Glossier
Beauty · glossier.com
17 out of 20 Trust-aware
The banner exists, the refusal button is written and waiting, and Canada is in the one rule configured never to show it.
How many clicks to find the privacy policy from the homepage?
One click, from the footer. “Privacy Policy” opens as a web page, with a separate US State Privacy Notice linked beside it.
Is there a meaningful choice about cookies and tracking before data is collected?
No banner here, and it is a setting, not an absence. Glossier runs OneTrust, and its published rule set has three rules: the United States rule and the European rule both carry ShowAlertNotice true, and the European one already has “Decline all cookies” written into it. The global rule, which is the one covering Canada, carries ShowAlertNotice false. A footer link called Cookie Preferences does open a full preference centre, which is why this is a 2 rather than a 1, but every optional category in it arrives switched on and nothing on the page says so.
How hard is the policy to read, how much of it is there, and can you get it in one piece?
Grade 13.7 across 3,154 words, in one place. Difficulty 1, length 3, access 4. One of the shorter policies measured here, which is the main reason it reads better than most. Measure it yourself.
How many clicks to reach data settings, and can you delete your account yourself?
A rights form two clicks away, and an address that is only for privacy. The policy links a OneTrust webform for access, correction and deletion, reachable from the footer without an account, and publishes Privacy@glossier.com alongside it.
Find the support page. How many clicks, and is there a way to speak to a human?
Contact in the footer, answered by a named team. gTEAM@glossier.com is published on the contact page, one click from any page, with a chat widget beside it.
Overall finding
17 out of 20 Trust-aware
Glossier is the clearest case in this batch of a consent banner being a jurisdictional artifact rather than a decision about people. The banner is built, the decline button is written, and Americans and Europeans both see it. Canadians are inside the global rule, where it is switched off, so tracking starts on arrival and the only way out is a footer link you would have to know to look for. Everything downstream of that gate is good: a short policy, a real request form, an address that exists only for privacy. The policy also still carries three contents links that bounce through Google into Glossier’s own Shopify admin, which is what happens when a document is pasted out of a Google Doc and never read again.
- Scored
- 17 August 2026
- Region
- Canadian site, Ontario IP, private window
- Session
- Logged out throughout
Scored from public evidence only. No company can pay to change a score, and paid relationships are disclosed here. Read the independence statement.