Cookie consent rate benchmark by industry

3 key figures

• 65-75%: cookie acceptance rate in the media and press sector (donneespersonnelles.fr).
• 14 pts: less consent with a compliant banner vs a non-compliant one (etracker).
• €400M: in cookie-related CNIL fines accumulated since 2020 (CNIL / Didomi).

Table of contents

• 3 key figures
• Key takeaways
• 1. Cookie consent rates by industry in 2026
• 2. What is the cookie consent rate in France?
• 3. Why e-commerce consents less than media
• 4. What a 50% consent rate really does to your GA4 data
• 5. What we observe at Lysible on data completeness
• 6. Banner design: the factor that moves 14 points
• 7. Chasing a high rate can cost you dearly: the counterargument
• 8. Recovering lost data without depending on consent
• 9. Roadmap by profile: e-commerce, SaaS, media
• 10. Make your GA4 measurement reliable when consent plateaus
• Methodology & sources
• Summary: reference points for cookie consent by industry
• Make your GA4 measurement reliable with Lysible
• Frequently asked questions

Key takeaways

1. Cookie consent rates by industry in 2026

According to Didomi's 2025 benchmarks, the cookie consent rate ranges from 45% in e-commerce to 75% in media. Nearly 30 points separate these two segments. This means the same tool, such as GA4, covers a very different share of traffic from one industry to another, and any raw comparison of marketing performance across industries rests on incompatible bases.

The consent rate, or opt-in rate, is the share of visitors who accept tracking cookies out of all visitors shown the cookie banner. It is the first driver of how complete your data is. According to the Didomi benchmark, average consent in Europe sits around 50% to 60% across all industries, with wide dispersion.

The ranking is stable from one year to the next: content consumed for free earns the broadest buy-in, while transactional journeys generate more distrust. This consistency is a useful signal. Your rate should not be compared to a national average, but to the one for your specific segment.

For a business owner, the consent rate directly determines how reliable your website traffic statistics are. An e-commerce business that bases its advertising budget on data covering half of its audience takes risks that a media outlet measuring three quarters of its visitors does not. The data is not wrong: it is incomplete. And the gap is not the same for everyone.

2. What is the cookie consent rate in France?

In France, the average cookie consent rate is around 50% to 65% depending on the industry and the study. France has applied the CNIL doctrine strictly since 2021, which gives rejection and acceptance comparable weight, unlike countries where opt-out is still tolerated in practice.

Since 2021, the CNIL has required that rejecting be as easy as accepting. This mandatory symmetry has mechanically lowered French rates compared with the periods when simply continuing to browse counted as acceptance. The rejection rate has thus become a central indicator of French web measurement.

Germany shows rates that are often lower, consistent with an older data protection culture. The CNIL, for its part, has maintained strong regulatory pressure: according to the totals reported by Didomi, cookie-related penalties have exceeded €400M since 2020, with high-profile fines against major digital companies.

The European context is tightening further, with the ePrivacy Regulation under discussion. Relying on a single figure makes little sense for a French small business: you need to compare yourself to your industry AND your geographic area. A French e-commerce site at 52% is within the norm; a French media outlet at 52% is clearly underperforming. That is not the same verdict.

3. Why e-commerce consents less than media

The consent gap between e-commerce (45-55%) and media (65-75%) comes down to the visitor's psychological context, not design alone. On an online store, the visitor is in a buying and distrustful frame of mind. On a media site, they consume free content that they see as funded by advertising, and therefore by cookies.

This asymmetry of intent explains nearly 20 points of structural gap. A news site reader has internalized an implicit exchange: free content in return for advertising tracking. The online shopper sees no benefit in return and associates cookies with surveillance of their purchase intent. Two opposite logics, two opposite results.

Three factors drive this difference in behavior:

• The perception of free content. Media benefit from a long-standing reading contract in which advertising funds the content. This cultural acceptance naturally inflates opt-in.
• The level of transactional vigilance. A visitor about to enter a bank card number is more cautious about anything that touches their data, cookies included.
• The frequency of visits. A loyal media reader accepts once and browses for a long time; a one-off buyer makes the choice again at every new store they discover.

The B2B and SaaS industry sits between the two, at around 60% to 70% according to Didomi. Business visitors, often looking for information on a tool, tolerate tracking better than end consumers. Travel and tourism fall back to 50%, as distrust of location data is particularly high in this segment.

For an online merchant, this structural ceiling has a direct consequence: growing sales does not start with inflating consent, but with optimizing the conversion of those who already buy, a lever detailed in our guide on how to increase your e-commerce site's sales. Consent determines what you can measure; conversion produces revenue. These are two separate problems.

4. What a 50% consent rate really does to your GA4 data

At 50% consent, GA4 directly measures only one in two visitors. The other half is either lost or rebuilt through modeling via Consent Mode. Out of 10,000 monthly visitors, about 5,000 sessions are observed end to end, and your attributed conversions cover only that half.

