I Hate Cookie Banners

I hate cookie banners. And I hate them even more when the sites showing them don't obey them. Half the websites we loaded this week put one in the way before you can read anything, and plenty of the ones that offer a real choice tuck "reject" behind a second screen of toggles. One Polish local news site's banner tells you it shares data with "1,180 trusted partners". Nobody reads that list. People click whatever makes the box go away.

The deal behind all this friction is simple: the site asks first, then tracks. Our data says that on one site in four that shows a banner, the tracking does not wait for the answer. With the banner still on screen and untouched, the advertising tags had already reported the visit to Meta, Google, TikTok, LinkedIn or a programmatic ad exchange, or left an advertising identifier in the browser. On most of those sites, whatever the visitor clicks next, that first page view has already been sent.

Last week we published a narrower version of this finding about OpenAI's new ChatGPT ad pixel, which ships with tracking switched on by default. (CipherCue) Several readers asked whether OpenAI was unusual. It is not. Across a random sample of 13,712 websites, OpenAI is ninth on the list of ad vendors firing early, well behind Meta and Google Ads.

How we tested

We took the 106,821 reachable websites we track, mostly European company sites, and put them in random order. Because the order is random, the sites we have scanned so far are a random sample. These figures cover the first 15,583. Of those, 13,712 loaded normally. The other 1,871 blocked our browser or returned an error, so we left them out.

Each site got a brand-new Chrome profile with no cookies or stored data, a normal desktop window, and a normal Chrome user agent. We loaded the homepage, waited ten seconds, and did nothing: no clicks, no scrolling, no mouse movement. We recorded every network request, every cookie the browser held at the end, whether a consent banner was visible, and a screenshot.

A site counts if one of two things happened before any click. Either an advertising endpoint received a request and answered it: a Meta Pixel event at facebook.com/tr, a Google Ads conversion or remarketing hit, a TikTok, LinkedIn, Pinterest or Microsoft Ads event, and so on. Or the browser held an advertising identifier cookie, such as Meta's _fbp or Google's _gcl_au. We report the two separately where it matters. Loading a vendor's script does not count. A Google hit that declares ad consent denied, in either of Google's two consent parameters, does not count either; 1,235 sites (9.0%) sent only such hits, and they are left out.

One thing we can't tell you is whether the tracking started before or after the banner popped up, because we didn't time the banner. What we do know is that it happened while the banner was still waiting for an answer.

Three examples

These three were drawn at random from the sites the scan flagged, then checked by hand. We have redacted their names and logos (see the disclosure note below). Each figure shows what was on screen when the scan finished, and the advertising requests that had already left the browser.

A UK example, before and after "Reject All"

The fourth example is a UK online retailer from the same random sample, and we followed it one step further: we clicked "Reject All" and loaded the page again. It was not chosen because it stands out; about one in four sites showing a banner did the same before a choice was made. The results were the same on four runs in an ordinary Chrome window (fresh profile, no extensions, UK connection) on 26 October 2026.

Banner on screen, ad tracking already active: 23.9%

The 95% confidence interval on the headline is 22.9% to 24.9%. Counting only sites where an advertising request was sent and answered, leaving out cookie-only cases, the figure is 21.7% (20.8% to 22.7%). The headline has moved by less than a point as the sample grew from 5,000 to 13,700 sites, and we expect it to hold for the full run.

Banners that offer a real choice did not look much different. Where the banner had a reject or settings button, tracking was active on 23.2% of sites, against 27.4% for "OK only" notices. This compares sites, not banner designs, so it does not show that the button changes anything; it does show that on those sites the tags had not waited for it.

It happens fast. Measured from the moment the browser requested the page, the median first advertising request went out after 1.8 seconds, and three-quarters within 2.6 seconds; 224 sites (15%) sent one within the first second. Because we did not time the banner itself, this does not say whether a tag beat the banner onto the screen. It does say the tags did not wait for an answer: on every one of these sites the banner was still unanswered when the observation ended.

Many of these sites are not dealing with a single vendor. On 945 the tracking involved one ad vendor, on 350 two, and on 367 three or more.

