The cookie compliance paradox: why millions of EU websites still violate placement rules

The banner everyone clicks through

You see the cookie banner. You click "Accept All" without reading. You move on with your
day. This ritual happens billions of times across European websites, yet our latest analysis
reveals a troubling reality: the vast majority of these banners exist to comply with a law that
millions of websites actively violate.
The European cookie law, in effect since 2011, established clear rules for the 27 EU member
states. Websites must obtain explicit user consent before placing non-essential cookies for
advertising, analytics, or profiling. The intent was simple - protect user privacy by giving
people control over their digital footprint. The implementation, however, tells a different
story.
Using Dataprovider's monthly web crawling infrastructure, we analyzed cookie placement
behavior across 14.2 million domains operated by companies in EU member states. What we
discovered challenges the assumption that cookie compliance software and regulatory
frameworks have solved the privacy problem.

The scale of European business websites

Our analysis identified 14,242,935 domains belonging to companies across the 27 EU
member states. These aren't just any websites - these are business domains where
Dataprovider successfully identified the operating company and its name, representing the
commercial web presence of European enterprises.

The distribution reveals the economic weight of major European markets:

Germany dominates with nearly one-third of all identified business domains, followed by
France, the Netherlands, and Italy. The remaining 17 countries account for roughly 25% of
the total, reflecting both population sizes and digital economy maturity across the union.

The baseline: cookie placement across EU websites

Of these 14.2 million business domains, our crawler detected cookie placement on 8,044,023
websites representing 56% of all identified business sites. The methodology here matters:
Dataprovider renders each website using a headless browser that cannot click "Accept" on
cookie banners like a human would. Any cookie our crawler receives represents what
websites place by default before user interaction.
Off course not all cookie placement constitutes a violation. Functional cookies necessary for
website operation are permitted without user approval. However, the scale of cookie
placement provides important context for understanding compliance behavior across the EU.
The geographic distribution of cookie placement reveals significant variations:

Slovenia leads with a 76% cookie placement rate, while Lithuania and Belgium both exceed
70%. Germany maintains the lowest rate at 43%, with Austria at 52%. These figures reflect
the proportion of business websites placing cookies by default, though not all necessarily
violate consent requirements. The variation across member states likely reflects differences in
website complexity, business models and technical implementation approaches rather than
compliance culture alone.

The tracking cookie problem

Not all cookies require consent. Functional cookies necessary for website operation are
permitted without user approval. Statistical cookies occupy a gray area, with requirements
varying by jurisdiction based on what data is collected, shared, and tracked.
To focus on clear violations, we examined placement of tracking cookies from major
platforms: Meta, Microsoft, LinkedIn, TikTok, Vimeo, HubSpot and Shopify. These cookies
unambiguously require prior consent under EU law. Our findings: 1,281,670 company
websites place these tracking cookies without obtaining user permission.

This represents 9% of all EU business websites and 16% of websites that place any cookies.
These are definitive violations. Marketing and analytics cookies from major platforms that EU
law explicitly requires consent to deploy. The country-by-country breakdown reveals
consistent patterns:

France leads in absolute numbers with nearly 184,000 violations, followed by Germany with
164,000 and Italy with 160,000. However, violation rates relative to total domains tell a
different story. Lithuania shows the highest violation rate at 16% of its business domains
placing unauthorized tracking cookies followed by Romania at 15.8% and Bulgaria at 15.2%.
Germany's violation rate remains the lowest at 4.0%.
The enforcement gap becomes visible here. France issued a €150 million fine to Shein for
cookie violations in 2024, yet French websites show the highest absolute violation count in
our data. Spain fined SEAT €20,000 for improper cookie placement, while the Netherlands

penalized Coolblue €40,000 for pre-checked cookie consent boxes. These enforcement
actions, while notable, represent a tiny fraction of the violations our data reveals.

The compliance software paradox

Perhaps the most striking finding emerges when examining websites using cookie compliance
software. Among EU business domains 2,700,425 websites implement specialized
compliance tools representing 19% of all business sites. The top platforms include:

These tools exist specifically to help websites comply with cookie regulations. They provide
banner interfaces, consent management and technical controls to prevent cookie placement
before user approval. Yet when we examined websites using these compliance tools we found
413,739 still placing non-essential cookies without consent.
This represents 15% of all websites with compliance software meaning one in seven sites that
invested in compliance tools still violates placement rules. The software exists, the banner
displays, yet the technical implementation fails to prevent unauthorized cookie placement.

What the numbers reveal

The data reveals a system where regulatory requirements exist, compliance tools
proliferate yet violations persist. Installing compliance software doesn't guarantee
correct configuration.
Websites must properly categorize cookies and ensure banners appear before non-
essential placement with technical errors occurring at any step. Third-party marketing
and analytics scripts often fire automatically before consent mechanisms activate,
while testing gaps emerge when websites only test with accepted cookies rather than
declined scenarios.
With millions of potential violations and rare enforcement actions, the regulatory intent
of protecting user privacy through informed consent gets lost in implementation
complexity. Internet users face the daily ritual of clicking through cookie banners that
few genuinely appreciate, knowing that many cookies get placed anyway regardless of
their choice. For now, we navigate this imperfect system and live with its frustrations.
Perhaps future regulations will bring meaningful change, either eliminating these
banners entirely or ensuring their implementation actually works as intended.