When people talk about cookie consent problems, they usually picture analytics: a Google Analytics tag that loads a little too early. Our October 2026 scan points somewhere more expensive. On 6,680 of the 23,367 small-business websites we analyzed (28.6%), at least one advertising pixel fired before the visitor had made any consent choice.
These are not measurement scripts. They are the tags that build remarketing audiences and report conversions back to ad platforms, and they are exactly the kind of non-essential tracker that regulators expect to wait for prior consent.
This post is part of our small-business cookie consent study. Here we look only at ad pixels.
Which pixels fire first
Two names dominate. Google Ads/DoubleClick fired before consent on 4,309 sites, and the Meta Pixel on 3,932. Everything else is a long way behind: TikTok Pixel on 282 sites, LinkedIn Insight Tag on 272, Pinterest Tag on 241 and Criteo on 58.
Many sites run more than one. 1,688 sites fired both the Meta Pixel and Google Ads before consent. Among the 6,680 affected sites, 4,701 had one ad pixel, 1,610 had two, 305 had three and 64 had four or more.
Most of these sites have no banner at all
The single most telling number: 4,063 of the 6,680 sites (60.8%) showed no cookie banner at all. In six out of ten cases, the business set up advertising but never set up consent. Someone connected an ad account, pasted a pixel or installed a sales-channel app, and the consent side of the job simply never happened.
The other 39.2% did have a banner, yet the pixel fired anyway. That is a different failure: the banner is there, but it is not wired to the tags. Usually the pixel was added directly to the theme, through a platform integration or through a tag manager trigger that ignores consent.
Platform and country differences
The share of sites firing an ad pixel before consent varied a lot by platform. HubSpot CMS (57.2% of 152 sites), PrestaShop (55.6% of 225) and Magento (53.0% of 83) were highest, though their samples are small. Among the big platforms, Shopify stood at 45.1% (1,089 sites), WordPress at 33.8% (10,609 sites) and Squarespace at 26.8% (583 sites). Wix was lowest at 13.3% (1,157 sites).
Ecommerce-heavy platforms rank high for an obvious reason: stores advertise, and their ad integrations are often one click away. That does not make the platform the culprit. The same platform shows up on both clean and problematic sites; configuration decides the outcome.
By country, Poland had the highest rate (40.9%), followed by Ireland (36.4%), Portugal (31.4%), Sweden (27.4%), Belgium (27.1%), the Netherlands (26.1%) and France (25.2%).
Reject does not always stop them
On sites with a first-layer Reject button, we clicked it and kept watching. On 15.3% of those sites an ad pixel still fired after Reject. The Meta Pixel was the most common survivor, on 381 sites. We covered why this happens in Why Your Cookie Banner's "Reject All" Button Might Not Actually Work.
It is a data problem too
Pixels that fire without consent are not only a compliance risk. They also feed ad platforms audiences and conversions that you are not supposed to use, which muddies reporting and targeting. For Google specifically, Google has required Consent Mode v2 for advertisers in the EEA since March 2024. We explain what it checks in Google Consent Mode v2: What It Actually Checks.
How to check your own site
- Open your homepage in a private window. Do not click anything on the banner.
- Open DevTools, go to the Network tab and reload.
- Filter for
facebook,doubleclick,googleadservices,tiktok,linkedin,pinterestandcriteo. Any hit before you choose is a pre-consent pixel. - Now click Reject, browse to another page and check again.
For a fuller walkthrough, see Does Your Site Load Trackers Before Consent?
How to fix it
- No banner? Add a consent tool first, then connect your pixels to it. A pixel with no consent gate is the most common pattern we found.
- Banner but pixel fires anyway? Find where the pixel is loaded: theme code, a platform app or a tag manager. Move it behind the consent category for marketing.
- Using Google Ads? Set Consent Mode v2 with a denied default and update it only when the visitor accepts.
- Several pixels? Check each one separately. Fixing Google Ads does not fix Meta, and vice versa.
Methodology in brief
We took 37,814 small-business domains from the website links on public Instagram business profiles in seven EU countries and scanned them on 24 October 2026 with a real Chromium browser and a clean profile, from EU IPs. 23,367 loaded and were analyzed. We loaded the homepage without interaction and recorded every request and cookie, then clicked a first-layer Reject button where one existed. The sample is not random, server-side tracking is invisible to a browser, and this is not a legal assessment of any site.
Check your site in a minute
Want to know whether your ad pixels wait for consent? Run a free Bannerproof scan and see what fires before the visitor chooses, and what keeps firing after Reject.