CheckEAA

Original research by CheckEAA, 479 online shops, tested 5 November 2026

BFSG Report 2026: How accessible and cookie-compliant are German online shops?

Short answer

We automatically tested 479 high-traffic German online shops, each on the home page and one product page. 96.5% had at least one automatically detectable WCAG 2.2 AA issue. 38.4% ran analytics or advertising trackers before visitors had clicked anything. 36.6% of shops with a cookie banner had no reject button on the first layer.

with automatically detectable WCAG 2.2 AA issues
96.5%
with tracking before any consent
38.4%
of cookie banners without a reject button on the first layer
36.6%

Results by industry

Share of shops per industry. Industries with fewer than 15 shops are grouped under Other. Base for the reject button: shops with a detected cookie banner.
IndustryShopsWCAG issuesTracking before consentNo reject on layer 1
All shops47996.5%38.4%36.6%
Home, garden & furniture9096.7%40%32.9%
Fashion & shoes8096.2%46.2%41.7%
Drugstore, beauty & health57100%42.1%38.8%
Electronics & tech4995.9%28.6%33.3%
Sports & leisure4695.7%47.8%54.8%
Books, media & toys3594.3%31.4%40%
Food & drink3290.6%34.4%38.5%
Car & motorbike26100%26.9%23.8%
Marketplaces & department stores17100%41.2%31.2%
Other4795.7%31.9%22%

Download totals as CSV

Accessibility: key findings

96.5% of shops had at least one automatically detectable issue, 95.8% at least one rated critical or serious. The median shop had 4 different issue types and 30 affected elements.

The most common rule was "Text with too little contrast" (71.8% of shops). 93.6% of the product pages we tested had at least one issue, right where people buy.

The ten most common barriers

Share of the 479 shops where the rule failed at least once on the home page or product page.

Text with too little contrast: 71.8%Text with too little contrast71.8%Visible label differs from the accessible name: 54.5%Visible label differs from the accessible …54.5%Links without an accessible name: 53.7%Links without an accessible name53.7%Touch targets too small: 38.4%Touch targets too small38.4%Images without alternative text: 29.9%Images without alternative text29.9%Buttons without an accessible name: 26.9%Buttons without an accessible name26.9%Links only recognisable by color: 16.1%Links only recognisable by color16.1%Lists with invalid structure: 15.9%Lists with invalid structure15.9%ARIA roles missing required children: 14.6%ARIA roles missing required children14.6%List items outside a list: 13.2%List items outside a list13.2%
How many different issue types per shop?
0 issue types: 3.5%0 issue types3.5%1-2 issue types: 23%1-2 issue types23%3-5 issue types: 40.3%3-5 issue types40.3%6-9 issue types: 29.9%6-9 issue types29.9%10+ issue types: 3.3%10+ issue types3.3%

Cookies and tracking: key findings

87.9% of shops showed a detectable cookie banner. Even so, 38.4% set cookies from analytics, advertising or session recording services, or sent measurement data to them, before any consent.

On 267 shops our scanner could click the reject button and reload the page. Tracking continued afterwards on 24.7% of them.

Not counted: shops that only send Google Consent Mode pings with consent denied and set no cookie (15.2%), and shops that only load a tracker library without sending data (10.4%).

Which trackers run before consent

Share of all 479 shops. Counted when a cookie was set or a measurement request was sent.

Google Analytics: 16.1%Google Analytics16.1%Google Ads / DoubleClick: 15.9%Google Ads / DoubleClick15.9%Meta Pixel: 12.5%Meta Pixel12.5%Microsoft Clarity: 12.1%Microsoft Clarity12.1%Microsoft Advertising (UET): 7.7%Microsoft Advertising (UET)7.7%TikTok Pixel: 5.4%TikTok Pixel5.4%Pinterest Tag: 3.8%Pinterest Tag3.8%Hotjar: 2.9%Hotjar2.9%

What this means legally

Germany's Accessibility Strengthening Act (BFSG) applies to e-commerce services provided to consumers after 28 June 2025 (§ 1(3) no. 5 BFSG). Micro-enterprises providing services are exempt from the requirements (§ 3(3) BFSG). Offering or providing a service that does not meet the requirements is an administrative offence with fines of up to EUR 100,000 (§ 37(1) no. 8 and (2) BFSG).

