We checked every hotel with a star rating in North Cyprus. Small ones go missing. Big ones track guests before asking.
Small hotels lose the guest who looks them up by name. Big hotels hand that guest's visit to Google and Meta before asking.
QUICK ANSWER
Elevates checked all 85 rated hotels on the North Cyprus register on 10 October 2026. Nineteen have no website that works, mostly one and two star hotels. Of the 66 sites that load, 37 start Google, Meta or Yandex tracking before the guest agrees, including 19 of 25 five star hotels. The figures show each class.
A guest who has heard about a hotel types its name into Google. For nineteen of North Cyprus's rated hotels, what comes back is a booking site, a parked domain, a security warning or nothing at all. For most of the big hotels, the site loads fine, and Google, Meta or Yandex know about the visit before the guest has agreed to anything.
Nobody had counted either thing for the whole island. So Elevates did.
The register lists 85 rated hotels, and Elevates looked for every one
The tourism planning office publishes a register of licensed accommodation. Its August 2026 edition names 85 hotels with a star rating: 25 with five stars, 5 with four, 17 with three, 24 with two and 14 with one. It gives a name, a town and a phone number for each, and no websites.
Elevates searched for every hotel's own website, opened each one, and on 10 October 2026 checked what a visitor's browser receives before touching anything.
Figure 1The register
Eighty five hotels. Nineteen have no site that works.
Every hotel with a star rating on the North Cyprus register, one mark each, checked 10 October 2026.
Nineteen have no website that works
Twelve hotels have no website of their own at all: an Instagram account, a Facebook page, listings on booking sites, and nothing else. Two more have only a third party page where their own website should be.
Five have a website address that turns guests away. One shows a security warning because its certificate expired in July. One shows only a "Coming Soon" page. One domain is dead, one shows only its registrar's parking page, and one points nowhere at all.
A dead or parked domain is often a sign that nobody at the hotel controls it any more, which is a more common problem than it sounds.
The missing ones are mostly small
Every five star hotel on the register has a website that works. Of the nineteen without one, fourteen are one or two star hotels, and eight of the fourteen one star hotels have nothing a guest could open.
A small hotel with no website is not invisible: it is on booking sites, and often on Google Maps. But every guest who finds it there books on someone else's terms, and a guest who looks it up by name to book direct finds nothing to book on. A free Google Business Profile is the floor, not the answer.
Most of the sites that work start tracking before anyone agrees
Of the 66 hotel websites that load, 37 set tracking cookies or send tracking data in the first seconds of a visit, before the visitor has clicked anything. Google's tags are on 31 of them, Meta's on 18, Yandex's on 9, Microsoft Clarity on 6 and TikTok's on 3.
Thirty five of those 37 show no cookie banner at all. Across all 66, only 10 show a banner of any kind, and on two of those the tracking had already started behind it. That second pattern is the one Elevates found on European policy institutes' sites too: the banner is there, and it is late.
The bigger the hotel, the more it tracks
The two failures run in opposite directions. The small hotels are the ones missing a website; the big ones are the ones whose websites track first.
Figure 2By class
Small hotels go missing. Big ones track first.
For each class: hotels with no working website, and working sites that track before the visitor agrees.
Nineteen of the twenty five five star sites track before consent. Among the working one star sites, two of six do. One likely reason: the hotels that run advertising campaigns install advertising pixels, and the pixels arrive with the campaign, not with a consent step.
Why a hotel in the north should care what Europe thinks
North Cyprus sits outside EU law by treaty, and geography alone does not bring a business inside the GDPR. What can bring it in is Article 3(2): offering services to people in the EU, or monitoring their behaviour there. The European Data Protection Board's guidelines on territorial scope list "online tracking through the use of cookies" among the activities that can count as monitoring, depending on what the data is used for.
A hotel selling rooms to British, German and Dutch guests, with Meta's pixel firing on every visit, is close to the case the guidelines describe. This post does not say any hotel is breaking the law; that depends on facts a homepage cannot show. It says the question is live for 37 of them, and the answer starts with what the browser receives.
A working site is where a direct booking can happen
Of the 66 working sites, Elevates confirmed a link to an online booking engine on 38: a page where the guest picks dates and sees what is free. The engines are mostly the ones the island's hotel trade already uses, HotelRunner, Rezervasyonal, Reseliva, or the hotel's own booking subdomain. On the other 28 Elevates could not confirm one from the homepage, which is not the same as there being none.
For the nineteen with no working site, that number is zero by definition. Every booking they take online arrives through someone else.
What this costs a hotel, and what Elevates would change
For a small hotel, the cost is the guest who already chose it and could not find a way to book direct. For a big one, it is a risk it may not know it is carrying: the tracking was installed with a campaign, by someone who has since moved on, and nobody has looked at the order things load in since.
Both are fixable without rebuilding anything grand. A small hotel needs one page in the languages its guests speak, a phone number, and a booking link. A big hotel needs the banner first and the trackers after consent, which is a change to the order of loading, not to the site. Elevates does both, and the first step is the same check this census ran.
How this was counted
The population is every hotel listed as "YILDIZLI OTEL" in the register's August 2026 edition. Websites were found by searching each hotel's name, then checking its Google listing and Instagram profile, and each one was opened and confirmed to name the hotel. A site counts as working if it loaded with the hotel's own content on either of two checks on 10 October 2026; two that failed in the morning worked by midday and are counted as working.
Tracking was measured by loading each homepage in a clean browser with no history, clicking nothing, and recording the cookies set and the requests sent in the first eight seconds. Two sites that block automated browsers were checked the same way in an ordinary browser. The census is aggregate: no hotel is named here.
Ask for your hotel's row
If you run one of the 85, Elevates will send you your hotel's own result: whether the site works, what loads before consent, and whether a guest can book from the first page. It costs nothing, and it is the same check, done again on the day you ask.