92% of websites set at least one high-entropy tracking cookie before a visitor ever sees or interacts with a consent notice, according to a 2019 audit of 2,000 popular sites by Sanchez-Rola, Dell'Amico, Kotzias, Balzarotti, Bilge, Vervier, and Santos, published at ACM AsiaCCS. That figure is the most detailed public measurement of the practice to date, and newer, larger studies through 2024 keep finding the same underlying behavior under different names: assumed consent, ignored rejection, pre-checked defaults.
The pattern matters because the law is explicit about ordering. Under Article 5(3) of the ePrivacy Directive, a site is only allowed to store or access information on a visitor's device without prior consent if that storage is strictly necessary for a service the visitor requested. A tracking cookie fired before the visitor has made any choice fails that test by definition. What follows is what four separate academic studies, spanning 2018 through 2024 and more than 125,000 combined website checks, found when they measured how often that rule gets broken.
What percentage of websites load trackers before consent?
92% of websites set at least one high-entropy cookie, meaning a cookie carrying a unique, trackable identifier rather than a generic session marker, before displaying any kind of consent notice. Sanchez-Rola et al. reached that figure by manually visiting 2,000 popular websites, attempting to opt out of data collection wherever an option existed, and recording what each site's cookies did before, during, and after that attempt.
The finding held regardless of whether a site later showed a well-designed consent banner. A tracker firing on page load happens before any banner can render, so the presence of a compliant-looking notice a second later does not undo the initial, unconsented cookie drop. This is the structural reason pre-consent tracking is hard to fix with banner design alone: the violation occurs in the milliseconds before the banner exists on the page at all.
Figure 1: Five separate compliance measurements from four studies, 2018 to 2024, sorted from most to least common. Sources: Sanchez-Rola et al. (2019), Utz et al. (2019), Bouhoula et al. (2024), Matte, Bielova, Santos (2020).
Why is loading a tracker before consent a compliance violation?
GDPR and the ePrivacy Directive set a strict ordering requirement, not just a disclosure requirement. Article 4(11) of GDPR defines valid consent as a freely given, specific, informed, and unambiguous indication of the data subject's wishes, given through a clear affirmative act. An affirmative act cannot happen before the visitor has seen the choice, which means any tracker that fires on page load, before the consent notice has even rendered, cannot legally rely on consent as its basis for processing.
Figure 2: The compliance test regulators apply to any tracker present on a page. Source: ePrivacy Directive Article 5(3), GDPR Article 4(11).
Regulators built this two-part test specifically because banner design alone cannot fix a timing violation. A site can have a compliant-looking notice, with an equally prominent reject button and no pre-checked boxes, and still violate the law if a single analytics or advertising script executes before that notice loads. If your site handles EU visitor data, the safest route is confirming which scripts fire on initial page load versus which fire only after an affirmative click, and disclosing that distinction accurately: you can generate a privacy policy that documents your actual tracking sequence rather than a generic template's assumptions.
How many websites even display a consent notice before tracking begins?
77.3% of popular EU websites displayed a cookie consent notice of any kind, according to an August 2018 crawl of 6,579 sites by Utz, Degeling, Fahl, Schaub, and Holz, published at ACM CCS 2019. That means close to a quarter of the sites in their sample never presented a notice at all, so those sites had no mechanism through which a visitor could decline tracking in the first place.
A site with zero notice is a different failure mode than a site with a notice that gets ignored. The first has no compliance mechanism to fail; the second has one that fails in execution. Both produce the same outcome for the visitor: cookies set without a meaningful chance to object. This is also part of why the 92% pre-notice tracking figure and the 77.3% any-notice figure are not contradictory: 92% measures whether the tracker fires before the notice, while 77.3% measures whether a notice exists on the page at all, and a site can score badly on either axis independently.
Figure 3: The scale and findings of each major academic audit of pre-consent tracking. Sources: Utz et al. (2019), Sanchez-Rola et al. (2019), Matte, Bielova, Santos (2020), Bouhoula et al. (2024).
How many consent banners quietly assume yes by default?
25.2% of sites using IAB Europe's Transparency and Consent Framework registered a positive consent signal even though the visitor had not made any choice, according to Matte, Bielova, and Santos's IEEE S&P 2020 study. The researchers crawled 22,949 EU websites to find sites running the TCF, then manually tested 560 of them, checking each banner's actual behavior against what it visually presented to the visitor.
Two related patterns showed up in the same 560-site sample. 236 sites, or 42.1%, used pre-selected or pre-checked consent options that nudged visitors toward accepting rather than presenting a neutral choice. Separately, 27 sites, or 4.8%, kept storing a positive consent signal even after the visitor explicitly opted out, meaning the reject click registered on screen but did not change what the site's tracking scripts did. Combined across every violation type the study checked, at least one compliance failure showed up on 54% of the 560 sites tested.
Figure 4: Share of manually tested sites carrying at least one consent-compliance violation. Source: Matte, Bielova, Santos, IEEE S&P 2020.
How many sites keep tracking after a visitor clicks reject?
