Tracking before consent: 50,000 German business sites checked

Cookie banners are part of everyday life now. In my sample, 59.5% of business sites had one. The idea behind them is simple: before a website measures its visitors with Google Analytics, the Meta Pixel, or similar services, it asks permission. Since December 2021 that’s been explicit in German law, today under § 25 TDDDG, the section of German telecoms and telemedia law covering consent for cookies and similar technologies. A site may only store information on a visitor’s device, or read it back out, with consent, unless it’s strictly necessary for the service.

I wanted to know whether the banner actually does what it promises. So I took the same 50,000 randomly drawn websites of German businesses as in my Google Fonts study. This time I opened every homepage in a real browser and watched closely what happens before anyone clicks anything.

Short version: 8.8% of reachable business sites in my sample measure their visitors before the first click in the cookie banner. That’s almost one in eleven. Looking only at sites that use tracking at all and where my browser found a consent button, it’s 30.9%, nearly a third.

1. Tracking before consent, in numbers: 8.8% measure before the click

Here’s how the test worked, without the jargon. A browser (Chromium, the technical base of Chrome) opens each site in a fresh, empty profile, with no stored cookies, set to German language. The page loads, then the browser waits four seconds. It moves the mouse, presses a key, and scrolls down a bit, the way a real visitor would while looking around. Another three seconds of waiting. Nothing gets clicked during this time, not even in the cookie banner.

Meanwhile, the browser logs every request the page sends out. I counted requests where the page sends data to a measurement or advertising service, for example a page view to Google Analytics or an event to the Meta Pixel. A script merely loading, without sending data, doesn’t count in the headline figure.

Of 50,000 addresses, 41,161 were reachable. Each one lands in exactly one tier, the most serious one that applies:

• Measurement runs before the click: 3,619 sites (8.8%). The site sends data to Google, Meta, or another measurement or advertising service, with no signal that the visitor declined.
• Only Google pings in “denied” mode: 859 sites (2.1%). More on this below.
• Only ad requests through a YouTube video or an AdSense script: 409 sites (1.0%).
• Tracking script loaded, but nothing measured yet: 1,733 sites (4.2%).
• Only third-party content like Google Fonts, Google Maps, or reCAPTCHA: 7,071 sites (17.2%).
• None of the above: 27,470 sites (66.7%).

What stands out about the first group: on 2,619 of these 3,619 sites, the browser detected a cookie banner. Nobody had answered it yet, and the measurement was already running in the background. The remaining 1,000 have no detectable banner at all. And 2,952 of these sites also set tracking cookies at the same time, most often _ga from Google Analytics.

I wanted to be sure these weren’t measurement errors. So I reopened 30 randomly selected sites from this group after the survey ended and took screenshots. 29 of the 30 measured before every click again. On 19 of the screenshots the unanswered banner is clearly visible; on one more it’s covered by another window.

Who gets the data before the click

Mostly it’s Google: on 2,670 of the 3,619 sites, roughly 74 out of 100, Google Analytics or Google Ads is involved. Google Analytics 4 measures on 2,170 sites before the click, Google Ads on 1,238. The Meta Pixel shows up on 536 sites. Surprisingly often, the old Universal Analytics still turns up: 534 sites send data to a service Google shut down long ago. That brings the business nothing at all. The data still flows.

Which industries are hit most often

At the top are furniture stores (16.7%) and IT service providers (15.1%). For furniture stores, though, the sample is only 221 sites, so the figure swings more. At the bottom sit electricians (2.1%) and pharmacies (1.5%). Why, the data alone can’t say for certain.

2. Why the cookie banner is often just decoration

A banner on a site doesn’t mean it actually blocks anything. My test doesn’t show what causes it case by case, it only sees the requests. But there are typical causes, and traces of some of them show up in the data.

