Spain runs Europe’s most GDPR-compliant cookie banners, with 28% of its top-site interfaces meeting the minimum bar for lawful consent, versus just 3% in Slovenia, according to a CHI 2025 study of 254,148 websites across 31 countries. The gap between the best- and worst-performing countries is wide, and it barely tracks with GDPR tenure or fine size. Below is the full country-by-country breakdown, what changed after regulators intervened, and how the UK’s newer compliance push compares to the EU average this data describes.
Which country has the highest cookie consent compliance rate?
Spain tops the ranking at 28% of interfaces meeting the minimum compliance test, per Nouwens et al.’s CHI 2025 paper, “A Cross-Country Analysis of GDPR Cookie Banners,” which scraped and analyzed 254,148 cookie banners across the top 10,000 websites in 31 GDPR and ePrivacy jurisdictions. Slovakia follows at 25%, then Italy and France tied at 23%.
The study defines a compliant banner as one offering an accept and a reject option with equal visual prominence, plus either a settings screen or granular purpose controls, with nothing pre-checked. That is a floor, not a strong standard, which is why even the leading country clears it barely more than a quarter of the time.
Figure 1: The seven most GDPR-compliant countries for cookie banners, by share of interfaces meeting the minimum test. Source: Nouwens, Kristensen et al., CHI 2025, 254,148 sites across 31 countries.
None of the top seven clear even a third of their banners. Even the countries that lead this list have a long way to go before “compliant” describes most of their websites.
Which countries have the lowest cookie compliance rates?
Slovenia sits at the bottom of the CHI 2025 ranking with just 3% of banners passing the minimum test, followed by Bulgaria at 4%, Hungary at 7%, Estonia at 8%, and the Netherlands at 9%. All five of these countries have been under GDPR for the same period as Spain, so tenure under the law does not explain the gap.
Grouping all 31 countries into rough tiers shows how lopsided the picture is: a small cluster clears 20% or better, most countries cluster in a wide 10-19% middle band, and a handful sit under 10%.
Figure 2: Nearly two-thirds of the 31 countries in the CHI 2025 dataset land in the middle compliance tier; only 7 clear the high bar and 5 sit below 10%. Source: author analysis of Nouwens et al., CHI 2025 country-level results.
Small countries also carry small underlying samples. Liechtenstein’s 12% compliance rate, for instance, comes from just 5 compliant interfaces out of roughly 42 top sites analyzed, so a single-site change would move its percentage more than it would for Germany or France. Treat single-digit-population countries in this dataset as directional, not precise.
Did enforcement actually raise compliance rates in France?
Yes, and by a measurable amount. After France’s CNIL began enforcement action against non-compliant cookie banners in December 2021, French site compliance rose 16.08 percentage points within three months, and climbed a further 21.69 points by September 2022, for a cumulative gain of 37.77 points in under a year, according to a longitudinal tracking study of 11,364 EEA websites from 2018 to 2024.
Figure 3: Compliance gain in French cookie banners in the months after CNIL began enforcement action in December 2021, measured as cumulative percentage points above the pre-enforcement baseline. Source: longitudinal EEA cookie banner tracking study, 2018-2024 data.
France’s fine record backs up the pressure: CNIL issued a 325 million euro fine to Google and a 150 million euro fine to Shein in September 2025, both tied to cookies placed without valid consent. If your business operates in a country where enforcement is active, publishing a clear, current cookie policy alongside a compliant banner is the fastest way to stay off that list; you can generate a compliant cookie policy and match it to whatever consent flow your banner actually runs.
Enforcement moved the needle in France specifically. Whether that pattern holds elsewhere depends on how consistently a regulator follows guidance with fines, which is not something every country in this dataset has done yet.
Is the UK more compliant than the EU average?
On a separate, more recent measure, yes and by a wide margin. The UK’s Information Commissioner’s Office (ICO) reviewed the country’s top 1,000 websites through 2025 and reported in December 2025 that 979 of the top 1,000 UK websites, or 97.9%, now meet its cookie compliance checks. Of those, 415 passed with no ICO contact at all, while 564 fixed their banners after direct engagement from the regulator, leaving only 21 sites still failing.
Figure 4: How the UK’s top 1,000 websites reached 97.9% cookie compliance after the ICO’s 2025 review campaign. Source: ICO, “ICO action secures increased cookie compliance,” December 2025.
The UK figure is not directly comparable to the CHI 2025 percentages above; it measures a smaller, curated set of the largest sites after a year of direct regulator outreach, not a broad top-10,000 sample measured passively. What it does show is that sustained, individualized enforcement moves compliance rates further and faster than guidance alone, which lines up with what happened in France.
Are cookie consent rates improving worldwide?
The direction is upward where regulators keep pushing, though the scope of what gets measured varies by country and study. Across the same 11,364-site EEA dataset used for the France figures, the share of banners offering both an accept and a reject button rose from 2.94% in 2018 to 30.66% in 2024, and consent management platform (CMP) adoption climbed from 11.60% to 40.29% over the same period. Just three CMP vendors now control 37% of that market, which means a handful of default settings shape a large share of the banners in every country on this list.
Figure 5: Key country-level enforcement milestones behind the compliance numbers above. Sources: GDPR effective date; CNIL decisions; ICO campaign announcement and results, 2025.
