Anyone who collects public web data at scale has watched the same page behave differently depending on where the request came from. Sometimes the difference is pricing or inventory. Increasingly it is a consent interface: a banner, a reject wall, or a screen demanding money before the article loads.
The useful question is not whether consent interfaces exist. It is where they cluster, how they differ between countries, and how much of what you see depends on your own vantage point rather than on the site. Several large published crawls now answer that, and the picture is less uniform than the phrase “cookie banner” suggests.
Key takeaways
- Across 31 European countries, 67% of top-10k websites show a consent interface, but only 15% of those interfaces meet a minimal compliance bar.
- Prevalence and compliance are different maps. Spain and Germany both banner heavily, yet Spain’s interfaces are minimally compliant 28% of the time and Germany’s 19%.
- Pay-or-okay is overwhelmingly a German phenomenon: 2.28% of German consent interfaces offer a paid alternative, against 0.03% in the United Kingdom.
- On an identical set of globally popular sites, 73.8% showed a banner to a visitor in Germany and 72.9% in Spain, and publishers treat the EU as close to a binary switch.
- One published crawl found 13.9% of EU websites serve a more compliant banner to EU visitors than to US visitors, which means a single-country audit cannot describe what a site does.
Three different things called a wall
Precision matters here, because the three are regulated differently and measured differently.
| Interface | What it does | Can you reach the content? |
|---|---|---|
| Consent banner | Asks for consent, usually with accept and sometimes reject | Yes, often before you answer |
| Reject wall | Offers accept prominently, hides or omits reject | Yes, but refusing is costly in clicks |
| Cookie wall or pay-or-okay | Conditions access on consent or a paid subscription | No, not without choosing |
Only the third genuinely blocks a page. The first two shape what a page does once loaded, which matters enormously if you are collecting data and want to know what an ordinary visitor actually receives.
Prevalence: 31 countries, one crawl
The clearest country backbone comes from a CHI 2025 study that scraped the top 10,000 sites in each of 31 European countries between 12 August and 4 September 2024, reaching 94% of target domains. Overall, 67% of websites showed a consent interface.
| Country | Top-10k sites with a consent interface |
|---|---|
| Germany | 78% |
| Spain | 77% |
| Slovakia | 77% |
| Austria | 76% |
| Italy | 76% |
| Denmark | 75% |
| United Kingdom | 74% |
| France | 73% |
| Romania | 73% |
| Slovenia | 72% |
| Netherlands | 71% |
| Poland | 71% |
| Belgium | 68% |
| Croatia | 67% |
| Sweden | 66% |
| Hungary | 66% |
| Greece | 65% |
| Finland | 64% |
| Ireland | 64% |
| Portugal | 64% |
| Luxembourg | 64% |
| Czech Republic | 63% |
| Norway | 61% |
| Bulgaria | 61% |
| Lithuania | 61% |
| Latvia | 56% |
| Cyprus | 55% |
| Malta | 49% |
| Estonia | 41% |
| Iceland | 39% |
| Liechtenstein | 34% |
| All countries | 67% |
Note carefully what this is. All 31 crawls ran from a single vantage point in Denmark, so the table describes national web cultures and the effect of national enforcement, not what a visitor sitting in Estonia would personally encounter. The authors say so explicitly. It is a map of websites, not of visitors.
Compliance is a different map
The same study scored interfaces against a minimal bar: accept and reject both on the first layer, visually comparable, no pre-ticked purposes, granular controls available. Only 15% cleared it.
| Country | Minimally compliant interfaces |
|---|---|
| Spain | 28% |
| Slovakia | 25% |
| Italy | 23% |
| France | 23% |
| Austria | 21% |
| United Kingdom | 21% |
| Germany | 19% |
| Denmark | 17% |
| Netherlands | 9% |
| Estonia | 8% |
| Slovenia | 3% |
Germany banners more than anyone and clears the bar less often than Spain. The Netherlands, with a well-resourced regulator, sits at 9%. Banner density tells you almost nothing about whether refusing is realistic, which is the part that shapes the data a page actually loads.
Pay-or-okay is mostly a German story
The paid-alternative numbers from the same crawl are small everywhere and wildly uneven:
| Country | Consent interfaces offering a paid alternative |
|---|---|
| Germany | 2.28% |
| Spain | 1.25% |
| Italy | 0.88% |
| Denmark | 0.67% |
| France | 0.44% |
| Austria | 0.14% |
| United Kingdom | 0.03% |
Germany is roughly 76 times the United Kingdom. An IMC 2023 study found the same concentration from a different angle: cookie walls on 0.6% of 45,000 sites overall, but on 8.5% of Germany’s top 1,000. It also found that sites using cookie walls send 6.4 times more third-party cookies and 42 times more tracking cookies than ordinary banner sites, so the wall is not merely a formality.
Both figures are correct and they describe different slices. Pay-or-okay is rare across the long tail and common at the very top of the German market, which is exactly where anyone monitoring news or media content will meet it.
The same site, a different wall
This is the part that matters most for measurement.
