If you build or run a website, you probably test it from where you sit. For cookie banners and trackers, that means you see one version of your site, and visitors in other countries may see a very different one.
We wanted to know how different, so we measured it.
(General information, not legal advice.)
What we did
On 14 October 2026 we loaded the same websites, on the same day, with the same scanner settings, from two places: a server in Virginia (US) and a server in Frankfurt (Germany, EU).
- The sites: a seeded random sample of popular websites from Google's Chrome UX Report list. 200 of them loaded from both places, so all numbers below compare those 200.
- Homepage only, one visit each, as a first-time visitor: no cookies, and nobody clicked the cookie banner.
- We counted requests to outside companies, requests to services we rate high risk (ad exchanges, data brokers, cross-site analytics, ad pixels, fingerprinting), third-party cookies, and whether a cookie banner appeared.
What we found
| Average per website | Visitor in Virginia | Visitor in Frankfurt |
|---|---|---|
| Requests to outside companies | 106.1 | 60.7 |
| High-risk tracking requests | 12.6 | 3.8 |
| Third-party cookies | 13.2 | 3.1 |
| Showed a cookie banner | 24 of 200 | 45 of 200 |
So the US visit triggered about 3x the high-risk tracking requests and 4x the third-party cookies, before any consent. And 21 sites showed a cookie banner only to the Frankfurt visitor; Virginia never saw one.
Why this happens
Most consent tools look up the visitor's country from their IP address and change behaviour:
- EU and UK visitors generally have to agree before non-essential trackers load, so the banner shows and the trackers wait.
- Most US visitors fall under opt-out rules instead, so many sites load everything at once and show no banner, or a smaller notice.
That isn't automatically wrong. But it has two consequences for anyone testing a site:
- If you test from the US, you never see what your EU visitors get. A broken banner, or a tag that fires before consent in the EU, stays invisible to you.
- If you test from the EU, you may think everyone gets the careful version. Your US visitors may be loading three times the tracking you saw.
One more US detail worth checking: California expects sites to treat the Global Privacy Control browser signal as an opt-out. A site that ignores GPC for its US visitors has a problem that an EU test will never show.
How to check your own site from another country
The quick manual way:
- Connect a VPN to the country you want (say, Germany), then open a new Incognito window.
- Open DevTools (F12), go to the Network tab, and tick Preserve log before loading the page.
- Load your site and don't click the banner.
- Filter with
-domain:*yoursite.comso only outside requests are left. - Note what you see: did a banner appear? Which outside hosts loaded before you chose anything?
- Switch the VPN to the US (or your other market) and repeat in a fresh Incognito window. Compare the two lists.
I wrote up the DevTools part in more detail in Your cookie banner might be decorative.
If you'd rather not juggle a VPN: I build PrivacyFixed, and its free scan lets you pick where the visit comes from (the US, the EU or the UK). The report says which location it used.
Caveats
- Cloud servers, not homes. Both visits came from data-centre IP addresses. Some sites treat those differently from home connections, so a real visitor's numbers can differ.
- One day, one visit, homepage only. Ads and tags rotate; a second visit can load a slightly different set.
- Averages hide a lot. Some sites behaved the same in both places; a few changed dramatically.
- The UK isn't in these numbers. Our scanner can also visit from London, but we haven't run this comparison from there yet.
The takeaway
Your site doesn't have one privacy behaviour; it has one per region. Test it from each place your visitors come from, before consent and after a Reject, and you'll catch the problems your own location hides from you.
Happy to answer questions about the method in the comments.
Top comments (0)