Pre-consent tracking on Europe's most visited websites (2026)

Results by country

Share of analysed websites per country. The top 50 websites per country domain (.no, .se, .dk, .fi, .de, .fr, .nl, .es, .it) were selected; websites that blocked our browser, did not resolve or returned no web page were excluded, so each country has fewer than 50.

Which consent platforms these websites use

Of the 211 websites where we could identify the consent management platform, these were the most common. We identify a platform by its IAB TCF CMP ID (looked up in IAB Europe's CMP list of 2026-10-22) or, without TCF, by the vendor's script host. Several large publishers run their own in-house platform. Platforms on only one website are left out of the table but included in the CSV.

How much the consent platforms download

Median bytes transferred from each platform's own servers during the first page load, for platforms we could measure on at least 3 websites. This includes scripts, styles, translations and vendor lists that the platform loaded before any choice.

The weight depends on each website's configuration (number of vendors, languages, banner design), so this is what these websites load, not a fixed size per product. Platforms served from the website's own domain could not be measured and are not listed. GetCookies was not used by any website in the sample, so it is not in this table.

Method

1. Sample. Tranco list GQ3QK (generated 2026-10-26, combining Chrome UX Report, Farsight, Majestic, Cloudflare Radar and Cisco Umbrella rankings). For each of the country domains .no, .se, .dk, .fi, .de, .fr, .nl, .es and .it we took the 50 highest-ranked registrable domains: 450 websites in total.
2. Browser. Chromium headless shell 156 with a fresh profile for every website (no stored cookies), desktop viewport 1366×768, language en-GB, time zone Europe/Oslo and a regular Chrome user agent.
3. Vantage point. A Norwegian internet connection. Norway is in the EEA, so the GDPR and the ePrivacy rules apply and websites that show banners by region should show one.
4. Procedure. Open the domain over HTTPS (https:// plus the domain), wait for the page's load event (at most 30 seconds), then wait 10 more seconds without clicking, scrolling or typing. Then record the cookies in the browser, the requests the page made, the IAB TCF API response and Google's consent state.
5. Exclusions. 90 of the 450 websites were excluded because the domain did not resolve, the connection or certificate failed, the server answered with an error such as 403 (often bot protection), or the response was not a web page. 360 websites were analysed.
6. Load on the websites. Each website received one homepage view, the same as a single visitor, and only a few websites were loaded at the same time. We did not consult robots.txt, and the browser did not identify itself as a crawler, because websites can treat declared bots differently from visitors.
7. Dates. All websites were loaded on 2026-10-27.

Definitions

Before the visitor's choice

Everything that happened from opening the page until the end of the waiting time, with no clicks. A real visitor might see the same page for longer.

Known analytics cookie

A cookie named _ga, _ga_*, _gid, _hj*, _clck, _clsk, _pk_id*, _pk_ses*, ajs_anonymous_id, amplitude_id* or mp_*_mixpanel.

Known advertising cookie

A cookie named _gcl_*, _fbp, _fbc, fr, IDE, test_cookie, _ttp, _uetsid, _uetvid, MUID, _pin_unauth, _scid, li_fat_id, personalization_id, __gads, __gpi or _rdt_uuid.

Ad pixel request

A request to facebook.com/tr, analytics.tiktok.com/api/v2/pixel, bat.bing.com/action, px.ads.linkedin.com, ct.pinterest.com or tr.snapchat.com.

Google advertising domain request

Any request to doubleclick.net, googleadservices.com or googlesyndication.com. Reported separately in the CSV (23.6% of websites) and not counted as a tracking signal, because Google also serves non-personalised ads and loads ad libraries before consent.

Google Analytics hit

A request to google-analytics.com or analytics.google.com ending in /collect. It counts as a tracking signal when it carries no Consent Mode state (gcs parameter) or reports analytics storage as granted.

Tracking signal

A known analytics or advertising cookie, a counted Google Analytics hit or an ad pixel request.

Google Consent Mode default

A consent default command in the page's dataLayer, or a default state in Google's consent store (google_tag_data.ics).

Identified consent platform

A website that answered the IAB TCF API, or loaded scripts from the host of a known consent platform (for example consent.cookiebot.com, cdn.cookielaw.org or sdk.privacy-center.org).

Limitations

• Only the homepage was loaded, once, on one day. Other pages and later visits can behave differently.
• A cookie or request before consent is not proof of a violation. Some analytics are allowed without consent in some countries, such as analytics cookies with little privacy impact in the Netherlands and audience measurement that meets the CNIL's conditions in France.
• The cookie and endpoint lists are not exhaustive. Tracking under other names, first-party proxies and server-side tracking are not detected, so the real rate of pre-consent tracking can be higher.
• We could only identify consent platforms that use IAB TCF or load from a known vendor host. Websites with their own banner count as having no identified platform, even if they show a banner.
• Some websites treat automated browsers differently; 90 were excluded, mostly for blocking us or not resolving. Large websites with bot protection are therefore under-represented.
• The Tranco list ranks registrable domains, so some entries are service domains (CDNs, APIs, login services) rather than websites people visit directly.
• We measured from Norway. Websites that tailor banners to the visitor's country may behave differently for visitors in other EEA countries.
• We did not test what happens after a visitor rejects or accepts.

Data and code

Aggregated results are free to use under CC BY 4.0 with a link to this page. We do not publish results per website. The crawler and the analysis script are published so the study can be repeated: run the crawler with the Tranco list above and the analysis script on its output.

• Results by country (CSV)
• Consent platform share (CSV)
• Consent platform transfer size (CSV)
• Crawler script (Node.js, Playwright)
• Analysis script (Node.js)

Cite as: GetCookies (Getia AS), "Pre-consent tracking on Europe's most visited websites", data collected 2026-10-27, getcookies.co/research/pre-consent-tracking-2026.

What this means for website owners

Installing a consent banner is not the same as blocking tracking until consent. On the websites we tested, the share with a tracking signal before any choice was about the same with or without an identified consent platform. What matters is whether the tags actually wait: scripts that load before the banner, tags added outside the consent platform, and Google tags without a Consent Mode default are the usual gaps.

To check your own site, open it in a private window, do not click the banner, and look at the cookies and network requests in your browser's developer tools. The Google Consent Mode v2 guide and the help article on scripts that are not blocked cover the common fixes.

Questions about this study