We scanned 98 UK Shopify brands in October 2026 to see how well their ad tracking and product data hold up. Three in four (75%) track visitors before they’ve agreed to cookies, or have no cookie banner at all. Almost all of them (95%) have Google Consent Mode v2 set up. So the setting is usually there; the wiring behind it often isn’t.
The product data showed a similar gap. Seven in ten stores (69%) have no barcodes (GTINs) in their product page data, and nearly a third have lots of titles too short to match Shopping searches well.
These are mid-size UK direct-to-consumer brands across fashion, beauty, food and drink, home, jewellery, pets and outdoor. We haven’t named any of them, and we won’t.
The headline numbers
| Finding | Share of brands |
|---|---|
| Track before consent, or have no cookie banner | 75% |
| Run ad tracking before consent, or have no cookie banner | 70% |
| Fire ad or analytics tags before the visitor chooses | 58% |
| Set tracking cookies before a choice | 52% |
| Have no cookie banner, but tracking still runs | 17% |
| Fire the Meta pixel before consent (of brands using Meta) | 49% |
| Have Consent Mode v2 set up | 95% |
| Show any sign of server-side tracking | 10% |
| Lose the Google click ID (gclid) on landing (of 71 we could test) | 14% |
| Count GA4 page views twice | 9% |
| Still load Universal Analytics | 9% |
| Have no barcodes (GTINs) in product page data | 69% |
| Have 40% or more of titles under 25 characters | 29% |
| Have product pages with no product structured data | 16% |
Tracking results are based on 92 brands. Six blocked our scan or showed no tags, so we left them out. Product results cover all 98.
Consent: the setting is there, the wiring isn’t
This was the biggest finding. On 58% of the sites, ad or analytics tags fired with full consent before the visitor had touched the cookie banner. On most of those (52% of all sites), tracking cookies were set too.
Another 17% had no cookie banner at all, but tags still ran.
Not every case is equally serious. Of the 75%:
| What happened before the visitor chose | Share of brands |
|---|---|
| No cookie banner, but tracking still runs | 17% |
| Ad tags fired or ad cookies were set | 52% |
| Only analytics ran (such as GA4) | 4% |
| Only an ad click ID was saved in a cookie, with no data sent | 1% |
So 70% have a clear problem: no banner, or ad tracking before consent. The other 5% are milder. UK rules allow some analytics cookies without consent if visitors are told and can opt out, but ad tags and ad cookies still need consent first.
What makes this interesting is that 95% of the brands have Consent Mode v2 configured. Consent Mode only works if it starts with consent denied for UK visitors and only switches to granted when someone clicks accept. When tags fire anyway, it’s typically because the default is set to granted, or because some tags load outside the consent setup (from a theme, an app or a hard-coded snippet).
In plain terms: the checkbox has been ticked, but nobody checked what actually happens on the page.
Under UK GDPR and PECR, non-essential cookies and similar tracking need consent first. Firing ad tags before a choice is a clear privacy risk. It also skews your data, because the platforms see visits they shouldn’t, and the numbers stop matching what your banner reports.
We didn’t count Google’s cookieless pings (sent under Consent Mode “advanced” before consent) as a problem. They’re designed to send no cookies or identifiers, and Google uses them to model conversions. Only tags firing with full consent counted.
Meta and Google Ads tags were the worst offenders
Of the 72 brands running the Meta pixel, 35 (49%) fired it before consent. Google Ads tags fired before consent on 47 sites (51%).
These are the tags that build retargeting audiences and feed bidding, so they’re the ones that matter most to get right.
Only 1 in 10 shows server-side tracking
Just 9 of the 92 brands (10%) showed any sign of server-side tracking, such as a first-party tagging domain or a custom tag loader. (Some may send server events we can’t see from the browser, so treat this as a floor.)
Server-side tracking doesn’t replace consent; it still needs the same consent rules. What it does is make the data you’re allowed to collect more reliable: fewer events lost to ad blockers and browser limits, longer-lasting first-party cookies, and better match rates for Meta and Google. Our Meta Conversions API guide explains how it works.
Smaller tracking leaks
- Lost click IDs (14%). On 10 of the 71 sites we could test, the Google click ID (gclid) was dropped on landing, usually by a redirect. When that happens, Google Ads can’t link the sale back to the ad, so conversions go missing and Smart Bidding learns from less.
- Double-counted page views (9%). Eight sites sent each GA4 page view twice, usually from a theme tag and a GTM tag both running. That inflates sessions and drags down conversion rates.
