"We have a cookie banner" is the usual answer when a small business is asked about consent. In our scan of small-business websites in Central and Eastern Europe, a better predictor of what actually happens was something else: the platform the site is built on.
The numbers in brief
We could identify the platform for about half of the 10,944 sites we analyzed in nine countries. The rest are custom builds or site builders our detector doesn't recognize; we call them "unidentified".
| Platform | Sites | Trackers before consent | Ad pixel before consent | Banner shown |
|---|---|---|---|---|
| WordPress | 4,830 | 59.1% | 44.5% | 37.9% |
| Shopify | 260 | 57.7% | 49.2% | 49.6% |
| Wix | 300 | 19.3% | 17.3% | 31.0% |
| Unidentified | 5,052 | 45.5% | 37.6% | 35.9% |
| All sites | 10,944 | 51.7% | 40.8% | 37.5% |
Smaller open platforms look like WordPress: PrestaShop 63.2% (95 sites), Webflow 57.5% (80) and Joomla 57.3% (96). Groups such as Drupal (72), Squarespace (69), HubSpot CMS (46) and Magento (38) are too small for us to draw conclusions.
WordPress: where most of the problem sits
WordPress accounts for 4,830 sites, by far the largest identified group, and it is above average on almost every measure. 59.1% of WordPress sites tracked before consent, and 88.9% sent some data to a third party before consent once services such as Google Fonts are included. 79.0% loaded Google Fonts from Google's servers.
The after-Reject numbers are the clearest signal. On the 862 WordPress sites with a first-layer Reject button, 57.7% still loaded trackers, tracking cookies or third-party services after the click, and 30.6% still loaded trackers or tracking cookies.
The Meta Pixel was the most common survivor on WordPress (156 sites), followed by Google Ads and Google Analytics/GTM (78 each).
Wix: fewer trackers, fewer banners
Only 19.3% of Wix sites tracked before consent, and only 31.0% showed a banner. That combination makes sense on a hosted builder: a site with no marketing tools connected has nothing to ask consent for, and when tools are connected through the platform, the platform's own banner holds them back. 81 of the 93 Wix banners we detected were Wix's own.
The weak spot is the banner design. 66.7% of Wix banners had no Reject on the first layer. Only 31 Wix sites had a Reject button we could click, too few for a percentage; on 2 of them trackers still loaded afterward.
Shopify: banners, but often "granted"
Shopify stores showed a banner more often than any other large group (49.6%), and their banners had a first-layer Reject more often too: only 34.9% lacked one. Yet 57.7% of Shopify sites tracked before consent and 49.2% fired an ad pixel, the highest share among the large groups.
There is a Consent Mode twist. 94 of 124 Shopify sites with Google tags sent a Consent Mode signal, but on 71 of those 94 the state was already "granted" before the visitor chose anything. We cover that in our Consent Mode report.
Why the platform matters
Our explanation, from experience rather than measurement: on a hosted builder, consent is a platform feature, and integrations connected through the platform's settings wait for it. On an open platform, trackers arrive from the theme, plugins, page builders and pasted snippets. The consent plugin controls only what it was told about. Platform and business type also overlap: stores advertise more, and advertisers install more pixels.
Check and fix, by platform
- WordPress, Joomla, PrestaShop: open the Network tab (F12), reload without touching the banner, and trace every tracker to its source. Make sure each one is loaded or blocked by your consent tool, then repeat the test after clicking Reject. Our WordPress consent plugin comparison covers the main options.
- Wix: use the built-in banner, connect analytics and pixels through the platform's settings rather than custom-code fields, and add a Reject option to the first layer.
- Shopify: check which apps inject storefront code, and confirm your Consent Mode default is "denied". See our Shopify consent guide.
For the country-by-country picture, see the flagship report: Cookie consent in Central and Eastern Europe.
How we measured
We took 14,565 small-business domains from public Instagram business profiles in Czechia, Romania, Hungary, Slovakia, Croatia, Slovenia, Lithuania, Latvia and Bulgaria; 10,944 loaded and were analyzed. Between 31 October and 1 November 2026 a real Chromium browser with a clean profile opened each homepage through a German IP address, recording every request and cookie. Where a first-layer Reject button existed, we clicked it and visited up to two more pages. The scan and this methodology are Bannerproof's own. It is a different sample and a newer scanner version than our October Western-EU study, so the numbers are not directly comparable. The sample is not random, server-side tracking is invisible to a browser, and this is not a legal assessment; we name no sites.
What does your platform load?
Scan your site for free and see what loads before consent and after Reject.
