What really happens behind cookie banners on ordinary business websites, and why having a banner is not the same as having consent.
If you build or maintain sites for clients: the 5-minute DevTools test is in the section "How to check your own site" below. Everything here was measured in a real browser, not from a survey.
Most people who click "Reject all" on a cookie banner assume that's the end of it. The banner disappears, the site carries on, and nothing about them gets sent to Meta or Google.
We wanted to know how often that assumption holds on ordinary business websites: the bakery, the physiotherapist, the local web shop, the photographer. These aren't the global brands that most cookie studies look at. So in October 2026, we ran our scanner on 37,814 small-business websites in seven EU countries and recorded what each one loaded before any consent was given, and what it kept loading after a visitor clicked "Reject."
Of those, 23,367 sites loaded and could be analyzed. This article focuses on one question: does the cookie banner actually do what it says? Here's what we found.
The short version
- 42.9% of the sites (10,018) loaded trackers or tracking cookies before the visitor made any choice at all.
- 28.6% fired an advertising pixel before consent.
- Only 31.1% of the sites (7,276) showed a cookie banner in the first place.
- Sites with a banner were more likely to track before consent than sites without one: 52.2% vs. 38.7%.
- 51.7% of the sites with a banner offered no "Reject" on the first layer.
- On the 3,514 sites with a first-layer "Reject" button, 21.1% kept firing trackers after the visitor clicked it, and 15.3% kept firing an advertising pixel.
The rest of this article explains how we measured this, what the numbers mean, why it happens, and how to check whether your own site is one of them.
How we did it
A study like this is only as good as its sample and its method, so here they are up front.
The sample. The websites come from public business profiles on Instagram, specifically the "website" link that small businesses put in their bio. That gives a set dominated by small and medium-sized businesses: shops, studios, clinics, restaurants, consultants, creatives. It is not a random sample of the web, and it is not the top-1,000 list that larger studies usually use. We think that makes it more interesting, because this is the part of the web that rarely has a legal team.
We started with 37,814 domains across the Netherlands, France, Poland, Sweden, Belgium, Portugal and Ireland. Of these, 11,838 no longer resolved, a reminder of how quickly small-business sites disappear. Others errored, timed out or blocked automated visits. That left 23,367 sites that loaded normally:
| Country | Sites analyzed |
|---|---|
| Netherlands | 7,817 |
| France | 5,559 |
| Poland | 2,873 |
| Sweden | 2,716 |
| Belgium | 2,564 |
| Portugal | 939 |
| Ireland | 899 |
The visit. Each site was opened in a real Chromium browser with a clean profile, from an EU IP address (Dutch sites from the Netherlands, the rest from Germany), on October 24, 2026. We loaded the homepage without clicking anything and recorded every network request and every cookie set.
What counts as a tracker. We matched requests and cookies against known analytics, advertising and session-recording services: Google Analytics and Tag Manager, Google Ads and DoubleClick, the Meta Pixel, Microsoft Clarity, Hotjar, TikTok, LinkedIn, Pinterest, Criteo and others. We report third-party services like Google Fonts, reCAPTCHA, embedded maps and YouTube separately. They also transfer visitor data, but they aren't trackers in the same sense, and we don't want them inflating the headline numbers.
The Reject test. If a banner showed a "Reject" or "Decline" option on its first layer, we clicked it, kept watching for a few seconds, and then opened up to two more pages on the same site, the way a visitor would keep browsing. Any tracker request or tracking cookie that appeared after the click was counted as "after Reject."
What we can't see. A scanner sees what a browser sees. It can't see server-side tracking, and it can't tell whether a site has a lawful basis we aren't aware of. These numbers describe what visibly happens in a visitor's browser, not a legal verdict on any individual site.
Finding 1: Tracking before consent is the norm, not the exception
Under the EU's ePrivacy rules and the GDPR, regulators expect non-essential trackers (analytics, advertising pixels, session recording) to wait until the visitor agrees. In our sample, 10,018 sites (42.9%) didn't wait, and 28.6% fired an advertising pixel before anyone had been asked anything.
