Clicking "Reject all" feels final. The banner closes, the page carries on, and most visitors assume nothing about them is going to Meta or Google.
We tested how often that holds on ordinary small-business websites. In October 2026 we scanned 23,367 of them across seven EU countries. On sites that offered a Reject button, one in five kept tracking after it was clicked.
The numbers in brief
- 42.9% of sites (10,018) loaded trackers or tracking cookies before the visitor made any choice.
- 28.6% fired an advertising pixel before consent.
- Only 31.1% (7,276) showed a cookie banner at all. 68.9% showed none.
- 51.7% of the sites with a banner had no Reject option on the first layer.
- Of the 3,514 sites with a first-layer Reject button, 743 (21.1%) kept firing trackers or tracking cookies after the click, and 537 (15.3%) kept firing an advertising pixel.
A banner is not the same as consent
The most counterintuitive result: sites with a banner were more likely to track before consent than sites without one.
52.2% of sites with a banner loaded trackers before any choice, against 38.7% of sites without a banner. Banners don't cause tracking. This is a selection effect: the businesses running ads and analytics are the ones that go and install a banner.
But it shows that installing the banner is often where the work stops. The dialog looks compliant, while the scripts behind it load as before, because nobody wired them to wait for the answer. A banner is only the interface for asking.
Half the banners make refusal harder
Of the 7,276 sites that showed a banner, 3,762 (51.7%) offered no Reject on the first layer. Accepting took one click. Refusing meant opening settings, unticking boxes, or wasn't possible at all.
France's CNIL has fined companies specifically for making refusal harder than acceptance. We covered the design side in Dark Patterns in Cookie Banners.
What survives "Reject"
On the 3,514 sites with a first-layer Reject button, we clicked it, waited, and kept browsing. Here is what kept firing.
| Tracker | Sites still firing after Reject |
|---|---|
| Meta Pixel | 381 |
| Google Analytics / GTM | 231 |
| Google Ads | 208 |
| Microsoft Clarity | 167 |
| Hotjar | 54 |
| TikTok Pixel | 40 |
The Meta Pixel leads by a wide margin. Clarity and Hotjar are session-recording tools, exactly what consent is meant to gate.
Why it happens
These causes come from our experience fixing sites, not from the scan itself:
- The pixel is hard-coded in the theme. The consent tool controls the scripts it knows about. The Meta Pixel pasted into the header years ago loads regardless.
- Tag Manager triggers fire on "All Pages". The banner records the visitor's choice, but the triggers ignore the consent state, so every tag fires anyway.
- A second plugin injects its own tracking. Shop, form and marketing add-ons often add pixels the consent tool doesn't know exist.
- Reject only closes the dialog. Nothing is blocked and nothing is revoked.
From the visitor's side, all four look the same: the banner goes away and the tracking continues. More on each pattern in Why Your Cookie Banner's "Reject All" Button Might Not Actually Work.
How much of this depends on your website platform, your country and your Google setup is a story of its own. We'll cover those in upcoming reports.
Check your own site in five minutes
- Open your site in a private window, press F12 and open the Network tab.
- Reload without touching the banner. Requests to
google-analytics.com,googletagmanager.com,connect.facebook.net,doubleclick.net,clarity.msorhotjar.commean trackers are loading before consent. - Clear the log, click Reject all, then reload and click to another page. Anything from that list that still appears is tracking after refusal.
Our guide Does Your Site Load Trackers Before Consent? walks through this in more detail.
How to fix it
- Find every place a tracker is added: theme header, Tag Manager, plugins, pasted snippets. Move all of them under the control of your consent tool.
- In Tag Manager, replace "All Pages" triggers with triggers that wait for consent.
- Put a Reject button on the first layer, as easy to use as Accept.
- After every change, run the Reject test again. A banner that looks right is not proof.
How we measured
We took 37,814 small-business domains from public Instagram business profiles in the Netherlands, France, Poland, Sweden, Belgium, Portugal and Ireland; 23,367 loaded and were analyzed. On 24 October 2026 a real Chromium browser with a clean profile opened each homepage from EU IPs, without interaction, recording every request and cookie. Where a first-layer Reject button existed, we clicked it, watched for a few seconds and visited up to two more pages.
The sample skews to consumer-facing small businesses and is not random. Server-side tracking is invisible to a browser. This is not a legal assessment of any site, and we name none.
Is your site one of the 21%?
The quickest way to find out is to run the same test we ran. Scan your site for free and see what loads before consent and what keeps loading after Reject.