Tracking Audit of Swedens Top 100 Ecommerce Sites 2026

The digital measurement landscape has changed dramatically over the past few years.

Browser restrictions have made traditional tracking less reliable. Consent requirements have reduced the amount of observable user data. Server-side tagging and first-party data infrastructure have moved from emerging technologies towards the mainstream. At the same time, advertising platforms have become increasingly dependent on high-quality conversion data to power attribution, audience creation and automated bidding.

In other words, the technical requirements for building a robust measurement setup look very different today than they did just a few years ago.

But has the market kept pace?

Overview of the Tracking Audit

To understand the current state of the market, Ctrl Digital conducted a technical audit of Sweden’s 100 largest e-commerce sites, including companies such as H&M, Coop, Telia, Elgiganten, Lyko, Zalando, and CDON (a complete list of all reviewed companies can be found at the bottom of the article). We wanted to understand not only which technologies companies have adopted, but how mature their implementations actually are.

We examined the technologies and implementation choices that shape modern digital measurement, from consent management and client-side tracking to server-side data tagging and first-party infrastructure.

As a starting point, digital analytics platforms are nearly universal among Sweden’s largest e-commerce companies. 98% of the sites we audited use a digital analytics platform, with Google Analytics 4 present on 90% of sites. Adobe Analytics is present on 8% and is typically deployed alongside GA4, while Matomo appears on just 2%.

But technology adoption alone tells us relatively little about the maturity of a measurement setup. The more interesting patterns emerge when we look at how these technologies have actually been implemented and how they work together.

Three main findings stood out.

1. Server-side Has Gone Mainstream. Mature Implementations Have Not.

Server-side tagging is no longer a niche technology among Sweden’s largest e-commerce companies. 63% of the sites we audited have implemented server-side tagging.

But looking one level deeper reveals a very different picture. Among those implementations, only 15% have IP alignment.

This distinction matters because simply having a server-side tagging environment does not mean that an organisation is realising all of its potential benefits.

In a standard server-side setup, the tagging server is typically hosted on a subdomain such as sst.company.com, while the underlying infrastructure may reside on a different IP range from the main website.

Browser privacy mechanisms can use characteristics of this infrastructure to distinguish the tracking server from the website itself and restrict the lifetime of browser identifiers.

With IP alignment, requests to the tagging server are routed through infrastructure aligned with the primary website, creating a stronger first-party context.

Read more in our dedicated article on ip-alignment for server-side tagging.

The implications are particularly important for attribution and optimization. Shorter-lived browser identifiers can fragment customer journeys. A returning visitor may be interpreted as a new user, and an interaction with an advertising campaign may no longer be connected to a purchase that happens several days later.

For analytics teams, this can make customer journeys and attribution more difficult to understand. For advertising platforms, it can reduce the quality of the conversion data available for optimization.

The market has clearly embraced server-side tagging, but there is still a substantial gap between adopting the technology and fully implementing it.

2. Server-side Is Not Replacing Client-Side Tracking

One of the clearest patterns in our audit is that the move towards server-side tagging has not resulted in client-side marketing tracking disappearing.

Across the sites we audited, we found widespread use of third-party marketing scripts running directly in the browser. Google Ads (69.3%), Bing (68.2%) and Meta (62.5%) were the most commonly detected, but client-side scripts from a broad range of other marketing and analytics platforms were also present.

While 63% of the companies we audited have implemented server-side tagging, 84% of all sites still send marketing requests directly from the browser.

When we cross-reference the two, the pattern becomes even clearer. Of the 63 companies using server-side tagging, 52 (83%) also send requests directly to third-party domains.

In other words, server-side adoption has generally not meant abandoning client-side marketing tracking. Instead, the dominant pattern appears to be a dual setup where server-side and client-side tracking coexist.

This is not necessarily a sign of an incomplete implementation. For major advertising platforms, browser- and server-side signals are often designed to complement each other. Meta, for example, recommends using Conversions API alongside the Meta Pixel, with events deduplicated when the same conversion is sent through both channels. Combining the two can provide advertising platforms with a more robust feedback loop for attribution and campaign optimization.

