is the exact pattern the French regulator CNIL fined Google €150 million and Facebook €60 million for in its decisions of late 2021, announced January 2022. The UK ICO, working with the CMA, warned the operators of the UK’s most-visited websites about the same pattern in November 2023, and the EDPB’s cookie-banner taskforce report (January 2023) set out the common enforcement position.

Why could nearly half the sample not be measured?

Because the scanner plays fair. It identifies itself as PrivacyForgeResearch, visits each homepage once, and never rotates identities, solves challenges or otherwise evades bot defences. 87 of the 166 retailers we attempted therefore could not be measured — 76 refused the scanner outright (a 4xx/5xx bot response — HTTP 400, 403, 429 or 503 — or a challenge page) and 11 were unreachable, timed out or returned nothing. Those sites are classified, counted and disclosed here rather than worked around, and every rate on this page is computed over the 79 sites that could be measured. The block rate is a finding in its own right: to an honestly-identified compliance scanner, roughly half of large EU/UK retail is not auditable at all.

Which sites were scanned?

The full site list is published in the methodology appendix on this page. Results are reported in aggregate only — this study names the failure rates, not individual shops.

Why are individual retailers not named?

The purpose is to measure how common these failures are across the market, not to accuse specific operators on the basis of an automated heuristic. Automated detection has error bars; aggregates are robust to them, individual accusations are not.

How does this compare to US enforcement?

US regulators enforce adjacent failures under state privacy laws: Sephora paid $1.2M (2022) for ignoring opt-out signals, American Honda $632,500 (2025) partly for consent flows that made opting out harder than opting in, and California’s CPPA fined retailer Todd Snyder $345,178 (2025) after a misconfigured consent banner failed to process opt-outs for 40 days.

State of EU/UK Retail Cookie Compliance 2026

We scanned the homepages of large EU and UK online retailers — no logins, no clicks, one visit each — and measured the three cookie-consent failures European regulators actually fine for. Results are reported in aggregate; the full site list and method are published below.

Scanned 2026-07-28 · 79 of 166 attempted retailers measured

Findings

How to read these numbers

The scanner identifies itself honestly — a PrivacyForgeResearch user-agent linking back to this page — and never bypasses bot defences, rate limits or challenge pages.

That has a cost: 87 of the 166 retailers we attempted could not be measured — 76 refused the scanner outright and 11 were unreachable, timed out or returned nothing. Every rate below is computed over the 79 sites that could be measured — and how much of large EU/UK retail is closed to an honestly-identified compliance scanner is itself one of this study’s findings.

Banners with no first-layer reject option10.1%

Share of the homepages that showed a banner.

Sites firing third-party trackers before any consent65.8%

Share of all measured sites.

Sites showing a cookie banner on the homepage87.3%

Share of all measured sites.

Consent Mode set to deny by default100%

Share of the sites where Google Consent Mode was detected (14 of 79 measured sites).

Country	Measured	First-layer reject	Trackers before consent
DE	16	62.5%	31.3%
ES	3	Percentage suppressed: fewer than 10 measured sites.	Percentage suppressed: fewer than 10 measured sites.
FR	9	Percentage suppressed: fewer than 10 measured sites.	Percentage suppressed: fewer than 10 measured sites.
IT	10	50%	90%
NL	11	90.9%	54.5%
UK	30	93.3%	86.7%

Percentages are suppressed for countries with fewer than 10 measured sites — the sample is too small to carry a rate. Their measured counts are shown for completeness.

Reuse this data: the aggregates on this page are licensed CC BY 4.0 — cite “PrivacyForge, State of EU/UK Retail Cookie Compliance 2026” with a link.

