Pre-consent data transfers, cookie consent, CMP adoption across 816013 EU websites — measured, not estimated.
45%
Cookie banner detected
21%
Reject option available
16%
High-risk pre-consent
55%
EU-headquartered hosting
561642 sites scanned · GDPR Art. 44
Resources loaded before cookie consent transfer the user's IP address to third parties — personal data under GDPR. International transfers require safeguards per GDPR Art. 44-49 and Schrems II (CJEU C-311/18). ePrivacy Art. 5(3) prohibits non-essential storage/access without prior consent.
16%
Sites with high-risk transfers
97%
Sites with medium-risk transfers
2.8
Avg transfers / site
35.9
Avg third-party requests
0.2
Avg high-risk / site
2.6
Avg medium-risk / site
Pre-consent transfers can be eliminated by self-hosting resources or using EU-based alternatives:
Google Consent Mode v2 with default 'denied' addresses data-collection-before-consent for Google tags (no data collection before consent), but the script itself still loads — transferring the user's IP. Server-side GTM eliminates this last transfer.
20719 sites with detected CMP
Consent Management Platforms (CMPs) implement the cookie consent requirements of ePrivacy Directive 2002/58/EC and GDPR. A CMP's quality directly affects legal compliance — misconfigured banners are a leading cause of GDPR enforcement actions.
Consent Management Platform distribution across 20719 sites with detected CMP
855847 sites with hosting data
GDPR Art. 28 requires processor agreements specifying data location. Art. 44-49 govern international transfers — the CLOUD Act gives US authorities access to data held by US companies regardless of server location. Schrems II (CJEU C-311/18) invalidated Privacy Shield and requires supplementary measures for US transfers.
73%
Hosted in EU/EEA
27%
Hosted outside EU
59%
Hosted domestically
55%
EU-headquartered provider
45%
Non-EU provider (CLOUD Act / Schrems II)
Server location via IP geolocation (MaxMind GeoLite2). Company HQ from ASN registry. A site may be physically hosted in the EU but use a US-headquartered provider subject to the CLOUD Act — per Schrems II (CJEU C-311/18), this requires SCCs with supplementary measures. · GDPR Art. 44-49
How this data was collected and what it represents.
All data is collected through automated, non-intrusive scans of publicly accessible websites. No login credentials are used, no forms are submitted, and no private data is accessed.
Cookie consent mechanisms are tested using a headless browser (Playwright). We load each site without interacting with any consent banner and record all cookies set, third-party requests made, and resources loaded before any user interaction — capturing the pre-consent state.
CMP detection identifies the Consent Management Platform in use (e.g., Cookiebot, OneTrust, Usercentrics) via script signatures, DOM elements, and API endpoints. Google Consent Mode and IAB TCF framework support are detected through JavaScript API probing.
Pre-consent data transfers are classified by risk level based on the receiving company's jurisdiction, data processing scope, and whether an EU-based alternative exists. High-risk transfers involve US-based services without adequate safeguards.
Hosting data is determined via IP geolocation (MaxMind GeoLite2) for server location and ASN registry lookups for provider company headquarters.
No individual sites are named. All statistics are aggregated and anonymised. Regulatory references indicate which requirements relate to each finding — they do not assert non-compliance of any specific organisation.
Run a free privacy scan and see how your cookie consent, pre-consent transfers, and hosting compliance compare — in 30 seconds, no account needed.
Based on automated scans of 816013 European websites. Updated continuously.