What our external audit cannot determine, however, is whether this coexistence is intentional.

For some companies, maintaining both browser- and server-side signals may be a deliberate measurement strategy. For others, the client-side requests may simply remain because only parts of the existing tracking architecture have been migrated server-side.

That distinction also matters for site security and performance. Moving appropriate data collection and vendor communication server-side can reduce the number of third-party scripts and requests executed in the browser. This reduces reliance on third-party code running directly on the site and can improve page performance, stability and load times, all important considerations for user experience and technical SEO.

The relevant maturity question is therefore not whether client-side tracking still exists, but whether companies have deliberately designed the division between browser and server around measurement quality, performance and control.

3. Privacy Implementation May Be Moving Faster than Measurement Adaptation

Consent requirements have changed how much data companies can collect through traditional browser-based tracking and when that collection can begin. To see how consent is handled in practice, this tracking audit looked at three specific mechanisms across the sites: blocking popups, the balance between opt-in and opt-out choices, and the adoption of Advanced Consent Mode for Google Analytics.

71% of E-Commerce Sites Use Blocking Cookie Banners

71% of companies use a blocking pop-up, meaning visitors are required to make an active consent choice before they can continue navigating the site.

This approach allows consented data collection to begin from the visitor’s first page view if they choose to accept. For the user, however, it requires an immediate interaction before accessing the site’s content.

The audit also shows that 66% of the e-commerce companies block non-essential cookies entirely until consent has been registered.

Under EU rules, consent is generally required before non-essential cookies or similar technologies are used. This makes pre-consent blocking an important part of how many companies approach privacy compliance.

64% Make It Equally Easy to Accept or Decline Cookies

64% of the e-commerce companies have designed their cookie consent banners so that it is just as easy to accept as it is to decline tracking. This can mean that the buttons to accept or reject are given the same visual weight and color coding.

European consent requirements state that users must be able to make a freely given choice, and declining consent should not be made unnecessarily more difficult than accepting it. A symmetrical consent banner, where accepting and declining are presented with comparable prominence, is therefore an increasingly common way of meeting these requirements. Yet just over a third of the sites we audited (36%) still make it more difficult to decline than to accept cookies.

Moving towards more transparent and symmetrical consent choices may also result in a higher proportion of users declining tracking. This can create further measurement gaps in conversion and transaction data, reducing the volume of observed data available for attribution, modelling and automated bidding.

Only 53% Use Advanced Consent Mode

Just over half of the companies deploy Advanced Consent Mode. This technology allows cookieless pings to be sent to Google when consent has not been granted. These signals can then contribute to Google’s modelling of gaps in observed behaviour and conversions rather than relying exclusively on data from consenting users.

The Trade-off Between Privacy and Measurement

Blocking non-essential cookies until consent has been collected represents a more restrictive approach to data collection. From a measurement perspective, however, it also comes with a trade-off: less directly observable data is available for analytics, attribution and advertising platforms.

Advanced Consent Mode is one technology designed to mitigate parts of this measurement gap.

An interesting pattern emerges when we combine the two variables.

Among sites that block cookies until consent, only 44% use Advanced Consent Mode. Among sites that do not block cookies until consent, adoption rises to 71%.

Our audit cannot tell us why this difference exists. One possible explanation is that companies taking a more restrictive approach to consent are also deliberately more cautious about sending cookieless measurement signals when consent has not been granted. If so, the lower adoption of Advanced Consent Mode may represent a conscious privacy decision rather than a lack of technical maturity.

But that raises another important question: is this trade-off an explicit business decision?

Restricting measurement can affect the amount of data available for attribution, modelling and campaign optimization. The decision therefore has implications beyond privacy and technical implementation.

Ideally, organisations should understand the trade-off they are making and consciously decide where they want to position themselves between a more restrictive privacy implementation and the measurement capabilities available to the business.

