DEV Community: PrivacyFixed

We visited 200 websites from Virginia and from Frankfurt. The US visit got 3x the high-risk tracking.

PrivacyFixed — Tue, 27 Oct 2026 22:02:58 +0000

If you build or run a website, you probably test it from where you sit. For cookie banners and trackers, that means you see one version of your site, and visitors in other countries may see a very different one.

We wanted to know how different, so we measured it.

(General information, not legal advice.)

What we did

On 14 October 2026 we loaded the same websites, on the same day, with the same scanner settings, from two places: a server in Virginia (US) and a server in Frankfurt (Germany, EU).

The sites: a seeded random sample of popular websites from Google's Chrome UX Report list. 200 of them loaded from both places, so all numbers below compare those 200.
Homepage only, one visit each, as a first-time visitor: no cookies, and nobody clicked the cookie banner.
We counted requests to outside companies, requests to services we rate high risk (ad exchanges, data brokers, cross-site analytics, ad pixels, fingerprinting), third-party cookies, and whether a cookie banner appeared.

What we found

Average per website	Visitor in Virginia	Visitor in Frankfurt
Requests to outside companies	106.1	60.7
High-risk tracking requests	12.6	3.8
Third-party cookies	13.2	3.1
Showed a cookie banner	24 of 200	45 of 200

So the US visit triggered about 3x the high-risk tracking requests and 4x the third-party cookies, before any consent. And 21 sites showed a cookie banner only to the Frankfurt visitor; Virginia never saw one.

Why this happens

Most consent tools look up the visitor's country from their IP address and change behaviour:

EU and UK visitors generally have to agree before non-essential trackers load, so the banner shows and the trackers wait.
Most US visitors fall under opt-out rules instead, so many sites load everything at once and show no banner, or a smaller notice.

That isn't automatically wrong. But it has two consequences for anyone testing a site:

If you test from the US, you never see what your EU visitors get. A broken banner, or a tag that fires before consent in the EU, stays invisible to you.
If you test from the EU, you may think everyone gets the careful version. Your US visitors may be loading three times the tracking you saw.

One more US detail worth checking: California expects sites to treat the Global Privacy Control browser signal as an opt-out. A site that ignores GPC for its US visitors has a problem that an EU test will never show.

How to check your own site from another country

The quick manual way:

Connect a VPN to the country you want (say, Germany), then open a new Incognito window.
Open DevTools (F12), go to the Network tab, and tick Preserve log before loading the page.
Load your site and don't click the banner.
Filter with -domain:*yoursite.com so only outside requests are left.
Note what you see: did a banner appear? Which outside hosts loaded before you chose anything?
Switch the VPN to the US (or your other market) and repeat in a fresh Incognito window. Compare the two lists.

I wrote up the DevTools part in more detail in Your cookie banner might be decorative.

If you'd rather not juggle a VPN: I build PrivacyFixed, and its free scan lets you pick where the visit comes from (the US, the EU or the UK). The report says which location it used.

Caveats

Cloud servers, not homes. Both visits came from data-centre IP addresses. Some sites treat those differently from home connections, so a real visitor's numbers can differ.
One day, one visit, homepage only. Ads and tags rotate; a second visit can load a slightly different set.
Averages hide a lot. Some sites behaved the same in both places; a few changed dramatically.
The UK isn't in these numbers. Our scanner can also visit from London, but we haven't run this comparison from there yet.

The takeaway

Your site doesn't have one privacy behaviour; it has one per region. Test it from each place your visitors come from, before consent and after a Reject, and you'll catch the problems your own location hides from you.

Happy to answer questions about the method in the comments.

Your cookie banner might be decorative: how to check what loads before consent

PrivacyFixed — Mon, 12 Oct 2026 17:36:17 +0000

Most websites now show a cookie banner. Far fewer check what the page does before anyone clicks it.

A common pattern: the banner appears, the visitor hasn't touched it yet, and Google Analytics, the Meta Pixel and a session-recording script have already loaded and sent their first requests. The banner is there, but it isn't controlling anything.

In the EU and UK, non-essential trackers are supposed to wait for consent, so this is a real problem for the site owner, and most of them don't know it's happening. Here's how to check your own site in about five minutes, why it usually happens, and how to fix it.

(General information, not legal advice.)

Check it yourself with Chrome DevTools

Open a new Incognito window. You want a first-time visitor: no cookies, no earlier consent choice.
Open DevTools (F12) and go to the Network tab before you load the page.
Tick Preserve log.
Load your site and don't click anything on the banner.
In the filter box, type -domain:*yoursite.com (with your own domain; the * keeps both yoursite.com and www.yoursite.com out). Now the list shows only requests to other companies.

Everything left in that list happened before consent. Look for hosts like:

google-analytics.com, googletagmanager.com (Google Analytics, Google tag)
connect.facebook.net, facebook.com/tr (Meta Pixel)
static.hotjar.com, clarity.ms (session recording)
analytics.tiktok.com, bat.bing.com (ad pixels)

Then check cookies: Application → Cookies. Anything like _ga, _fbp or _hjSession set before you clicked is a tracker that didn't wait.

Finally, click Reject and keep watching the Network tab while you click through two or three pages. Requests to the same trackers after a Reject are the worst case: the visitor said no, and the site kept going.

Why it happens

In my experience it's rarely deliberate. The usual causes:

A hard-coded snippet. Someone pasted the Google tag or Meta Pixel into the theme header years ago, and the banner added later has no control over it.
A plugin or app that loads its own pixel. Many e-commerce and marketing plugins add tracking scripts on their own, outside the banner's control.
Tag Manager triggers. Tags set to fire on "All Pages" run whatever the banner says, unless the triggers or Consent Mode settings are set up for consent.
Pages the banner setup never covered. The home page is fine, but checkout, a landing page or an old template loads trackers directly.

The fix, in principle

A tracker that needs consent shouldn't be able to run until consent exists. The standard way is to make the script inert, then switch it on when the visitor agrees:

<!-- Inert: the browser won't run a script with an unknown type -->
<script type="text/plain" data-consent="marketing"
        src="https://connect.facebook.net/en_US/fbevents.js"></script>

<script>
  // Call this from your banner's "Accept" handler.
  function grantConsent(category) {
    document
      .querySelectorAll('script[type="text/plain"][data-consent="' + category + '"]')
      .forEach(function (inert) {
        var live = document.createElement("script");
        if (inert.src) live.src = inert.src;
        else live.textContent = inert.textContent;
        inert.replaceWith(live);
      });
  }
</script>

Most consent tools use a version of this pattern (their own attribute names), and on WordPress, Shopify, Wix and Squarespace it's normally a setting rather than code. Two things to watch:

Order matters. If an inline snippet calls a library (fbq(...), gtag(...)), the library's queue stub has to exist first. That's why Google's own snippet defines gtag() before the library loads.
Google Consent Mode is different. In its advanced mode, Google's tags load before consent and send cookieless pings by design. Decide which mode you're using on purpose.

After any fix, run the DevTools check again in a fresh Incognito window. A fix you haven't re-checked is a guess.

Doing this at scale

Checking one page by hand is fine. Checking every page, after every plugin update, is where it breaks down, and that's why I built PrivacyFixed. It loads a site in a real browser as a first-time visitor, lists every outside company contacted before the banner is answered, checks whether a Reject is respected, and gives step-by-step fixes for WordPress, Shopify, Wix and Squarespace. Three free scans a day, no sign-up.

But you don't need it to start. Open Incognito, open the Network tab, and look. Most people are surprised by what's already there.

What's the worst thing you've found loading before consent? I'd like to hear it in the comments.