A January 2025 crawl visited an identical set of globally popular sites from ten countries. Germany saw a banner on 73.8% of them and Spain on 72.9%, well above the non-EU vantage points. Of the sites reached successfully in all ten countries, 119 showed a banner everywhere and 97 showed one nowhere. Among sites that bannered in exactly two countries, 68 of 72 picked Germany and Spain. Publishers are not tuning per market. They are flipping an EU switch.
A separate crawl of 2,579 websites in December 2024, run from Paris and New York, measured banner design rather than presence. It reported that 13.9% of EU websites show a more compliant banner to EU users than to US users. The starker figure is for non-EU websites: judged compliant 48.4% of the time when viewed from the EU vantage point, and 13.5% when viewed from New York, with non-compliance rising from 29.4% to 63.0%. Same sites, same week, different IP.
The conclusion is unavoidable. A consent audit conducted from one country describes that country, and nothing else. The same logic applies to age verification, which is becoming a geo-compliance testing problem and to any dataset that records a URL without recording where it was observed, a gap we argue for closing in the case for a vantage-point standard.
Where regulators have landed
Positions differ enough to explain the map above, and they keep moving, so treat this as orientation rather than advice and take specific questions to counsel.
The European Data Protection Board’s 2020 consent guidelines took the view that access to a service should not be conditioned on consent to storing or reading information on a user’s device. In April 2024 its Opinion 08/2024, requested by the Dutch, Norwegian and Hamburg authorities, addressed consent-or-pay on large online platforms and concluded that in most cases such platforms cannot obtain valid consent by confronting users only with a choice between accepting behavioural advertising and paying a fee, and that they should consider an equivalent alternative without a fee. Its 2023 cookie banner taskforce report set out the shared position on missing reject options and pre-ticked boxes, while recording that authorities were not unanimous.
The United Kingdom diverges. The ICO’s January 2025 guidance treats consent-or-pay as potentially lawful subject to a factor-based assessment. Its enforcement numbers from 4 December 2025 are more revealing than any crawl: of the top 1,000 UK websites, 979 met its compliance checks, but only 415 passed without intervention. 564 improved after direct engagement, 21 were still failing, and preliminary enforcement notices went out in 17 cases. Baseline compliance among the UK’s largest sites was roughly 40%. The rest moved when chased.
What this means for collection
If you are gathering public web data, consent interfaces change your results in three ways, and only the first is obvious.
- Content access. Cookie walls block the page outright. Concentrated in German-language news and media, rare elsewhere.
- Page composition. Before any consent click, a page in a GDPR-regulated location loads far fewer advertising and tracking third parties than the same page elsewhere. Anything you measure about page weight, requests or trackers is really measuring a consent state.
- Comparability. If half your crawl runs from one country and half from another, you have two incompatible datasets that look like one.
The practical answers are unglamorous. Collect from the country you intend to describe, record the vantage point alongside the URL and timestamp, and record the consent state you measured in, because pre-consent and post-consent are different observations of the same page. Shifter’s residential gateway takes the country in the username, so the same collector can run the same list from several markets without changing anything else:
curl -x customer-USERNAME-country-de-sid-9f3a2b7c-ttl-600:PASSWORD@p.shifter.io:443 \
https://example.com/Country codes are ISO 3166-1 alpha-2, and region, city and ASN filters are available on the Full Geo pool. The geo-targeting documentation covers the syntax and which filters each pool supports.
The bottom line
The web is not uniformly walled. It is walled in patterns that follow national enforcement history, and in a way that responds to where the visitor appears to be. Germany banners most and monetises refusal most; Spain banners nearly as much and does it more cleanly; the United Kingdom’s biggest sites were largely compliant only after a regulator wrote to them. Across all of it, a measurable share of sites quietly serve a different interface to a visitor from somewhere else.
That last fact is the one with teeth. Any claim about what a website shows its users is a claim about a location, whether or not the person making it realises they picked one.
Sources and references
- Nouwens, Kristensen, Maalt and Bagge, A Cross-Country Analysis of GDPR Cookie Banners and Flexible Methods For Scraping Them, CHI 2025. Crawl 12 August to 4 September 2024, top 10k per country across 31 countries. Prevalence, minimal compliance and paid-alternative tables.
- Rasaii, Gosain and Gasser, Thou Shalt Not Reject: Analyzing Accept-Or-Pay Cookie Banners on the Web, ACM IMC 2023. Cookie wall prevalence and cookie volumes on cookie wall sites.
- Yu, Yin and Zimmeck, Global Web, Local Privacy? An International Review of Web Tracking. Crawl 5 to 24 January 2025 from ten countries. Banner prevalence on an identical site set and multi-country banner strategy.
- Grossman, Smith, Borcea and Chen, Using Salient Object Detection to Identify Manipulative Cookie Banners that Circumvent GDPR. Crawl 16 to 23 December 2024 from Paris and New York, 2,579 websites.
- European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679.
- European Data Protection Board, Opinion 08/2024 on valid consent in the context of consent or pay models, adopted 17 April 2024.
- European Data Protection Board, Report of the work undertaken by the Cookie Banner Taskforce, adopted 17 January 2023.
- Information Commissioner’s Office, ICO action secures increased cookie compliance, 4 December 2025.
- Shifter, Residential Proxies geo-targeting documentation. Country, region, city and ASN targeting, and pool support.