In a scan of 23,367 small-business websites, more than one in four fired an advertising pixel before the visitor had said anything at all.
Short on time? Jump to "How to check your own site" and "How to fix it" near the end: a DevTools checklist and the fix for each of the three setups we see most.
Ask a small business owner whether their website tracks visitors, and you will often get a shrug. Ask whether they run ads on Instagram or Google, and the answer is usually yes. Those two answers are more closely connected than most people realize.
In October 2026 we scanned the websites of small businesses across seven EU countries. We were looking for trackers that load before a cookie consent choice, or keep loading after the visitor refuses. Analytics showed up everywhere, as you would expect. But the finding that stuck with us was narrower: advertising pixels, the small scripts that report visits and purchases back to ad platforms, were firing before consent on 6,680 of the 23,367 sites we analyzed. That is 28.6%, more than one in four.
This piece looks at why that happens, what it looks like on real (unnamed) sites, how to check for it and how to fix it.
What an ad pixel actually does
An analytics tag answers the question "how is my website doing?" An advertising pixel answers a different one: "which of my ad viewers came here, and what did they do?"
When a pixel loads, it typically sends the ad platform a signal that a particular browser visited a particular page, often along with an identifier stored in a cookie. The platform uses that signal to attribute conversions to ads, to build remarketing audiences ("people who viewed a product but did not buy"), and to train the platform's targeting.
For an advertiser, this is useful. It is also the textbook example of a non-essential tracker. EU rules require prior consent for non-essential trackers, and regulators expect a visitor to be able to say no before an ad pixel loads, not after.
The numbers
We looked for the usual advertising tags. Here is how often each one fired before any consent choice:
- Google Ads/DoubleClick: 4,309 sites
- Meta Pixel: 3,932 sites
- TikTok Pixel: 282 sites
- LinkedIn Insight Tag: 272 sites
- Pinterest Tag: 241 sites
- Criteo: 58 sites
Two platforms dominate. That is not surprising: Google and Meta are where most small businesses buy ads, and both make their tags very easy to install. The smaller pixels still matter, but they form a long tail.
Pixels also travel in groups. On 1,688 sites, both the Meta Pixel and Google Ads fired before consent. Among the 6,680 sites with at least one pre-consent ad pixel, 4,701 had one, 1,610 had two, 305 had three and 64 had four or more distinct ad pixels running before the visitor chose anything.
The banner that was never there
Here is the part that changes how you think about the problem. Of the 6,680 sites, 4,063 (60.8%) showed no cookie banner at all.
That is worth sitting with. For most of these businesses, the issue is not a misconfigured consent tool or a clever dark pattern. There is no consent step whatsoever. The business set up advertising, and nobody set up consent.
It is easy to see how that happens. A typical sequence goes something like this:
- A shop owner opens an ad account to promote a product.
- The ad platform recommends installing its pixel "to measure results."
- The website builder or ecommerce platform offers a one-click integration, or the owner pastes a snippet into the site header.
- Ads start running, conversions show up in the dashboard, and the job feels done.
At no point in that flow is the owner forced to think about consent. The pixel works the moment it is installed, and nothing visibly breaks without a banner. So it stays that way.
The remaining 39.2% are a different story. These sites did show a banner, but the pixel fired anyway. Here the business has made an effort, and the problem is in the wiring.
Three patterns we keep seeing
Without naming any site, these are the patterns behind most of the "banner present, pixel fires anyway" cases.
The hard-coded pixel. A developer or the owner pasted the pixel snippet into the theme header months or years ago. Later, someone added a consent banner. The banner works perfectly for the scripts it manages, but it does not know the pixel exists, because the pixel never went through it. The banner looks right, and the pixel loads on every page view regardless.
The platform integration. Many ecommerce and website platforms offer native "sales channel" or "marketing" integrations that inject ad tags for you. Some of these respect the platform's own consent settings. Some only respect them if those settings are switched on and configured for the visitor's region. Others bypass the site's third-party consent tool entirely. The result can be a banner from one tool and a pixel from another system that never consults it.
The tag manager trigger. A tag manager container fires the Google Ads or Meta tag on "All Pages" or on page load. The consent tool sets a consent state, but the trigger does not check it. The banner and the tag manager both work as designed; they are simply not connected.
In all three cases, the visible banner gives a false sense of security. The owner sees a banner and assumes the job is done.
Platforms: the integration effect
Here is the share of analyzed sites on each platform that fired an ad pixel before consent:
- HubSpot CMS: 57.2% (152 sites)
- PrestaShop: 55.6% (225 sites)
- Magento: 53.0% (83 sites)
- Shopify: 45.1% (1,089 sites)
- Webflow: 41.0% (212 sites)
- WordPress: 33.8% (10,609 sites)
- Squarespace: 26.8% (583 sites)
- Wix: 13.3% (1,157 sites)
A few cautions before reading too much into this. HubSpot CMS, PrestaShop and Magento have small samples, so their exact rates are less stable than WordPress's. And these figures describe the sites in our sample, not what each platform does out of the box.
Still, the shape makes sense. Ecommerce-focused platforms sit near the top, because stores advertise and their ad integrations are close at hand. A marketing-automation CMS appears there too, which fits a customer base that runs campaigns. Platforms at the bottom of the list were not free of the problem; their users simply ended up with fewer pre-consent pixels in our scan.