- Universal Analytics still loading (9%). Google switched Universal Analytics off in 2024, but eight sites still load it. It slows the page and collects nothing.
- Microsoft Ads (36%). A third have the Microsoft UET tag installed. Worth knowing if you’re weighing Microsoft Ads as a cheaper second search channel.
Product data: missing barcodes and short titles
For Google Shopping and Performance Max, your product data is your ad. We read a median of 251 products per store, plus six product pages each.
- No barcodes (69%). Most stores have no GTINs in their product page data. Google uses GTINs to match products to searches and to the right product listing, so missing ones can limit reach for branded and resold products.
- Short titles (29%). Almost a third of stores have 40% or more of their titles under 25 characters, such as just the product name. Titles that add the brand, product type, colour, size or material match far more searches.
- No product data on the page (16%). Some stores had product pages with no product structured data at all, so Google has less to check the feed against.
- Promotional words in titles (5%). Words like “sale” or “free delivery” in titles can get products disapproved in Merchant Center.
- Duplicate titles (40%). Many stores have products sharing an identical title, which makes it hard for Google to tell variants apart.
One caveat: we read the storefront, not the feed. Some stores use feed apps that rewrite titles or add GTINs before the data reaches Google. Even so, when the storefront is thin, the feed usually is too. Our guide to Google Shopping on Shopify covers how to fix it.
How to check your own store
Both checks we used are free, take about 30 seconds and need no sign-up:
- The tracking checker opens your page in a real browser, shows which tags fire before and after consent, checks Consent Mode, click IDs and double counting, and gives you a score with your top three fixes.
- The Shopify product checker reads your product data and flags short titles, missing GTINs, structured-data gaps and promotional wording.
If you’d rather have someone look properly, a paid media audit covers tracking, consent and product data alongside the ad accounts.
How we ran the study
- Sample: 98 UK Shopify brands, picked by hand from mid-size UK direct-to-consumer brands. We confirmed each runs on Shopify and is set up for the UK (GB or GBP in the store’s own settings). Household names and marketplaces were left out.
- Tracking: one visit to each homepage from a UK connection on 28 October 2026, in a real browser, with test click IDs. We recorded every tag before any cookie choice, then again after accepting.
- Product data: up to 500 products and six product pages per store, read from the public storefront.
- What it isn’t: a random sample of every UK Shopify store, or a legal assessment. One visit is a snapshot, and some sites may behave differently on other pages or on a repeat visit.
Frequently asked questions
What percentage of UK Shopify stores track before cookie consent?
In our October 2026 study of 98 UK Shopify brands, 75% either fired tracking before the visitor made a cookie choice or had no cookie banner at all. 58% fired ad or analytics tags with full consent before any choice.
If I have Consent Mode v2, am I covered?
Not necessarily. 95% of the brands we checked had Consent Mode v2 set up, but most still let tags fire before the banner was answered. Consent Mode needs to default to denied for UK visitors and only switch to granted after an accept click, and the tags must respect it.
Do cookieless Google pings count as tracking before consent?
We didn’t count them. Under Consent Mode “advanced”, Google tags can send cookieless pings before consent, with no cookies or identifiers, to help model conversions. Only tags firing with full consent counted in our figures.
Does server-side tracking fix consent problems?
No. Server-side tracking still has to follow the visitor’s consent choice. It makes the data you’re allowed to collect more reliable and less exposed to ad blockers and browser limits, but it doesn’t remove the need for consent.
Why do GTINs matter for Google Shopping?
GTINs help Google match your products to the right searches and product listings. Products that should have a GTIN but don’t can get less visibility, especially branded items sold by several retailers.
In short
Most UK Shopify brands we checked have the right settings switched on, but 75% still track before consent or have no banner, only 10% use server-side tracking, and 69% have no barcodes in their product data. Check what your page actually does, not just what the settings say.
Sources
The guidance this study’s checks are based on. Last checked October 2026.
- Guide to PECR: cookies and similar technologies, ICO
- About consent mode, Google Ads Help
- Consent mode overview, Google for Developers
- Universal Analytics is going away, Google Analytics Help
- GTIN [gtin], Google Merchant Center Help
- Title [title], Google Merchant Center Help
Want to know where your own store stands? Run the free tracking checker and Shopify product checker, or book a paid media audit for a full, prioritised plan. If you’d like us to fix it, let’s chat.
Want a senior eye on your eCommerce advertising?
Work directly with the founder: no juniors, no hand-offs, 30-day rolling contracts.