Outside Europe, comparable per-country compliance studies are thin. We could not find a CHI-2025-equivalent breakdown for the US, Canada, or Asia-Pacific markets, and country-level accept-rate claims for those regions circulating on vendor blogs did not trace back to a disclosed sample or methodology, so we have left them out rather than repeat an unverifiable figure. For the visitor-behavior side of this picture rather than the compliance side, see our breakdown of cookie consent accept rates and trends and how many visitors reject all cookies once a genuine reject option exists.
Cookie consent compliance rates by country: the full list
The table below covers all 31 countries in the CHI 2025 dataset, ranked from highest to lowest share of compliant cookie banners.
| Rank | Country | Compliant interfaces | Compliance rate |
|---|---|---|---|
| 1 | Spain | 1,894 | 28% |
| 2 | Slovakia | 1,815 | 25% |
| 3 | Italy | 1,536 | 23% |
| 4 | France | 1,539 | 23% |
| 5 | Austria | 1,485 | 21% |
| 6 | United Kingdom | 1,416 | 21% |
| 7 | Ireland | 1,217 | 20% |
| 8 | Germany | 1,430 | 19% |
| 9 | Luxembourg | 265 | 18% |
| 10 | Finland | 1,087 | 18% |
| 11 | Cyprus | 166 | 18% |
| 12 | Denmark | 1,210 | 17% |
| 13 | Czech Republic | 1,046 | 17% |
| 14 | Iceland | 280 | 16% |
| 15 | Belgium | 1,057 | 16% |
| 16 | Sweden | 881 | 14% |
| 17 | Latvia | 688 | 13% |
| 18 | Greece | 782 | 13% |
| 19 | Portugal | 711 | 12% |
| 20 | Liechtenstein | 5 | 12% |
| 21 | Malta | 71 | 12% |
| 22 | Romania | 807 | 12% |
| 23 | Norway | 624 | 11% |
| 24 | Lithuania | 604 | 11% |
| 25 | Poland | 658 | 10% |
| 26 | Croatia | 658 | 10% |
| 27 | Netherlands | 620 | 9% |
| 28 | Estonia | 318 | 8% |
| 29 | Hungary | 466 | 7% |
| 30 | Bulgaria | 255 | 4% |
| 31 | Slovenia | 198 | 3% |
Source: Nouwens, Kristensen et al., “A Cross-Country Analysis of GDPR Cookie Banners,” CHI 2025. Compliant interfaces reflect each country’s own sample size within the 254,148-banner study, so small countries (Liechtenstein, Malta, Cyprus) carry wider margins of error than large ones.
The Bottom Line
The country you operate in changes your odds of running a compliant cookie banner more than almost any other factor in this data. Spain’s 28% compliance rate is the best in Europe and still means most of its top sites fail a basic legal test; Slovenia’s 3% means compliance is closer to the exception than the rule. What moves the needle is not tenure under GDPR but active enforcement: France gained 37.77 percentage points after CNIL started fining sites, and the UK’s ICO pushed its top 1,000 sites to 97.9% compliance through direct, individualized outreach rather than guidance alone. If your site operates in more than one of these markets, the safest baseline is to build to the strictest country’s standard rather than the average.
Frequently Asked Questions
Which country has the highest cookie banner compliance rate? Spain leads Europe with 28% of its top-site cookie banners meeting the minimum GDPR compliance test (equal-prominence accept and reject buttons, no pre-ticked boxes), according to a CHI 2025 study of 254,148 websites across 31 countries.
Which country has the lowest cookie consent compliance rate? Slovenia has the lowest rate in the CHI 2025 dataset at just 3% of banners passing the minimum compliance test, followed by Bulgaria at 4% and Hungary at 7%.
Is the UK more compliant than EU countries on cookie consent? By a later, differently measured yardstick, yes. The UK ICO reported in December 2025 that 979 of the top 1,000 UK websites, 97.9%, met its cookie compliance checks after a year-long review campaign, well above the EU country averages in the 2025 CHI study.
Did enforcement actually raise compliance rates in France? Yes. After France’s CNIL began enforcement action in December 2021, French site compliance rose by 16.08 percentage points within three months and by a further 21.69 points by September 2022, per longitudinal EEA banner tracking.
Sources and References
- Nouwens, Kristensen, et al.. (2025). “A Cross-Country Analysis of GDPR Cookie Banners and Flexible Methods for Scraping Them.” CHI 2025, ACM. Analysis of 254,148 websites across 31 countries, including the full per-country compliance table.
- Information Commissioner’s Office (ICO). (2025). “ICO Action Secures Increased Cookie Compliance.” Review of the UK’s top 1,000 websites, results published December 2025.
- CNIL. (2025). Google cookie consent decision, 325 million euro fine. Official regulator decision.
- CNIL. (2025). “Cookies Placed Without Consent: Shein Fined 150 Million Euros.” Official regulator decision.
- Longitudinal EEA cookie banner study. (2024 data). “A History of GDPR Cookie Banner Compliance.” 11,364 websites, 30 EEA countries, 2018 to 2024, including the France pre/post-enforcement figures.
Note: All figures verified as of August 2026. Country-level compliance data is refreshed by primary researchers infrequently, so headline figures in this article are re-checked and refreshed at least twice a year. The UK figures reflect a different, later measurement window than the EU country table and should not be averaged together.