Methodology

Sample: the 166 attempted sites published in the appendix below — large online retailers in the UK, Germany, France, Spain, Italy and the Netherlands (150 hand-curated primaries plus a 16-site spare tranche promoted in full), with one storefront per retail brand: no brand appears twice or in two markets, though a large retail group may appear through several of its brands. The country tag is the storefront’s home market.
Instrument: a Playwright (headless Chromium) scanner visiting each homepage once with a fresh browser profile, en-GB locale, and an identifying research user-agent (PrivacyForgeResearch). The scanner never interacts with consent controls — it loads the page, waits six seconds, and reads. The scan ran on 27–28 July 2026 from a UK vantage point.
Measure (a) — first-layer reject: whether the visible consent banner contains a reject/refuse/only-necessary control at its first layer, matched against a six-language lexicon. A "settings" or "preferences" door does not count — that is the pattern CNIL fined Google €150M and Facebook €60M for.
Measure (b) — pre-consent tracking: whether any request to a known third-party tracking host fired before any consent interaction, matched against a published list of tracker domains. The Google Tag Manager loader itself is deliberately not counted.
Measure (c) — Consent Mode default: where Google Consent Mode is present, whether ad_storage and analytics_storage default to denied before interaction.
Aggregate-only reporting: per-site results are not published. Rates are computed over the 79 sites that could be measured. The scanner identifies itself honestly and never bypasses bot defences, rate limits or challenge pages, so a site that refuses it is recorded as an exclusion rather than worked around: of the 87 excluded sites, 76 were bot-blocked (a 4xx/5xx bot response — HTTP 400, 403, 429 or 503 — or a challenge page), 7 failed with a protocol or interrupted-navigation error, 2 no longer resolve, 1 returned an empty page and 1 timed out.
Limitations: one homepage visit per site from a UK vantage point; JavaScript rendered for six seconds; banners served only on inner pages, geo-targeted variants, and post-consent behaviour are out of scope. Detection heuristics were verified against the viewport screenshot captured for every scanned site: a random audit of sites recorded as showing a banner agreed on 9 of 10, and every site recorded as showing no banner was screenshot-checked individually, as was every site re-scanned after an instrument fix.
Limitation — banner detection is a floor: a banner counts as present only when its first layer exposes readable control labels, so notice-only banners and icon-only controls are not counted, and a consent-management container that is mounted in the page but never shown to the visitor does not count as a banner shown. The true share of sites presenting some form of cookie notice is therefore at least the figure reported here.

Frequently asked questions

What did the study measure?: Three checks on each retailer’s homepage, before any consent interaction: whether the cookie banner offers a first-layer reject option, whether third-party tracking requests fire before consent, and whether Google Consent Mode (where present) defaults to denied. All three map to failures European regulators have actually enforced against.
Why does a missing first-layer reject button matter?: Because making refusal harder than acceptance is the exact pattern the French regulator CNIL fined Google €150 million and Facebook €60 million for in its decisions of late 2021, announced January 2022. The UK ICO, working with the CMA, warned the operators of the UK’s most-visited websites about the same pattern in November 2023, and the EDPB’s cookie-banner taskforce report (January 2023) set out the common enforcement position.
Why could nearly half the sample not be measured?: Because the scanner plays fair. It identifies itself as PrivacyForgeResearch, visits each homepage once, and never rotates identities, solves challenges or otherwise evades bot defences. 87 of the 166 retailers we attempted therefore could not be measured — 76 refused the scanner outright (a 4xx/5xx bot response — HTTP 400, 403, 429 or 503 — or a challenge page) and 11 were unreachable, timed out or returned nothing. Those sites are classified, counted and disclosed here rather than worked around, and every rate on this page is computed over the 79 sites that could be measured. The block rate is a finding in its own right: to an honestly-identified compliance scanner, roughly half of large EU/UK retail is not auditable at all.
Which sites were scanned?: The full site list is published in the methodology appendix on this page. Results are reported in aggregate only — this study names the failure rates, not individual shops.
Why are individual retailers not named?: The purpose is to measure how common these failures are across the market, not to accuse specific operators on the basis of an automated heuristic. Automated detection has error bars; aggregates are robust to them, individual accusations are not.
How does this compare to US enforcement?: US regulators enforce adjacent failures under state privacy laws: Sephora paid $1.2M (2022) for ignoring opt-out signals, American Honda $632,500 (2025) partly for consent flows that made opting out harder than opting in, and California’s CPPA fined retailer Todd Snyder $345,178 (2025) after a misconfigured consent banner failed to process opt-outs for 40 days.
Can I reuse these figures?: Yes — the aggregate data on this page is licensed CC BY 4.0. Cite “PrivacyForge, State of EU/UK Retail Cookie Compliance 2026” with a link to this page.

Fixing these failures is covered step-by-step in our complete GDPR compliance guide and the cookie consent best-practices guide.

State of EU/UK Retail Cookie Compliance 2026

Findings

How to read these numbers

Methodology

Appendix: the published site list

Frequently asked questions