We audited 216 beauty brand websites: whatever the platform gave them, that is what is there

Per brand we examined the homepage, one category page and one product page. Some of it over plain HTTP, some in a real browser — because tags like the Meta Pixel are no longer written into the HTML source; Google Tag Manager injects them at runtime. You cannot see them without running the page.

The tool, the brand list and the aggregate results are open source: github.com/soleach/soleach-web-scraper. Run it with your own list and produce your own data.

Three limits worth stating up front

• We reached 189 of 216 brands (88%). Of the remaining 27, sixteen returned a direct 403 to our openly identified crawler. That is not an error, it is those sites' choice — and a finding in itself.
• We never touched the cookie banner; consent is the visitor's to give, not a crawler's. So every tag we saw is one that fired before the visitor agreed to anything. The cost is that a site correctly withholding its tags shows us no pixel at all, and we did not count those sites as having none.
• 63% of sites sit behind a CDN with no mention of AI crawlers in robots.txt. The real policy may live in a Cloudflare panel we cannot see. We marked those brands as unmeasurable rather than as allowing access.

79 of the 189 reachable brands (42%) publish a substantive llms.txt file. The file is a proposed standard for describing a site to AI engines (llmstxt.org), and 42% is far higher than we expected for this market.

Then we split the result by e-commerce platform, and the picture changed completely:

• Of the 66 brands on Shopify, 64 have llms.txt — 97%.
• Of the 123 brands not on Shopify, 15 have it — 12%.

So the headline 42% is not evidence of AI-visibility awareness. Shopify generates the file for its tenants automatically. A Turkish beauty brand that is not on Shopify has roughly a one-in-eight chance of having one.

Without that split, the biggest claim in this article would have been wrong: we would have written that Turkish beauty brands are doing better at GEO than expected.

The first finding suggests a pattern; the second confirms it. We looked at two things that require deliberate setup. Both are almost entirely absent.

FAQPage markup: 1 brand out of 189

This is the cheapest win in AI visibility: a few lines of markup that make the questions and answers on your page machine-readable (schema.org/FAQPage). Answer engines look for exactly this shape. In Turkey's beauty sector one single brand does it — 1 in 189, or 0.5%.

ViewContent on product pages: 4 shops out of 116

This one costs money directly. ViewContent is the signal telling Meta that a visitor looked at this product (Meta Pixel standard events). Without it you cannot run catalogue campaigns, cannot retarget by product, and cannot tell the delivery system which items attract interest. Of the 116 brands with their own shop, four fire it — 3%.

And this is not a platform limitation. It is present on 2 of 63 Shopify shops and 2 of 53 shops elsewhere. Shopify hands you llms.txt for free, but ViewContent has to be configured — and nobody configures it. That is the pattern: whatever the platform gave them, that is what is there.

Of the 175 sites we could render in a browser, 34 (19%) sent Meta Pixel requests. That share looks low, but remember: sites correctly holding their tags until consent are invisible here, so real installation is higher.

The real finding is inside that group. Of the 34 sites with a live pixel, 11 (32%) send no event identifier. That parameter is what lets Meta match a browser event with the same event sent server-side through the Conversions API and count it once (Meta: deduplicate pixel and server events). Without it the same purchase is counted twice, reported ROAS comes out higher than reality, and budget drifts to the wrong channel.

One unexpected detail: among Turkish brands, 13 of the 15 with a pixel set an event identifier; among global brands it is 7 of 12. The sample is small and should be read cautiously — but it does not support the assumption that local brands lag on this.

Recall that we never touched the cookie banner. On that basis the 175 sites we could render split four ways:

• A banner is shown, but marketing tags had already fired: 60 sites (34%).
• No consent interface at all, tags firing: 51 sites (29%).
• Tags withheld, consent awaited — the correct behaviour: 35 sites (20%).
• No tags at all: 29 sites (17%).

In other words, on most sites that show a banner the banner is decorative: marketing tags start running before the visitor presses accept.

There is a nuance here, and missing it produces the wrong conclusion. With Google Consent Mode active, a GA4 tag can fire while storage is denied — that is correct behaviour, and we saw Consent Mode signals on 101 of 175 sites (58%) (Google: Consent Mode). The Meta Pixel has no such intermediate state: it either fires or it does not.

A distinction matters here. Training crawlers (GPTBot, ClaudeBot, CCBot) collect content to train models; blocking them is a defensible choice, and 6 brands do it. Retrieval crawlers (OAI-SearchBot, ChatGPT-User, PerplexityBot) fetch a page while answering a user's question; blocking those removes the brand from AI answers entirely.

None of the 189 brands blocks the second group. That was our expectation, and it was wrong.

But the number that matters is a different one: 175 of 189 brands (93%) have no rule about AI crawlers in robots.txt at all. Neither permission nor prohibition — the subject has never been addressed. On top of that, 63% sit behind a CDN, so we cannot even be sure the brand side knows where the decision is being made.

Structured data follows the same pattern: 60% of homepages carry Organization markup (mostly a theme default), 12% BreadcrumbList, and 70% of product pages carry Product markup — but only 29% include an aggregate rating. Whatever the platform put there is still there.

The data says something simple: your platform gives you a floor, and nobody builds on top of it. Whoever does, gets ahead. Cheapest first:

• Set up ViewContent. If you have your own shop and this event does not fire on your product pages, you are sending Meta no product signal at all. One-off work, direct campaign impact.
• Add an event identifier. If you run the Pixel and Conversions API together without deduplication, your conversions are being reported inflated.
• Add FAQPage markup. A few lines — and something exactly one brand in the sector does.
• Take a deliberate position in robots.txt. At minimum, know what you are telling which crawler; the decision has probably been made in a CDN panel.
• Write an llms.txt. If you are not on Shopify, you almost certainly do not have one.

The tool, the brand list and the aggregate results are public: github.com/soleach/soleach-web-scraper. The crawler obeys robots.txt, identifies itself, and never impersonates another user agent.

We deliberately do not publish per-brand results. We tried: because every field in the dataset is a public observation, row-level anonymity cannot be achieved — with names removed, 216 of 216 rows remain unique once all columns are used together. The only honest options were to name names or to aggregate; we chose the second. Crawl your own list and produce your own per-brand data.

Crawl date: 5 August 2026. The figures describe that day. Sites change; run the same audit today and you will get different numbers, which is exactly as it should be.