Katla
Scan your site free

Cookie consent in Swedish e-commerce, 2026Only 681 of 3,705 shops asked properly.

We visited 3,705 Swedish e-commerce sites as a first-time visitor, recorded every cookie set before, during and after the banner, and checked whether refusing actually worked. 681 passed.

51.1%set non-essential cookies before the visitor chose anything
26.6%showed a banner with no way to refuse on the first layer
876 of 3,705showed no cookie banner at all
18.4%had valid consent: they asked first, and took no for an answer
CONSENT VERDICT

One in six passed. Half set non-essential cookies before asking.

Each site got one verdict, and it names the first test it failed. 681 passed all three. 629 set nothing non-essential at all and needed no banner. The rest had a problem before the visitor was asked, or in the way they were asked.

Nothing wrong found: 1,310 of 3,705Valid, of 3,076 that needed consent: 681
Verdictof 3,705 sites
Non-essential cookies set before consent1,894 · 51.1%
Valid consent681 · 18.4%

592 of these had cookies before consent that we could not identify

No non-essential cookies, no consent needed629 · 17.0%

366 of these had cookies before consent that we could not identify

No reject option on the first layer334 · 9.0%
Reject offered, but weaker than accept130
Refusing did not stop non-essential cookies21
Could not be verified16
BEFORE THE VISITOR CHOSE

The page loads. The banner appears. The cookies are already there.

1,894sites had non-essential cookies set before any choice51.1% of 3,705
1,359had only cookies we could not identify36.7% of 3,705
452had nothing non-essential set at all12.2% of 3,705
583set non-essential cookies and showed no banner at all15.7% of 3,705
First layerof 3,705 sites
No refusal on the first layer984 · 26.6%
Refusing is as prominent as accepting1,373 · 37.1%
No banner found to compare1,063 · 28.7%
Refusing is offered, but weaker284 · 7.7%
After clicking refuse
A refusal control was found and clicked2058 of 3,705
No non-essential cookies after refusing1123 of 2,058
Refusing released new non-essential cookies72 of 2,058
REFUSING

Saying no is harder than saying yes.

On 26.6% of the sites we scanned there was a banner with no way to refuse on the first layer at all. Where a refusal control did exist we clicked it, on 2,058 sites: 1,123 of those were left with no non-essential cookies afterwards. On the rest, what had been set before the banner stayed put.

1,123/2058

refusals that left the visitor with no non-essential cookies

CONSENT TOOL MARKET SHARE

Nearly two thirds run a known consent tool. One in eight built their own. Almost a quarter show nothing.

We recognised a consent platform on 2,368 of 3,705 sites. 461 showed a banner we could not attribute to any vendor, most of them built in-house. 876 showed no banner at all.

Recognised tool · 63.9%In-house · 12.4%None · 23.6%
Cookiebot556 · 15.0%
Shopify privacy banner365 · 9.9%
vanilla-cookieconsent252 · 6.8%
Abicart cookie banner223 · 6.0%
CookieYes176 · 4.8%
Cookie Information165 · 4.5%
OneTrust89 · 2.4%
Pandectes59 · 1.6%
Other tools (39)483 · 13.0%
In-house banner461 · 12.4%
No banner found876 · 23.6%
Scorecard by consent tool

How each tool performed on the sites where we found it, as each shop set it up

Consent toolShareSites testedPassed all threeCookies before consentReject failed
Cookiebot15%55619%56%57% of 552
Shopify privacy banner10%36553%32%32% of 336
vanilla-cookieconsent7%25213%34%35% of 62
Abicart cookie banner6%22339%48%41% of 207
CookieYes5%17612%63%55% of 141
Cookie Information4%16545%41%42% of 150
OneTrust2%8935%26%27% of 88
Pandectes2%5922%44%38% of 26
Complianz2%5812%78%85% of 54
Consentmo1%4922%57%59% of 27
Nyehandel cookie banner1%490%51%-
Usercentrics1%4333%53%53% of 43
CookieScript1%3839%24%22% of 23
cookieconsent (Insites)1%264%85%-
CookieFirst1%22 †5%82%80% of 20
Consentmanager1%20 †25%30%36% of 11
Cookie Notice1%19 †0%84%-
Moove GDPR Cookie Compliance<1%14 †0%79%-
WebToffee<1%12 †0%67%-
Didomi<1%11 †9%18%20% of 10
Termly<1%11 †45%18%-
Visma cookie banner<1%11 †0%0%0% of 10
Civic Cookie Control<1%10 †0%40%-
In-house banner12%46111%58%44% of 179
No banner found24%8760%58%10% of 48

