Almost all major food and personal care brands’ websites in Europe are passing on visitor data before they make a preference on the kind of data they consent to have tracked, according to agency Nixon’s Privacy Index, a survey of 200 well-known websites.
On 80% of sites surveyed, data was already being sent to Google, Meta, LinkedIn or other tech companies as soon as the page loaded. That is not allowed under the General Data Protection Regulation (GDPR), because every visitor must first be able to state whether, and by whom, their personal data may be processed. This is done via cookie walls, which now turn out to be a worthless shadow play.
According to Nixon, in 68% of cases this involves at least one clear violation of the consent rules. The company only classifies a finding as ‘high risk’ if the rules for that service unambiguously require consent. Nixon Digital called the remaining findings a ‘potential risk’. That depends on how the service is set up, for example whether an analytics service really does not retain the data for its own purposes. That setup is not visible from the outside.
The most striking finding was that 184 companies surveyed had a tool in place have such a tool, mainly OneTrust and Cookiebot, but on 126, data still went off-site before the visitor has responded to the banner. According to the report, such a tool only works if every tag, pixel, embed and font is actually linked to it. In practice, different teams and agencies add tags over time, and the linkage is rarely tested again after going live. The banner is there, but the scripts load around it.
In Europe there has been talk of making the cookie wall invisible. Websites would then have to read out someone’s privacy preference in the background via the browser. However, if that profile is derived from information from cookie walls, it is pointless. After all, cookie walls do not do what a site visitor expects them to do.
Google is the most common destination. On 75 sites, a signal is sent to Google Analytics before consent is given. No one sees it happening. On 52 websites, a measurement took place for Google’s advertising systems. On 44 sites, such requests did not contain any consent signal at all. On 39 sites were pings in Google’s consent mode without cookies. Nixon counted those too, because even such a request transmits an IP address, the device and the page visited, and because the guidelines of the European privacy regulators (EDPB) also place measurements without cookies under the consent requirement.
In addition, on 82 sites an advertising or social media tracker is active from Meta, LinkedIn, TikTok or Microsoft. On 19 sites, an embedded YouTube video placed cookies before anyone has pressed play.
The report did not mention any company by name. In the coming quarters, Nixon will subject additional sectors to a scan. Each scan will be repeated so that the privacy scanner can track developments over time.
Emerce
Ltd