Cookies and similar technologies fall under § 25 TDDDG: storing or reading information on the device needs consent unless it is strictly necessary for the service the user asked for. German data protection authorities view a missing, equally easy reject option on the first layer critically when the banner forces users to interact (DSK guidance for telemedia, paras. 56 to 58 and 122).

An automated finding is an indication, not a legal violation in an individual case. This study is not legal advice.

Check your own shop for free

Method

Sample: we started from the public Tranco list JZPGY of 4 November 2026, a research-grade ranking of the most visited domains. From the top 1 million entries we took all 29,761 .de domains and checked the 8,000 highest-ranked with a single home page request for shop signals (a cart plus at least two more signals such as a shop system, product markup or euro prices). This gave 676 candidates. A language model (gpt-4.1-mini, temperature 0) used title and description to decide whether each is a B2C shop for physical goods and which industry it belongs to. 523 German-language shops remained; we used the 500 highest-ranked.

We did not target micro-enterprises; ranking by traffic favours larger retailers. Test period: 5 November 2026. 479 shops could be evaluated; 21 blocked automated access or returned an error and are excluded.

Test: the home page of each shop and, when the home page linked to a product, one product page (327 shops). Headless Chromium with axe-core 4.14 (WCAG 2.0, 2.1 and 2.2 rule sets, levels A and AA). Cookie test on the home page: cookies and network requests in the first seconds without any interaction, detection of the banner and its buttons, then a click on reject, a reload and a second measurement.

  • Passive: no form input, no purchases, no login. The only interaction is clicking reject in the cookie banner.
  • At most three shops at a time, our own user agent pointing to this page, robots.txt respected.
  • Tracking counts only when an analytics, advertising or session recording service sets a cookie or sends a measurement request.
  • Every number on this page is computed by script from the raw data. Raw data with shop names stays internal; only totals are published.

Limits of automated testing

  • Automated tests find only part of all barriers. Deque, the maker of axe-core, puts the share at 57 percent of issues found in its own analysis; many WCAG criteria, such as meaningful alt text or keyboard use through a flow, need a human. The real issue rate is therefore likely higher.
  • We tested two pages per shop, not cart, checkout or account. A shop without findings is not automatically accessible.
  • Cookie banners are detected via known platforms and typical button labels. Unusual banners can be missed. Authorities consider a missing reject button critical mainly when the banner blocks the content; we did not check that per shop.
  • The measurement is a snapshot from Germany with a German browser profile. Shops change constantly.

Frequently asked questions

How many German online shops have accessibility issues?

In our sample of 479 high-traffic shops, 96.5% had at least one automatically detectable WCAG 2.2 AA issue (tested 5 November 2026).

How many shops use trackers before consent?

38.4% of the shops tested set cookies from analytics, advertising or session recording services, or sent measurement data, before visitors consented.

How often is the reject button missing from the cookie banner?

36.6% of shops with a detected cookie banner had no reject button on the first layer.

Which shops were tested?

The 500 highest-ranked German-language B2C shops with a .de domain from the public Tranco list JZPGY. We do not name individual shops; only totals are published.

Does the BFSG apply to every online shop?

The BFSG applies to e-commerce services provided to consumers after 28 June 2025 (§ 1(3) no. 5 BFSG). Micro-enterprises providing services are exempt (§ 3(3) BFSG).

Does a finding mean a legal violation?

No, not automatically. A finding shows a likely barrier or tracking before consent. Whether there is a violation in an individual case depends on further circumstances. This study is not legal advice.

Can I test my own shop the same way?

Yes. The free CheckEAA quick scan uses the same scanner as this study and shows the issues on your home page with a suggested fix.

Sources

BFSG Report 2026: Accessibility and cookie compliance in German online shops | CheckEAA