DUBLIN, 2 November 2026 — Ahead of Web Summit, ConsentScan, the cookie-compliance scanner developed by Irish cybersecurity company Cycubix, has published its first EU Consent Index. It measures how 160 of the most visited websites in Ireland, Germany, France, Spain, Italy, the Netherlands, Poland and Portugal handle visitor consent under the GDPR and the ePrivacy rules.
Each site was loaded the way a first-time visitor would see it. ConsentScan recorded every cookie and tracker that ran before the visitor made a choice, then clicked the site’s own “Reject” option where one was offered and checked whether tracking stopped.
News and media sites performed worst: 95% loaded trackers before consent and only 2 of 40 earned an A. On 10 of the 11 news sites where our scanner could complete a Reject click, trackers kept running after the visitor refused. Finance and insurance sites performed best, with 43% earning an A.
Trackers before consent, grade A and grade F, by sector (40 sites per sector):
German and Dutch sites performed best in the sample, with half or more earning an A. No Spanish or Portuguese site in the sample earned an A, and 95% of the sites in each country loaded trackers before consent. Irish sites sat mid-table: three in four loaded trackers before consent and a quarter earned an A.
Trackers before consent, grade A and grade F, by country (20 sites per country, 5 per sector):
With 20 sites per country, the country results are indicative of each market’s leading websites, not a national average.
“Most organisations we speak to want to get consent right. What this index shows is that consent usually breaks in the technical detail: a tag that fires before the banner has loaded, a consent setting that was never switched on, or a Reject click that never reaches the tools collecting the data. None of that is visible to the visitor, and often not to the site owner either. The good news is that these problems are usually quick to fix once someone looks. That is why we built ConsentScan: to show website owners exactly what loads before consent and whether Reject is respected, so they can fix it with confidence,” said Fabio Cerullo, founder and Managing Director of Cycubix.
Website owners can run a free scan of their own site at consentscan.io.
The index covers 160 websites: 20 per country across four sectors (finance and insurance, news and media, retail, and travel and transport), five sites per sector per country. Sites were drawn from each country’s list of most visited websites in the Chrome User Experience Report (top 5,000, September 2026). Where a site blocked automated scanning or would not load, it was replaced with another well-known site from the same country and sector (30 of 160).
Scans ran between 14 and 18 October 2026 from a single location in the EU (Ireland), loading each homepage and up to 50 internal pages in a standard browser with no consent given. Trackers or non-essential cookies that ran before any consent was given are reported as “trackers before consent”; high-risk trackers are advertising, marketing and analytics tools that identify visitors. Where the site offered a Reject option on its banner, ConsentScan clicked it, reloaded and browsed on to check whether tracking stopped (completed on 62 sites; on the others, the automated click could not operate the banner, for example because it sat in an embedded frame). Banners where refusing means paying or subscribing (8 news sites) are counted as offering a Reject option. Banners on Polish sites could not be read automatically, so Poland is largely absent from the Reject figures. The banner figures are based on the 112 sites where the scanner could read the first-screen buttons.
Grades run from A (no tracking before consent, and Reject respected where it could be tested) to F (for example, ten or more issues, or tracking that continues after Reject). The full grading rules are published at consentscan.io/how-it-works. Visitors in other countries may see different behaviour from the same sites.
The index reports aggregate results only and does not name individual websites.
ConsentScan checks websites for GDPR and ePrivacy cookie compliance. It shows which cookies and trackers load before consent, whether the Reject button is respected, and how to fix each issue. It is built by Cycubix, an Irish cybersecurity company. Founded in 2011 and based in Dublin, Cycubix provides cybersecurity training and consultancy.
Ana Loza, Director of Operations, Cycubix · info@cycubix.com