65.4% of websites that offer a cookie rejection option still collect user data despite that explicit refusal, according to a 2024 USENIX Security study by Bouhoula, Kubicek, Zac, Cotrini, and Basin at ETH Zurich. The study automated its analysis across 97,000 websites popular in the EU, drawn from the Chrome UX Report, using trained machine learning models to detect declared cookie purposes and interactive banner elements at a scale no manual audit could match.
The same study found that more popular websites were more likely, not less, to ignore a rejected choice or to assume consent before the visitor interacted with the notice at all. That is the opposite of what a compliance-improves-with-scrutiny theory would predict: sites with the largest audiences and, presumably, the most legal and engineering resources to fix the problem showed the pattern more often, not less. The consistent story across every study in this post, spanning six years and more than 125,000 combined site checks, is that assuming consent by default has been cheaper to build than honoring it.
| Study | Year | Sites examined | Key pre-consent finding |
|---|---|---|---|
| Sanchez-Rola et al., AsiaCCS | 2019 | 2,000 (manual) | 92% set a tracking cookie before any notice appeared |
| Utz et al., CCS | 2019 (Aug 2018 crawl) | 6,579 (crawled) | Only 77.3% displayed a consent notice at all |
| Matte, Bielova, Santos, IEEE S&P | 2020 (Nov 2019 crawl) | 560 manual / 22,949 crawled | 25.2% assumed consent with no interaction; 54% had 1+ violation |
| Bouhoula et al., USENIX Security | 2024 | 97,000 (automated) | 65.4% kept tracking after a visitor clicked reject |
The Bottom Line
Four independent academic studies, run six years apart with sample sizes ranging from 560 manually verified sites to 97,000 automatically analyzed domains, all measured the same underlying problem and found it at a similar scale: most websites treat consent as a formality rather than a gate. 92% of sites in the most detailed manual audit set a tracking cookie before showing any notice, and the newest, largest study available, covering 97,000 sites in 2024, found that even an explicit reject click frequently changes nothing about what the site does. If you run a site that serves EU visitors, the practical fix is not a better-looking banner; it is confirming which scripts on your page fire before any consent decision is made, removing or delaying the ones that are not strictly necessary, and describing your actual data collection sequence in a privacy policy that matches what your code does rather than what a template assumes it does.
Frequently Asked Questions
What percentage of websites load trackers before a visitor gives consent? 92% of sites set at least one high-entropy tracking cookie before showing any consent notice, according to a 2019 manual audit of 2,000 popular websites by Sanchez-Rola et al. (AsiaCCS 2019). A 2024 audit of 97,000 sites found the same underlying pattern, tracking that starts before any interaction, is still common today.
Is it legal to set tracking cookies before a user consents? No. Article 5(3) of the ePrivacy Directive requires consent before storing or accessing information on a device, with an exception only for strictly necessary cookies, and GDPR Article 4(11) defines valid consent as a freely given, specific, informed, unambiguous action taken before processing begins.
Do sites that show a reject button honor it? Often not. 65.4% of websites offering a cookie rejection option still collected user data despite that explicit refusal, according to a 2024 USENIX Security study that automatically analyzed 97,000 EU-popular websites.
How many consent banners assume yes without the visitor clicking anything? 25.2% of 560 sites using IAB Europe's Transparency and Consent Framework registered a positive consent signal even though the visitor had not made a choice, and 42.1% used pre-selected options to nudge users toward accepting, per Matte, Bielova, and Santos's IEEE S&P 2020 study.
Where the Numbers Come From
- Sanchez-Rola, Dell'Amico, Kotzias, Balzarotti, Bilge, Vervier, and Santos. (2019). "Can I Opt Out Yet? GDPR and the Global Illusion of Cookie Control." ACM Asia Conference on Computer and Communications Security (AsiaCCS 2019). Manual analysis of 2,000 popular websites; 92% set a high-entropy cookie before any consent notice appeared.
- Utz, Degeling, Fahl, Schaub, and Holz. (2019). "(Un)informed Consent: Studying GDPR Consent Notices in the Field." ACM SIGSAC Conference on Computer and Communications Security (CCS 2019). Crawl of 6,579 popular EU websites, August 2018; 5,087 (77.3%) displayed a consent notice of any kind.
- Matte, Bielova, and Santos. (2020). "Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe's Transparency and Consent Framework." IEEE Symposium on Security and Privacy. Crawl of 22,949 EU websites; manual analysis of 560 sites; 141 (25.2%) registered consent without interaction, 236 (42.1%) used pre-selected options, at least one violation on 54% of sites tested.
- Bouhoula, Kubicek, Zac, Cotrini, and Basin. (2024). "Automated Large-Scale Analysis of Cookie Notice Compliance." USENIX Security Symposium 2024. Automated analysis of 97,000 EU-popular websites; 65.4% of sites offering a rejection option collected data despite that refusal.
Note: All figures verified as of August 2026. The 92% figure remains the most detailed public measurement specific to pre-notice tracking as of this writing; it is a 2019 study, and this post will be updated if a comparable large-scale remeasurement of that exact metric is published. Related studies through 2024 confirm the surrounding pattern, ignoring rejection and assuming consent by default, persists at similar or larger scale.