The key point is that no platform forces you into this. On every platform we saw sites that handled ad pixels correctly and sites that did not. The difference was configuration.
Countries
The rate also varied by country: Poland 40.9%, Ireland 36.4%, Portugal 31.4%, Sweden 27.4%, Belgium 27.1%, the Netherlands 26.1% and France 25.2%.
We would not draw strong cultural conclusions from this. The samples per country differ in size and in the mix of businesses and platforms. What it does show is that this is not a problem of one market. Even the lowest rate in our sample means roughly one in four sites firing an ad pixel before consent.
After Reject
Some sites do offer a Reject button on the first layer of their banner. We clicked it, waited, and browsed up to two more pages. On 15.3% of the sites with a first-layer Reject button, an ad pixel still fired after the visitor had refused.
The Meta Pixel was the most common survivor, on 381 sites. That fits the hard-coded and platform-integration patterns above: a pixel that never went through the consent tool will not be stopped by it.
From the visitor's point of view, this is arguably worse than having no banner. They were offered a choice, made it, and the choice was ignored.
Why advertisers should care, compliance aside
It is tempting to treat consent as a box to tick for regulators. For advertisers, it is also a data quality issue.
When a pixel fires for everyone, the ad platform receives conversions and audience members from people who never agreed to tracking. That data ends up in remarketing lists you should not be targeting and in conversion reports you base budget decisions on. When the setup is later corrected, the numbers shift, and it becomes hard to tell whether a campaign got worse or whether the measurement simply became honest.
For Google, there is an additional layer. Since March 2024, Google has required advertisers in the EEA to use Consent Mode v2, which passes the visitor's consent choice to Google's tags. A site that fires Google Ads with no consent signal is not doing what Google itself expects from EEA advertisers. Consent Mode deserves its own article, so we will save the details for that.
How to check your own site
You do not need special tools for a first look.
- Open a private window. This gives you a clean slate with no stored consent.
- Open DevTools before you load the page. Go to the Network tab and tick "Preserve log".
- Load your homepage and do nothing. Do not click the banner or scroll to dismiss it.
-
Filter the requests. Search for
facebookorfbevents,doubleclick,googleadservices,tiktok,linkedinorpx.ads,pinterestandcriteo. Any match at this stage is a pixel that did not wait. -
Check cookies. Under Application, look for cookies such as
_fbpor_gcl_au. If they appear before you have made a choice, that is another warning sign. - Now click Reject. Clear the log, navigate to another page or two, and filter again. Anything that shows up now ignored the refusal.
- Repeat on a product page or checkout. Some pixels are only added to specific templates.
If you use a tag manager, its preview mode will also show which tags fired and on which trigger. Compare that against the consent state at the time.
How to fix it
The fix depends on which pattern applies to you.
If there is no banner at all. Start by adding a consent tool. Then connect every advertising tag to its "marketing" or "advertising" category. A banner on its own does nothing unless the tags actually wait for it.
If the pixel is hard-coded. Remove the snippet from the theme or header and reinstall it through the consent tool or through a tag manager trigger that requires marketing consent. Search your theme files for the pixel ID to make sure there is no second copy.
If a platform integration injects the pixel. Check the platform's own privacy or consent settings. Many have a setting that tells their integrations to wait for consent, and some only apply it in certain regions. Confirm that the platform's consent signal and your banner agree with each other.
If a tag manager fires it. Change the trigger, or add a consent check, so the tag fires only once marketing consent is granted. Test both the accept path and the reject path.
If you advertise on Google. Set up Consent Mode v2 with a denied default, and update it only when the visitor accepts. This does not replace a consent gate for other pixels, but it is what Google expects from EEA advertisers.
Check each pixel separately. We often see sites where fixing one tag leaves another in place. Fixing Google Ads does not fix Meta, and vice versa.
Finally, retest after every change. The most common reason a fix "did not work" is that a second copy of the pixel is still loading from somewhere else.
What our scan cannot see
A few honest limitations.
Our sample came from website links on public Instagram business profiles in seven EU countries: 37,814 domains, of which 23,367 loaded and were analyzed. That skews toward consumer-facing small businesses, the kind that are likely to advertise on social media. It is not a random sample of all websites.
We scanned from EU IPs with a real Chromium browser and a clean profile, loading the homepage with no interaction. Some pixels only appear on specific pages, after scrolling or after adding to a cart, so our numbers are more likely to undercount than overcount.
Server-side tracking, where the business's own server sends events to the ad platform, is invisible to a browser. A site with no visible pixel may still be sending data that way.
And none of this is a legal assessment of any site. We name no websites and make no claim about any individual business.
The short version
More than one in four small-business sites in our scan fired an ad pixel before the visitor had a say, and six in ten of those had no banner at all. The most common story is not malice or a clever trick. It is a business that switched on advertising and never got around to consent.
The good news is that this is one of the easier problems to fix, once you know it is there.
The full study is here: small-business cookie consent study. For a shorter, practical version of this article, see Meta Pixel and Google Ads Before Consent.
Bannerproof scans websites for trackers that load before consent or after refusal. You can check your own site for free at bannerproof.app.
Top comments (0)