Banner present, measurement runs anyway. On 2,619 of the 3,619 sites there was a detected banner and a measurement running regardless. How that happens in any single case, I can’t see from outside. A typical example: Google Analytics got built directly into the design template at some point, a banner plugin got added later, and nobody ever wired the old tracking to the banner. Both run side by side. To the visitor, everything looks in order.

The banner doesn’t actually ask. On some of the sites I photographed it reads roughly “By using this website you agree”, often with just a button underneath like “Accept” or “Got it”. That’s a notice, not a question. Consent requires being able to say no.

Google Consent Mode is set too loosely. Google offers a setting where its services send pings even before the decision, explicitly flagged as “denied”. I counted that separately (2.1% of sites), because it’s legally unclear whether that’s permitted. But something else is more common. Of 3,066 sites sending requests to Google Analytics 4 before the click, 2,027 report no consent status at all. 115 even report “granted”, although nobody granted anything. 896 report “denied”, and for 28 the signal is mixed or unclear.

The website builder plays a role too. 199 of 200 sites running on a single website builder send data to Adobe before the click. Almost all of them are restaurants, snack bars, and cafés. A pattern that uniform points more towards shared technology behind it than 199 individual decisions. Anyone running their site through a builder should check just as carefully as someone with their own WordPress site.

On top of that, 4.2% of sites load a tracking script like Google Tag Manager before the click without measuring anything yet through it. Germany’s Hanover Administrative Court ruled in 2025 that even this loading requires consent. That’s a single first-instance ruling, not settled case law. That’s why this group doesn’t sit in the headline figure. If you want to play it safe, though, load the script only after consent too.

The good news is in the data too. On a fixed quarter of the sites, my browser ended up clicking the consent button, recognised by text like “Accept all”, “Agree”, or “OK”. Of 1,854 sites that showed any tracking at all in that process, 1,079 (58.2%) sent no measurement before the click. 238 of those had already loaded the tracking script, though. So it’s possible, and for more than half, at least holding back the measurement already works.

3. Checking your own site in five minutes

You don’t need a tool or an agency for this, just a normal browser. If you don’t maintain your own website, send these steps to whoever does.

1. Open a private window. In Chrome it’s called “Incognito”. That way the browser has no stored cookies and no earlier consent of yours saved.
2. Open developer tools before the page loads. Right-click anywhere, choose “Inspect”, then the “Network” tab. Now enter your address and load it. Don’t click the banner.
3. Search for suspicious requests. Type into the filter box, one at a time: collect (Google Analytics), facebook.com/tr (Meta Pixel), doubleclick and googleadservices (Google Ads). Any hit while the banner is still open is a warning sign, but not every hit is already a measurement; some requests only load scripts or ad creative. It’s clear-cut with Google Analytics: a collect request with tid=G- in the address is a measurement. If it shows gcs=G100, Google is reporting “denied”. If gcs is missing entirely, the measurement goes out with no decline signal at all.
4. Check the cookies. In the “Application” tab, click “Cookies” on the left. If you already see _ga, _gid, _gcl_au, or _fbp there, even though you haven’t clicked anything yet, something was stored before consent.
5. Decline for comparison. Open a new private window, this time click “Decline” in the banner and repeat step 3. Apart from Google pings carrying the “denied” signal, nothing else should show up.

If you find something, the fix is usually this: tracking shouldn’t be hard-coded into the site, only started through the banner tool. On WordPress, that means removing the built-in analytics code from the theme or plugin and setting it up in the banner tool as a service that only loads after consent. If you use Google Tag Manager, the best move is to have the tag manager itself load only after consent. Whether you run Consent Mode in Basic or Advanced mode is a decision to make with whoever advises you on data protection.

For a quick first impression of whether your tracking measures cleanly at all, there’s my free tracking check (in German). It shows which trackers your homepage loads and whether Consent Mode is detectable. What exactly happens before the click, though, is shown most reliably by the browser method above, on your own site.

For the technically curious: how I measured this

You can skip this part. It’s for anyone who wants to check the numbers. All figures are also available as an open dataset with CSV and JSON download (in German), for citing and recalculating.

