Is your web host part of your cookie consent problem? Our data says the host tells you much less than the platform the site is built on.
As part of our study of small-business cookie consent, we analyzed 23,367 small-business websites in seven EU countries and identified the hosting network behind each one. Then we compared how often sites on each network loaded trackers before the visitor had made any consent choice.
Hosts don't add trackers. Site owners and their tools do.
A web host serves files. It doesn't decide whether a site loads Google Analytics, a Meta Pixel or Google Fonts on the first page view. Those choices come from the site owner, the theme, the plugins, the page builder and whoever set up the marketing tags.
Among general-purpose hosts, the share of sites with trackers before consent falls in a fairly narrow band, roughly 34% to 52%:
- Sites hosted with Combell: 51.7% (793 sites)
- TransIP: 47.1% (575)
- o2switch: 46.7% (525)
- Cloudflare: 45.6% (3,745)
- OVHcloud: 44.7% (2,184)
- Hetzner: 39.2% (543)
- IONOS: 37.8% (539)
- one.com: 34.1% (1,005)
- Google Cloud: 34.0% (582)
- AWS: 33.7% (1,310)
Across the whole sample, 42.9% of sites loaded trackers before consent. The general-purpose hosts cluster on either side of that figure. The differences mostly reflect which platforms and customers each host serves.
The outliers are platforms, not hosts
Two names stand apart: sites hosted with Squarespace (32.1%) and Wix (15.2%). But these aren't hosts in the usual sense. When a site "is hosted with Wix," the host and the website builder are the same product. The platform controls the templates, the built-in consent options and how third-party code gets added.
So the gap between Wix and a general-purpose host isn't evidence that one host is better than another. It reflects that a hosted builder makes some technical choices on its users' behalf, while a general-purpose host gives site owners full freedom, including the freedom to install trackers in ways that ignore consent.
Why "any pre-consent transfer" runs higher on some hosts
The second chart widens the lens. It counts any data sent to a third party before consent, including third-party services such as Google Fonts, reCAPTCHA, Maps and YouTube. These aren't trackers, but they still pass the visitor's IP address to another company as the page loads.
On hosts where WordPress dominates, this rate reaches 75–80%: sites hosted with OVHcloud were at 80.5%, TransIP 79.1%, o2switch 78.3% and Combell 77.9%. The main driver is Google Fonts and other third-party services, which many WordPress themes and page builders load from external servers by default. Sites hosted with Squarespace (44.1%) and Wix (25.3%) were again much lower.
Google Fonts deserves a mention because German courts ruled on it in 2022: loading fonts from Google's servers without consent sent visitors' IP addresses to Google. The fix is simple, and self-hosting fonts takes minutes on most sites.
A note on how we identified hosts
We matched each site's IP address to its network (ASN). That means a CDN or proxy in front of a site shows up instead of the origin host. Cloudflare, with 3,745 sites, is the clearest case: it usually sits in front of another host, so "sites behind Cloudflare" is a mix of many different hosting setups.
What site owners can check
Whatever your host, the same few things decide the outcome:
- Open your site in a private window and don't click anything. Then check the network tab in your browser's developer tools for requests to analytics and ad domains. Our guide to checking for trackers before consent walks through it.
- Look for Google Fonts requests to fonts.googleapis.com or fonts.gstatic.com. If you see them, host the fonts locally.
- Check how tags are wired. If you use Google Tag Manager or plugins that inject pixels, make sure they wait for consent.
- Test your Reject button. Click it, browse a couple of pages, and confirm nothing new fires.
If you're on WordPress, the consent plugin and its configuration matter more than the server it runs on. Our comparison of WordPress consent plugins covers the main options.
Where hosts can help
Hosts aren't responsible for what their customers install, but they are well placed to help, especially managed WordPress hosts. A few practical ideas:
- An onboarding check that flags trackers or Google Fonts loading before consent.
- Starter themes or one-click setups that load fonts locally.
- A consent plugin preinstalled with sensible defaults, so blocking before consent is the starting point, not an extra step.
Method in brief
We scanned 23,367 small-business sites in the Netherlands, France, Poland, Sweden, Belgium, Portugal and Ireland on 24 October 2026, using a real Chromium browser with a clean profile from EU IPs. The homepage loaded with no interaction, and we recorded every request and cookie. The sample (from public Instagram business profiles) skews toward consumer-facing small businesses. Server-side tracking isn't visible, this is not a legal assessment, and no sites are named.
Check your own site
Your host won't tell you what your site loads before consent, but a scan will. Run a free Bannerproof scan to see which trackers and third-party services fire before a visitor says yes.
