Pre-consent data transfers, cookie consent, CMP adoption across 45802 EU websites — measured, not estimated.
51%
Cookie banner detected
28%
Reject option available
19%
High-risk pre-consent
40%
EU-headquartered hosting
1264 sites with detected CMP
Consent Management Platforms (CMPs) implement the cookie consent requirements of ePrivacy Directive 2002/58/EC and GDPR. A CMP's quality directly affects legal compliance — misconfigured banners are a leading cause of GDPR enforcement actions.
Consent Management Platform distribution across 1264 sites with detected CMP
33897 sites scanned · GDPR Art. 44
Resources loaded before cookie consent transfer the user's IP address to third parties — personal data under GDPR. International transfers require safeguards per GDPR Art. 44-49 and Schrems II (CJEU C-311/18). ePrivacy Art. 5(3) prohibits non-essential storage/access without prior consent.
Third-party data transfers that occur before the user interacts with any cookie consent mechanism. Every HTTP request transmits the user's IP address (personal data under GDPR) to the service provider — regardless of whether Google Consent Mode blocks data collection. Requires legal basis under GDPR Art. 44-49 (Schrems II).
19%
Sites with high-risk transfers
97%
Sites with medium-risk transfers
3.2
Avg transfers / site
44.2
Avg third-party requests
0.2
Avg high-risk / site
2.8
Avg medium-risk / site
Pre-consent transfers can be eliminated by self-hosting resources or using EU-based alternatives:
Google Consent Mode v2 with default 'denied' makes Google tags GDPR-compliant (no data collection before consent), but the script itself still loads — transferring the user's IP. Server-side GTM eliminates this last transfer.
42463 sites with hosting data
GDPR Art. 28 requires processor agreements specifying data location. Art. 44-49 govern international transfers — the CLOUD Act gives US authorities access to data held by US companies regardless of server location. Schrems II (CJEU C-311/18) invalidated Privacy Shield and requires supplementary measures for US transfers.
62%
Hosted in EU/EEA
40%
Hosted outside EU
46%
Hosted domestically
40%
EU-headquartered provider
60%
Non-EU provider (CLOUD Act / Schrems II)
Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44–49
How this data was collected and what it represents.
All data is collected through automated, non-intrusive scans of publicly accessible websites. No login credentials are used, no forms are submitted, and no private data is accessed.
Cookie consent mechanisms are tested using a headless browser (Playwright). We load each site without interacting with any consent banner and record all cookies set, third-party requests made, and resources loaded before any user interaction — capturing the pre-consent state.
CMP detection identifies the Consent Management Platform in use (e.g., Cookiebot, OneTrust, Usercentrics) via script signatures, DOM elements, and API endpoints. Google Consent Mode and IAB TCF framework support are detected through JavaScript API probing.
Pre-consent data transfers are classified by risk level based on the receiving company's jurisdiction, data processing scope, and whether an EU-based alternative exists. High-risk transfers involve US-based services without adequate safeguards.
Hosting data is determined via IP geolocation (MaxMind GeoLite2) for server location and ASN registry lookups for provider company headquarters.
No individual sites are named. All statistics are aggregated and anonymised. Regulatory references indicate which requirements relate to each finding — they do not assert non-compliance of any specific organisation.
Run a free privacy scan and see how your cookie consent, pre-consent transfers, and hosting compliance compare — in 30 seconds, no account needed.
Based on automated scans of 45672 European websites. Updated continuously.