• Addresses: the same random sample as the German business websites study. 50,000 businesses out of 350,146 German companies with their own website in OpenStreetMap: restaurants, practices, trades, hotels, shops, and many more. Not a hand-picked selection, not a list from search results.
• Browser: headless Chromium, controlled via Playwright, a fresh, empty browser context per page, German language, Berlin timezone, a common window size. Fonts, videos, and most images were cancelled after the request was logged, to save compute time. Collected from 23 September 2026 to 26 September 2026 from a server in Germany.
• Sequence: load (plus load time), wait four seconds, then mouse movement, a shift key press, and a 300-pixel scroll, another three seconds. This interaction matters: some banners and some tracking scripts only start once something moves on the page. 94 sites actually only measured after the scroll, and still without a click.
• What counts as a measurement: requests that send data to a measurement or advertising service. The rules are fixed in advance, and some cover whole server groups of a provider. For Google Ads, every request to Google’s ad servers counts (doubleclick.net, googleadservices.com, googlesyndication.com); for Adobe, every request to its measurement servers. For Google Analytics 4, the call to /g/collect counts, whether direct to Google or via a self-hosted server (server-side tag manager); for Meta, the call to facebook.com/tr. Also included: Microsoft Clarity, Hotjar, LinkedIn, TikTok, Pinterest, Microsoft Ads, Criteo, Adobe, Mouseflow, HubSpot, etracker, and Matomo Cloud. Self-hosted Matomo doesn’t count.
• Consent Mode: Google requests carry a parameter (gcs) reporting the consent status. If it reads “denied” for analytics or advertising, the site doesn’t count towards the headline figure, it gets its own tier. If it’s missing or reads “granted”, it counts.
• YouTube and AdSense: an embedded YouTube video and the AdSense script trigger requests to Google’s ad services on their own. Sites where that’s the only thing happening sit in their own tier too.
• Reachable: the page loaded and triggered more than one request. 66 sites loaded so slowly that no server response arrived within the time limit, and were evaluated on whatever had happened by then.
• Not reachable: 8,488 addresses, mostly domains with no reachable server and broken certificates. Those get dropped.
• Excluded: 351 addresses: 238 parked domains and 113 that redirect to an automatically generated profile page from a third-party provider. No business’s own website is visible there anymore.
• Precision: the 95% confidence interval for the headline figure runs from 8.5% to 9.1%. For the share among sites with tracking, it’s 28.8% to 33.0%.
• Cross-check with a click: on a fixed quarter of the sites (10,173), the browser afterwards clicked a button or link whose text sounded like consent (“Accept all”, “Agree”, “OK”, “Got it”). It found one on 5,212 of them, on 202 of those with no detected banner. Whether a valid consent was actually stored afterwards, I didn’t separately verify. The 30.9% figure applies only to sites where a button was found. Whether it would be higher or lower across all sites can’t be said from this.
• Cross-check: the browser found Google Fonts on 20.0% of sites. The purely technical check in the Google Fonts study came to 18.7%. Two different measurement paths land close together.
• What the test doesn’t see: subpages, longer visits, and banners that only appear for certain countries. It also doesn’t see sites that detect automated browsers and treat them differently. That could shift the figure in either direction.

Bottom line

• 8.8% of reachable German business sites measure their visitors before anyone clicks anything in the cookie banner. Almost one in eleven.
• Among sites that use tracking at all and have a consent button, it’s nearly a third (30.9%).
• Most affected sites have a banner. The measurement runs anyway.
• Roughly 74 out of 100 affected sites involve Google Analytics or Google Ads, mostly with no consent status at all.
• More than half of sites with tracking hold the measurement back until consent. So it’s possible. Checking your own site takes five minutes in the browser.

Survey date: 26 September 2026. I’m not a lawyer, and this isn’t legal advice. It only shows you what’s technically happening on your site.