Sites were sampled from the Majestic Million, 10 site per order of magnitude. This was done based on the suspicion that use of the header is different in the long tail of sites.
Testing was done in Sweden with different Accept-Language
headers based on informed guesses about what languages the sites might support. Between any two attempts using the same site cookies were cleared to avoid previous language being remembered, but it is still possible the server had state based on IP that affected results.
By rank (buckets of 10):
- 10-99: 2/10 sites fully localized, 2/10 localized GDPR prompts, 2/10 used physical location/IP.