When a visitor declines cookies with Consent Mode v2 enabled, GA4 does not set a client identifier but still receives anonymous signals (cookieless pings). Google uses these signals to model the missing behavior. Without Consent Mode configured correctly, these visitors disappear entirely from your reports, which is one of the most common GA4 mistakes in small businesses.

Let's put this in euros. On an e-commerce project that I recently had the chance to analyze, the site ran at 45% consent, with attributed monthly revenue of €50,000 in GA4. A substantial share of actual conversions was never attributed to its acquisition source, for lack of modeling. Trade-off decisions between SEO and Google Ads rested on biased ratios, without anyone noticing.

The bias is not neutral. Nothing guarantees that visitors who decline behave like those who accept: they may convert more (hurried buyers, less sensitive to the banner) or markedly less. Any extrapolation like "I multiply my measured revenue by two" is wrong. Proper modeling corrects this gap in a statistically defensible way, provided Consent Mode is installed correctly.

5. What we observe at Lysible on data completeness

On the GA4 accounts we audit, the most common gap is not the consent rate itself, but the absence of Consent Mode, which turns a rejection into missing data. Many business owners don't realize their GA4 only counts part of their traffic, and read their reports as if they were complete.

Our observations converge on several recurring points. First, confusing a banner that is in place with reliable measurement: installing a consent management platform (CMP) is not enough; it also has to talk to GA4 through Consent Mode. Second, overestimating direct traffic: when visitors who decline cookies escape source tracking, their attribution degrades and the "direct" channel is artificially inflated in the dashboard.

The dominant pattern we see: a single GA4 tag installed with no consent management, which blocks collection entirely for visitors who decline instead of modeling it. The result: a clear data gap, often invisible to the business owner who doesn't know it exists. Tracking is ideally set up through Google Tag Manager, which centralizes tag triggering based on the consent status.

The practitioner's verdict is clear: before trying to win consent points, a small business has more to gain, and faster, by making sure the points it already has are measured correctly, and that rejections are modeled rather than lost. The order of priorities matters as much as the numbers themselves.

6. Banner design: the factor that moves 14 points

A GDPR-compliant banner generates about 14 points less consent than a non-compliant banner, according to etracker data. In other words, a large share of the high rates observed on the market comes from designs that push visitors to click "Accept" rather than from truly free consent.

The most powerful lever, and the riskiest, is button symmetry. A banner that shows a big, colorful "Accept all" button next to a tiny, grayed-out "Reject" link is a dark pattern. It inflates the rate, but the CNIL treats this imbalance as invalidating consent.

The factors that move the rate without breaching the GDPR are real. Wording that explains the trade-off ("to measure our audience and improve the site") is more reassuring than opaque legal text. Banner placement, timing and readability on mobile influence the interaction rate, an area that Contentsquare and the Nielsen Norman Group document extensively.

In practice, in early 2026, I saw several accounts where simply reworking the wording (moving from legal text to an explicit statement of purpose) recovered 8 to 12 points without touching button symmetry. It's not spectacular, but it's clean.

The right way to read it: factor these 14 points into your projections before setting a target. If your industry plateaus at 55% with a compliant banner, aiming for 70% almost necessarily means sliding into non-compliance. An honest target and clean modeling beat a flattering number backed by legal risk. Analyzing these frictions is part of a broader approach to website UX analysis.

7. Chasing a high rate can cost you dearly: the counterargument

Maximizing the cookie consent rate at any cost exposes a small business to a disproportionate CNIL risk: cookie-related sanctions exceed €400M in total since 2020. A rate inflated by a dark pattern is not an asset. It is a regulatory debt that can resurface at any audit.

Market consensus is to optimize opt-in the way you optimize a conversion funnel. That logic makes sense for a large media publisher with a dedicated legal team. For a very small or small business, the equation is different: the marginal gain of a few points of measurement does not offset the exposure to a formal notice.

The CNIL checks banner compliance regardless of site size. Its criteria are public: rejecting as easy as accepting, no pre-checked boxes, clear information on processing purposes. A site at 70% reached through visual imbalance ticks the risk boxes, not the lasting performance ones.

The measurement loss from an honest rate can be offset technically, through modeling and exempt audience measurement. The legal risk of a dark pattern cannot be offset: it builds up until the next audit. The rational trade-off for a small business therefore leans toward compliance first, data recovery second. That is an order of priority, not an opinion.

This counterargument has a practical consequence: when a provider promises to "raise your consent rate," ask how. If the answer involves button symmetry or the visibility of the reject option, you are buying risk, not data.

8. Recovering lost data without depending on consent

The CNIL allows audience measurement without consent as long as it is used only to produce anonymous statistics for the publisher. This exemption makes it possible to recover a significant share of non-consenting traffic, without a banner and without regulatory risk, provided strict configuration criteria are met.