Most of these sites aren't trying to hide anything. The typical story is simple: someone added Google Analytics years ago, a marketer pasted in a Meta Pixel for one campaign, and nobody ever connected either of them to a consent mechanism. On 68.9% of the sites there was no banner at all, so there was nothing to connect them to.
If we also count third-party services like web fonts loaded from external servers, the share of sites with some pre-consent data transfer rises to 70.9%. That's a separate and more debatable issue, and we'll cover it in an upcoming report.
Finding 2: Having a banner doesn't mean having consent
This was the result we least expected.
Sites that did show a cookie banner were more likely to load trackers before consent (52.2%) than sites that didn't show one (38.7%).
That doesn't mean banners cause tracking. It's mostly a selection effect: businesses that run ads and analytics are the ones that go looking for a banner. A site with no marketing scripts has little reason to install one.
But it does show that installing a banner is very often where the work stops. The banner appears and looks compliant, while the scripts behind it load exactly as they did before, because they were never wired to wait for the visitor's answer.
It helps to separate two things that people often treat as one. A banner is a user interface: a box with some text and buttons. Consent is a behavior: scripts that don't run until the visitor says yes, and that stay off when the visitor says no. You can install the first in ten minutes. The second requires every tracker on the site to be connected to the visitor's choice, and on a site that has grown over several years, that's where things slip.
Finding 3: Half the banners make "no" harder than "yes"
There's a second problem with the banners themselves. Of the 7,276 sites with a banner, 3,762 (51.7%) had no "Reject" option on the first layer.
On those sites, visitors could accept in one click, but refusing meant a trip into a settings panel and a series of toggles, or wasn't possible at all. Typical patterns are "Accept" next to "Settings," or a large "Accept" button next to a small text link.
This matters for two reasons. First, regulators have been explicit about it. France's CNIL has fined companies specifically for making refusal harder than acceptance. Second, it shapes what visitors do. When "no" takes several clicks and "yes" takes one, the consent rate a site sees says more about the banner's design than about what visitors want.
It also matters for our measurement. We only ran the Reject test on sites with a first-layer Reject button, because that's the button a typical visitor would see and use. That leaves 3,514 sites: roughly the other half of all banners, the ones that made refusal as easy as acceptance, at least visually.
Finding 4: One in five keeps tracking after you click "Reject"
This is the finding that matters most to anyone who has ever clicked "Reject all" and trusted it.
On 3,514 sites the banner showed a first-layer Reject button. We clicked it. On 743 of them (21.1%), trackers or tracking cookies kept appearing after the click. On 537 (15.3%), those trackers included an advertising pixel.
| Tracker | Sites still firing after Reject |
|---|---|
| Meta Pixel | 381 |
| Google Analytics / GTM | 231 |
| Google Ads | 208 |
| Microsoft Clarity | 167 |
| Hotjar | 54 |
| TikTok Pixel | 40 |
The Meta Pixel was by far the most common thing to survive a "Reject": we saw it on 381 sites, ahead of Google Analytics/GTM (231), Google Ads (208) and Microsoft Clarity (167). Clarity and Hotjar deserve a special mention. They are session-recording tools that can capture how visitors move through a page, and they are exactly the kind of tool consent is meant to gate.
Remember that these are the sites that had done more than most. They had a banner, and the banner had a clearly visible Reject button. They had, on the surface, done it right.
Why it happens
Why would a site keep tracking after the visitor has said no? We didn't measure the causes in this scan. But in our experience fixing sites like these, it comes down to a handful of patterns.
1. The pixel is hard-coded in the theme. The consent tool controls the scripts it knows about. But the Meta Pixel was pasted straight into the header years ago, by a freelancer or through a "custom code" field, and it loads on every page regardless of what the visitor chose.
2. Tag Manager fires on "All Pages." The banner records the consent state correctly, but the triggers in Google Tag Manager were never changed to respect it. The banner says "no," Tag Manager never asks, and every tag fires on page load.
3. A second plugin adds its own tracking. E-commerce, form, popup and "marketing" add-ons often inject their own pixels. The consent tool doesn't know they exist, so it can't block them.
