Only 142 of 1,758 shops asked properly.
We visited 1,758 Swedish e-commerce sites as a first-time visitor, recorded every cookie set before, during and after the banner, and checked whether refusing actually worked. 142 passed.
One in twelve passed. Half set tracking cookies before asking.
Each site got one verdict, and it names the first rule it broke. 142 had a lawful banner. 375 set nothing non-essential at all and needed no banner. The rest had a problem before the visitor was asked, or in the way they were asked.
109 of these had cookies before consent that we could not identify
185 of these had cookies before consent that we could not identify
The page loads. The banner appears. The cookies are already there.
Saying no is harder than saying yes.
On 42.9% of the sites we scanned there was a banner with no way to refuse on the first layer at all. Where a refusal control did exist we clicked it, on 633 sites: 290 of those were left with no non-essential cookies afterwards. On the rest, what had been set before the banner stayed put.
refusals that left the visitor with no non-essential cookies
Nearly six in ten run a known consent tool. One in eight built their own. Three in ten show nothing.
We recognised a consent platform on 1,028 of 1,758 sites. 232 showed a banner we could not attribute to any vendor, most of them built in-house. 498 showed no banner at all.
How each tool performed on the sites where we found it
Percentages are of the sites tested with each tool, not of all 1,758. Tools found on fewer than five sites are left out. The reject column is of the sites where a refusal control was actually found and clicked, which is why its denominator is smaller.
Analytics leads, and Meta is never far behind.
_ga was already in the jar on 376 sites when the visitor arrived. Google's analytics and advertising cookies and Meta's pixel take the first four rows between them, and WooCommerce's own attribution cookies take the fifth.
How we checked
Would your shop have passed?
Katla runs the same check on your site: every cookie, before and after the banner, classified by the AI.