If the decision instead sits implicitly within configuration choices made by individual specialists, the organisation may be accepting measurement loss without having made an explicit business decision to do so.

This is why we believe privacy implementation may be moving faster than measurement adaptation. The issue is not necessarily that Advanced Consent Mode should always be implemented, but that the consequences of implementing or not implementing it should be understood and weighed at a business level.

From Technology Adoption to Measurement Maturity

Taken together, the findings paint a more nuanced picture of the Swedish e-commerce market.

The issue does not appear to be a lack of technology adoption.

• Server-side tagging has become mainstream, but implementation depth varies significantly.
• Server-side infrastructure continues to coexist with extensive client-side marketing tracking.
• More restrictive consent practices correlate with lower adoption of Advanced Consent Mode, raising the question of whether privacy implementation is moving faster than measurement adaptation.

The next stage of digital measurement is therefore less about whether individual technologies have been adopted and more about how they have been implemented and how they work together as a measurement architecture.

For companies evaluating their own setup, that changes the questions worth asking.

Instead of simply asking:

“Do we have server-side tagging?”

It becomes more useful to ask:

“How much of our tracking actually operates server-side?”

“Is our first-party infrastructure configured to realise the benefits of server-side tagging?”

“What data are we still sending directly from the browser to third parties, and why?”

“How much measurement data are we losing because of browser and consent restrictions?”

“What have we implemented to mitigate that loss?”

A modern measurement architecture is not defined by the presence of GA4, a consent management platform or a server-side container individually.

It is defined by how those components work together to create reliable, privacy-conscious data for analysis, attribution and optimization.

Methodology

Rather than relying on surveys or self-reported technology usage, the assessment was based on externally observable website behaviour and technical implementations.

We examined areas including:

• Digital analytics platforms
• Server-side tagging
• IP alignment
• Client-side third-party marketing requests
• Cookie and consent behaviour
• Consent Mode implementation

Because the assessment is based on publicly observable website behaviour, it does not provide visibility into companies’ complete internal data architectures, governance processes or technologies that cannot be detected externally.

The Assessment Covers the Following 100 Companies

HM, Coop, Telia, Elgiganten, Apoteket.se, Clas Ohlson, Biltema, Willys, Samsung, Adidas, Tele2, Telenor, Jula, Bauhaus, Comviq, Tre SE, Stadium, Intersport, Kjell & Company, Rusta, NetOnNet, Jysk, Åhlens, Apotek Hjärtat, Byggmax, Mekonomen, Hemköp, ÖoB, Akademibokhandeln, Zalando, CDON, Kicks, Mio, Cervera, Kappahl, Gina Tricot, Hemtex, Synsam, DinSko, Adlibris, Apotea, Lyko, Bokus, Granngården, Naturkompaniet, Bilia, City Gross, NK, Panduro, Webhallen, Ellos, Kronans Apotek, XXL Sport, Blomsterlandet, Lekia, Inet, Scorett, Lagerhaus, Boozt, Mathem, Interflora, ASOS, Ahlsell, Arken Zoo, Elon, Beijer Byggmaterial, Hornbach, Jotex, Bubbleroom, Nelly, Jollyroom, Trademax, RoyalDesign, Chilli, jem & fix, Swedol, Dustin, Sellpy, Power, Partykungen, Fyndiq, Bokbörsen, Bygghemma, NA-KD, Ginza, Babyland, Apohem, K-Bygg, Svenskt Kosttillskott, NordicFeel, MEDS, Proffsmagasinet, Cykelkraft, Ridestore, Nordic Nest, Svenssons, Studentapan, Wexthuset and Funktionsverket.

For questions regarding this study or to discuss a specific tracking setup, please contact [email protected].

Ctrl Digital helps companies design, implement and continuously improve modern measurement architectures across digital analytics, server-side tracking, data collection and activation. If you want to understand how your measurement setup compares with Sweden’s largest e-commerce companies, get in touch.