4. Reject only hides the banner. Some setups treat the click purely as a way to close the dialog. Nothing is blocked, nothing is revoked, and the choice isn't passed on to anything.
From the visitor's side, all four look identical. The banner goes away and the tracking continues.
Three sites that look the same from the outside
To make this concrete, here are three composite examples. They are not real businesses, but each pattern is one we see regularly.
The florist with a forgotten pixel. A flower shop installed a consent plugin last year. It correctly blocks the analytics plugin it was configured for. Three years earlier, an agency ran a short Meta campaign for the shop and pasted the pixel into the theme's header. The campaign ended; the pixel didn't. Every visitor who clicks "Reject" still sends a page view to Meta.
The studio with a busy Tag Manager. A design studio routes everything through Google Tag Manager: analytics, an ads conversion tag, and a session-recording tool someone tried out once. The banner sets a consent value in the data layer, but every tag still uses the default "All Pages" trigger. The setup looks professional, and nothing in it waits for consent.
The web shop with two sources of truth. A small online store uses a consent tool and also a shop add-on that "connects your store to social ads." The add-on loads its own pixel through its own code path. The consent tool blocks the pixels it manages and never sees this one.
All three would show a tidy banner with a "Reject all" button. All three would count in our 21.1%.
How to check your own site
You don't need special tools to run the same test we ran. A browser and five minutes are enough.
1. Look before you click. Open your site in a private window and open the browser's developer tools (F12), then the Network tab. Reload the page without touching the banner. If you see requests to google-analytics.com, googletagmanager.com, connect.facebook.net, doubleclick.net, clarity.ms or hotjar.com, they're firing before consent.
2. Click "Reject," then look again. Clear the network log, click "Reject all," reload, and click through to another page or two. Anything from that list that still appears is tracking after refusal. That's the 21% problem.
3. Check the cookies. In the developer tools, open Application (or Storage) and then Cookies. Tracking cookies such as _ga, _gcl_au or _fbp that appear after a refusal point to the same issue.
4. Repeat on more than the homepage. Some trackers are added only on product, checkout or contact pages. Our scan visited up to two extra pages for this reason.
How to fix it
If you find a problem, the fixes are usually straightforward. The hard part is finding every place a tracker is added.
- Make an inventory. List every tracker you see in the Network tab, then find where each one comes from: theme header, Tag Manager, a plugin, a "custom code" field in your site settings.
- Move hard-coded pixels under consent control. Load them either through your consent tool or through Tag Manager with consent-aware triggers. Remove snippets that are no longer used at all.
- Fix Tag Manager triggers. Tags for analytics, ads and session recording should fire only after the matching consent has been given, not on "All Pages."
- Check every plugin and add-on. Look for settings like "enable tracking" or "connect pixel" in shop, form and marketing extensions, and either switch them off or route them through consent.
- Put Reject on the first layer. "Reject all" should be as visible and as easy as "Accept all."
- Test again after every change. A banner that looks right proves nothing. The Reject test does.
For anyone using Google tags for advertising, there's one more layer: since March 2024, Google has required Consent Mode v2 for EEA advertisers. How sites in our sample handle it is a story for an upcoming report.
A note on what this study is and isn't
This study is a snapshot of how real, everyday business websites behave, measured the same way a visitor's browser would experience them. It is not a legal assessment of any individual site, and we have deliberately not named any.
The sample is drawn from businesses with a public Instagram presence, so it skews toward consumer-facing small businesses and shouldn't be read as representative of all websites in these countries. Server-side tracking is invisible to a browser, so if anything, the after-Reject figure describes what's visible rather than everything that's happening. And because we only waited a few seconds and visited up to two extra pages, some trackers that fire later or deeper in a site would not show up in our numbers.
We plan to repeat the scan and publish breakdowns by platform and country, as well as a closer look at Google's consent setup, in upcoming reports.
Bannerproof scans websites for trackers that load before consent or after refusal. You can run the same check on your own site for free at bannerproof.app. More of our research and guides are on the Bannerproof blog.
Top comments (0)