What websites track before you consent: October 2026

Sites where our scan detected a consent management platform (a CMP: the software behind the cookie banner) were more likely than sites with no CMP detected to have loaded a tracker before anyone answered it — 90% against 65%. The typical site with a CMP had already loaded 3 tracking companies by the time the banner appeared, against 1 on sites with none.

This compares two groups of sites in a single snapshot. It isn't evidence that installing a CMP causes more tracking; a likely reason is that ad-funded sites, which load more third parties to begin with, are the ones most likely to run a CMP. It does mean a banner on its own says little about what already loaded behind it. The CMP's own scripts aren't counted as trackers here (see how we classify).

Sites grouped by the last label in their domain, where at least 20 sites in that group were scanned. Pre-consent tracking ranged from 32% of .cn sites to 97% of .jp sites.

Sites in the top 100 were less likely than sites outside the top 1,000 to load a tracker before anyone answered consent: 47% against 76%. Many of the very largest sites are infrastructure and platforms rather than the kind of content-and-advertising sites that make up most of the long tail.

We could identify 221 distinct tracking companies, and advertising companies are the largest group of them.

Of the 11,611 tracking cookies set before consent across every site we scanned, less than half (42%) are set to last more than a year, and 6% carry no expiry at all (a “session” cookie, which normally disappears when the browser closes but can still identify a visitor for the rest of that visit).

Counted per placement: a cookie set by the same company on 500 different sites counts 500 times, not once.

• Region. The scan runs from a server in Germany. Consent behaviour and the ads and trackers a site chooses to show can differ by region.
• One homepage load, no interaction. A fresh browser profile loads the homepage once, waits for the network to go quiet, then waits a little longer for anything that fires late. It never clicks, scrolls or answers the consent banner.
• Which sites. Targets come from the Tranco list (list Y83YG), a research ranking of popular domains. Adult and gambling sites are excluded, and sites are skipped where robots.txt disallows crawling the homepage. Of 5,000 attempted, 2,450 loaded and were published; the rest failed to load, blocked the scanner, or were excluded.
• “Tracking” means an advertising, analytics or social-media company, or an advertising or analytics cookie. Companies and cookies we couldn't identify are not counted as trackers, so the real share is a floor, not a ceiling.
• Not a legal finding. Whether a cookie needs consent depends on its purpose and on the law where the visitor is. This report describes what one automated scan observed on one page load; it is not an accusation and not legal advice.

Read the full methodology.

You're welcome to cite or link to this report. A suggested citation:

“What websites track before you consent: October 2026.” CookieTosser, October 2, 2026. https://www.cookietosser.com/report

Figures update with each monthly scan; the numbers above reflect the October 2026 crawl. If you spot an error, see corrections.