Which trackers fire first

The cookies these tags leave behind are the familiar ones. Across all 13,712 loaded sites, Meta's _fbp was set before consent on 1,151 and Google's _gcl_au on 1,073. TikTok's _ttp was set on 293 and Microsoft's MUID on 221. On 1,871 of the 2,173 sites with any marketing cookie, at least one was written to the site's own domain. So these identifiers belong to the site itself, not just to third-party domains loaded in the background.

The banner says no; the tags are not listening

Cookiebot exposes the visitor's consent state to the page, so on Cookiebot sites we can read what the banner itself recorded. On 815 sites with a visible Cookiebot banner, Cookiebot reported marketing consent as false. On 260 of those (32%), advertising tracking was active anyway.

Google Ads shows the same mismatch from the other side. Google's tags can take the visitor's choice from the banner ("Consent Mode") and declare it on every hit, in two parameters, gcs and gcd. When ad consent is denied, the tag sends only cookieless pings, which we do not count. Of the 716 sites with a banner on screen and a counted Google Ads hit, 545 (76%) sent hits whose parameters show Consent Mode was not set up for advertising at all: gcd marks ad storage as "not set", or neither parameter is present. The other 171 (24%) declared ad consent "granted" before the visitor had chosen, like the clothing shop above.

Neither result shows that a consent platform is broken, and the scan cannot see how each site installed its tags. What it shows is a mismatch: the state the banner holds and the signals the advertising tags send do not agree. Possible causes include tags installed outside the consent platform, a shop plugin or tag-manager integration that bypasses it, consent defaults that were never set, or defaults set to "granted".

By consent platform

This isn't a league table. Any of these platforms can hold tags back until the visitor says yes; it comes down to how each site sets it up. A news site and a clothing shop also run very different numbers of tags, whichever banner they use.

Shopify is the outlier: on 56% of the shops where we saw Shopify's privacy API, ad tracking was already active. The scan can't tell us whether that came from Shopify's own banner or from one of the shop's ad integrations.

By country: Germany 14.7%, UK 31.2%

German sites with a banner had tracking active at roughly half the rate of British and Dutch ones. This is an observed difference between groups of sites, not evidence of why. We saw the same split with OpenAI's pixel last week, where barely a third of German sites fired it before consent. The country is the one we hold for the company behind each site, which is not always where its visitors are.

Fixing the banners has not happened

The European Commission's Digital Omnibus proposal of November 2025 included a way out of the banners: websites would have had to honour a consent choice set once in the browser. On 21 October 2026 the Council of the EU agreed its negotiating mandate, and that provision (Article 88b in the proposal) is struck out of it, along with the duty on browser makers to support such signals. (Council of the EU) (mandate text) This is a negotiating position, not law: talks start once the European Parliament adopts its own position, and Parliament could still push for the provision. For now, the banner stays.

The rule itself has not changed. Under the EU ePrivacy Directive and, in the UK, PECR, storing or reading non-essential cookies or similar identifiers on a visitor's device generally needs consent first, with exemptions such as cookies strictly necessary for a service the visitor asked for. Our scan records what a browser sent and stored; whether a particular site broke the rules depends on facts the scan cannot see, and is for regulators and courts to decide.

Regulators do enforce the rule. In September 2025 France's CNIL fined the operator of shein.com 150 million euros because advertising cookies were placed the moment visitors arrived, before any interaction with the banner. (CNIL) In November 2025 it fined American Express 1.5 million euros for cookies placed before any choice and after a refusal. (CNIL) In the UK, since 5 February 2026 the ICO can fine up to 17.5 million pounds or 4% of global turnover for breaches of PECR, which covers cookies, up from 500,000 pounds, under the Data (Use and Access) Act 2025. (ICO)

Check your own site in two minutes

If something fires, the fix is often configuration rather than a new tool: load the tag through the consent platform (or mark it so the platform blocks it until consent), switch off tracking in any shop or plugin integration that bypasses the banner, and give Google's tag a Consent Mode default of "denied" for European visitors.

We are still scanning. The full run covers all 106,821 sites and finishes in November; we will update these figures when it does. If you sell consent or privacy tooling, we can share the site-level list for your market, with the evidence behind each observation. Request the list

×

×

×

×

×