FMCG sites often share data before cookie consent
A new sample shows that visitors are often tracked before they have made a choice.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
On eight out of ten websites examined belonging to major FMCG brands, visitor data reached technology companies before visitors made a choice in the cookie banner. The measurement is not a court ruling, but it does point to a recurring gap between the banner and what the website technically does.
The figures come from the first FMCG edition of the Nixon Privacy Index. Nixon Digital examined 200 European websites run by companies in sectors including food, drink, household products and personal care. According to the company, the sites were automatically loaded between August and October 2026 as though it were a first visit.
On around eight out of ten websites, data was sent to companies such as Google, Meta or LinkedIn before the visitor had made a choice. Nixon also reports that 68 per cent of the sites examined had a high-risk profile on at least one point. Nine out of ten sites did use a consent tool.
A consent tool is the technology behind a cookie banner. Such a system should not only display a choice, but also block scripts and trackers for as long as consent is absent. This can go wrong when tags are configured incorrectly, external fonts are loaded, or videos and analytics tools already make contact with third parties.
The Autoriteit Persoonsgegevens and the Autoriteit Consument & Markt distinguish between necessary and privacy-sensitive technologies. According to the ACM, tracking cookies and certain analytics cookies may be placed only with consent. Visitors must know in advance what data is collected and what it is used for.
The researchers do not describe their results as a definitive legal finding. An automated scan shows what happens on a particular page at a particular moment. A website may have different settings for each page, country or visitor. A scanner may also classify a technology incorrectly.
For companies, the practical question therefore concerns more than the design of the banner. They must also check which scripts are loaded before consent, which data goes to external parties and whether a refusal is technically respected. For consumers, a visible banner in itself does not mean that all tracking has already been correctly blocked.
One story, several perspectives
What is established
- The sample found data traffic on many websites before a choice was made in the cookie banner.
- The ACM states that tracking cookies and certain analytics cookies require consent.
- A technical scan is not a definitive legal ruling.
Left
Arguments Companies must not track visitors first and ask for consent afterwards. Regulators should enforce the rules strictly and impose fines where systems systematically ignore users’ choices.
Values Privacy, limits on power and consumer protection in relation to large technology companies.
Consequences Stricter enforcement may reduce tracking, but make digital marketing and some free services more expensive.
Centre
Arguments The rules must be enforced in a technically workable and predictable way. Companies have responsibilities, but also need clear standards and verifiable measurement methods.
Values Legal certainty, proportionality and practical workability.
Consequences A uniform approach can improve compliance without every error immediately resulting in a severe sanction.
Right
Arguments Digital companies must inform consumers clearly, but not every measurement error should be treated as a serious breach. A market with room for innovation can also produce privacy-friendly alternatives.
Values Entrepreneurship, freedom of choice and limited regulatory burdens.
Consequences Giving companies more room can stimulate innovation, but the risk remains that users effectively have no free choice.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The percentages and sample size can be checked in the Nixon index and the reporting about it. The text correctly qualifies that technical scans are not definitive legal rulings.
- confirmed Nixon examined 200 European FMCG websites. — The Privacy Index lists 200 websites examined. source
- confirmed On eight out of ten sites, data reached third parties before a choice was made in the cookie banner. — This is the index’s main finding. source
- confirmed Sixty-eight per cent had at least one high-risk finding. — Nixon gives this percentage for the FMCG sample. source
- confirmed Tracking cookies and some analytics cookies require consent. — This is stated in the ACM’s explanation. source
Editor's note
The measurement results come from research by Nixon Digital and have been described by a second specialist publication. The scan shows technical behaviour, but in itself does not prove that every website involved is in breach of the law.Sources
- The Nixon Privacy Index — Nixon Digital
- Cookies plaatsen — Autoriteit Consument & Markt
- Acht op tien FMCG-sites delen data zonder consent — MarketingTribune
More on this in Dutch media
- RTL Nieuws — „privacy cookies”
- FD — „privacy cookies”
- Trouw — „privacy cookies”