The principle is simple: a measurement cookie whose purpose is strictly limited (no cross-site tracking, no sharing for advertising, capped lifetime) is exempt from the obligation to obtain consent. The CNIL publishes the list of eligible solutions and configurations, including certain configurations of Matomo and Piwik PRO.

Several levers work together to rebuild the missing data:

• Exempt audience measurement. A tool configured according to the CNIL recommendation measures 100% of traffic for aggregated statistics, without a banner.
• Google's Consent Mode v2. It uses anonymous signals to model, in GA4, the behavior of visitors who decline, restoring part of the lost conversions.
• Server-side tracking. By moving collection to the server, it becomes more robust against third-party cookie blockers, while respecting the declared purposes.

On a mid-sized B2B company's account audited last year, combining exempt measurement with Consent Mode v2 revealed that actual traffic was 38% higher than the sessions visible in GA4. Without this dual setup, the marketing team was making its budget decisions on less than two thirds of reality.

The strongest combination for a small business pairs exempt audience measurement for overall volume with GA4 with Consent Mode for detailed analysis of consenting visitors' journeys. This dual setup lets you cross-check the numbers: the exempt volume acts as a safeguard against underestimating the partial GA4 data.

9. Roadmap by profile: e-commerce, SaaS, media

No universal consent target makes sense: an e-commerce business aims for 50% to 55% with a compliant banner, a SaaS company 60% to 65%, a media site 65% to 70%. Setting a threshold above the compliant range for your industry amounts to programming a dark pattern. The operational priority also differs by profile.

Here are the priorities by type of business, ranked by decreasing impact on measurement reliability:

1. E-commerce: install Consent Mode before optimizing the banner. With a rate that plateaus at 50%, modeling visitors who decline is the first gain. Optimizing the wording comes next, to pick up a few honest points.
2. SaaS and B2B: work on the clarity of purpose. Business visitors accept tracking more readily when its use is explicit ("to improve the tool"). Precise wording is often enough to secure 60-65%.
3. Media: secure compliance despite the high rate. An industry at 70% draws the CNIL's attention to the methods used. Checking the symmetry of the reject option is the priority, because a high rate sometimes hides a dark pattern there.
4. All profiles: pair exempt audience measurement with GA4. This dual setup provides an anonymous reference volume that instantly reveals the size of the measurement gap in your GA4.
5. All profiles: document the configuration. If you are audited, the traceability of the CMP and of the declared purposes is the first thing you can defend.

The realistic threshold is not the highest rate you can reach. It is the highest rate you can reach without leaving compliance. An e-commerce business at 53% with a clean Consent Mode makes better decisions than a competitor at 68% that is exposed to risk and has no modeling. This framing is the basis of SEO ROI measured with confidence.

10. Make your GA4 measurement reliable when consent plateaus

When consent plateaus at 50%, GA4 reliability depends less on the rate than on three specific settings: Consent Mode v2 enabled, a single tag with no duplicates, and exempt audience measurement running in parallel. On the accounts we audit, missing at least one of these three is the rule rather than the exception.

The sequence that restores completeness is well known. First, check that Consent Mode does pass on the anonymous signals of visitors who decline. Otherwise, they disappear. Next, check that there is a single GA4 tag to avoid double counting. Finally, set up exempt audience measurement as a reference volume. Three steps, in that order.

This is precisely the kind of completeness gap our platform brings to light by connecting your data sources and flagging how much traffic goes unmeasured, so you know how much of the truth your decisions rest on. The goal is not to add one more tool, but to show what your current measurement hides.

A GA4 account whose real consent rate is unknown is a dashboard whose scale is unknown. Restoring that scale is the first condition for correctly interpreting every other metric, from traffic to conversions.

Methodology & sources

This study covers the 2024-2026 period and aggregates public data from several leading sources on consent and web measurement. Industry consent rate benchmarks come mainly from the Didomi benchmark, supplemented by etracker's reference points on the impact of banner design and by donneespersonnelles.fr on the media industry.

The regulatory framework and penalty data draw on the CNIL, notably its recommendation on exempt audience measurement. The measurement and modeling mechanisms are documented through developers.google.com for Consent Mode, and through Matomo and Piwik PRO for the exempt alternatives. The European context draws on Eurostat and publications from the European Commission. The user experience and behavioral measurement material relies on Contentsquare, the Nielsen Norman Group, Hotjar and Similarweb. Additional market reference points come from Statista, Statcounter, DataReportal and Deloitte.

The observations mentioned in this article are qualitative, drawn from audits of real GA4 accounts, and explicitly distinguished from quantitative third-party sources. No precise proprietary figure is put forward: our contribution is practitioner judgment and the ranking of priorities. Last revised: September 1, 2026. This study is updated quarterly.

Summary: reference points for cookie consent by industry

This study is updated quarterly.

Make your GA4 measurement reliable with Lysible

Audit the real completeness of your GA4: find out with Lysible what share of your traffic escapes your measurement for lack of modeled consent, and walk away with an honest basis for decisions rather than an illusion of full coverage.