A row is what these shops deployed, not what the tool is capable of: every tool here can be configured to pass, and a shop that configured it otherwise is counted against the tool it was using. Percentages are of the sites tested with each tool, not of all 3,705. Tools found on fewer than ten sites are left out, and a row marked with a dagger was found on fewer than 25, where one site moves the percentage several points and the row is indicative rather than a measurement. The reject column is of the sites where a refusal control was actually found and clicked, which is a smaller number than the row beside it, and it is a dash below ten clicks. Katla is not in this table: we publish it, and our own row is the one a reader has no way to check.

Download every tool and every count behind this table (CSV)
MOST COMMON COOKIES SET BEFORE CONSENT

Analytics leads, and Meta is never far behind.

_ga was already in the jar on 855 sites when the visitor arrived. Google's analytics and advertising cookies and Meta's pixel take the first four rows between them, and WooCommerce's own attribution cookies take the fifth.

CookieVendorSites
_gaanalyticsGoogle Analytics855
_fbpmarketingMeta757
_ga_*analyticsGoogle Analytics532
_gcl_aumarketingGoogle519
sbjs_*analyticsseven Sourcebuster cookies, set togetherWooCommerce429
_gidanalyticsGoogle Analytics345
_gatanalyticsGoogle Analytics160
hello_retail_id156
Also set before a choice: __kla_id on 146 sites.
METHOD AND SCOPE

How we checked

01Sites were drawn from e-commerce listings on price-comparison services and kept only where the listing placed the shop in Sweden. Each site was visited once as a first-time visitor with an empty cookie jar, from a Swedish connection, because many consent tools show a banner only to visitors in the EU.
02Every cookie set before any interaction was recorded and classified by purpose and vendor against a database of known cookies, and where the database had no entry, by patterns in the name and the host that set it. No model is asked to judge anything: the same cookie is classified the same way on every run, and each one carries whether a definition or a pattern named it. Cookies we could not identify are reported separately and never counted as non-essential, so an unrecognised cookie is an open question here and never a finding against a shop.
03The banner, if there was one, was identified and accepted. A second visit looked for a refusal control on the first layer, clicked it, and recorded what was left in the jar afterwards.
04A site passed only on all three of the tests a regulator applies: nothing non-essential in the jar before the visitor chose, a refusal offered on the first layer as plainly as acceptance, and a refusal that left nothing non-essential behind. Each site gets one verdict and it names the first test the site failed, so a site is counted once however many ways it fell short. A site that set nothing non-essential at all is counted apart rather than as a pass, because it was never asked to ask.
05A random sample of 50 scans is being reviewed by hand against those same three tests. 47 have been reviewed so far, and the reviewer reached the same verdict as the scan on 91.5% of them.
063,705 sites were scanned from 21 to 22 September 2026. Sites we could not reach at all are in none of these figures: a server that never answered has no consent behaviour to judge either way. Individual shops are not named, and neither are the listings they were drawn from. Percentages are of the 3,705 scanned sites unless a line says otherwise.
07Every figure here describes 21 to 22 September 2026 and nothing since. A shop or a tool that has changed after that window will not show it until the next census, which we will run over the same population and publish the same way. Each visit is kept whole behind these counts: when it ran, what was in the cookie jar at each step, how the banner was recognised and how the refusal was clicked, so any number above can be traced back to the visits it was counted from. A vendor named above who reads their row differently can write to contact@katla.app, and we will go back to the evidence and correct the page if the row is wrong.

Would your shop have passed?

Katla runs the same check on your site: every cookie recorded before and after the banner, and a reject control we actually click.

Scan your site free