Your site may be tracking before the click. Four causes, and a two-minute check.

There is a sentence we hear again and again: "but we have a cookie banner." It is usually true, and it answers the wrong question. A banner is something on the screen. Whether your site sends data before anyone clicked it is decided somewhere else entirely, in the order your scripts load.

How often those two things come apart was measured in 2022 by the chair for privacy and security in information systems at the University of Bamberg, across a hundred randomly drawn German-language sites. Of the 81 that had a cookie banner at all, 64 were already loading third-party trackers before the user had interacted with it. On average three trackers at that point, on one site thirteen.

What we saw ourselves, and what that is worth

In September we opened 40 sites in a freshly created Chrome profile, clicked no banner, and recorded the full network traffic for fifteen seconds. Only a genuine data request to a tracking service counted as a hit, meaning a call to Google Analytics or the Meta pixel. Libraries loaded without transmitting data did not count, and neither did bare connection warm-ups.

A word on how much that carries, before any number appears that cannot support one: these 40 sites are handpicked, not randomly drawn. We included portals, specialist sites, small business sites and our own, because the pattern interested us rather than the rate. A percentage from that sample would be a number with a false claim attached. For a rate, use the Bamberg study, which is drawn and published.

What the observation does carry is the pattern, and it was unambiguous:

• Not one of the 22 large and mid-sized sites in our selection sent full analytics data before the click. What loaded there before any decision were libraries and tag manager containers with no tags fired.
• Every case we found was a small WordPress site.

The reason for that split is unromantic: after the 2020 Planet49 ruling and section 25 of the TTDSG, large publishers spent money, bought a certified consent platform and paid somebody to audit the tag order. That is not moral high ground, that is a budget. Anyone running a site on the side does not have that budget, and nobody audits them.

The four causes

1. A warm-up script that assumes consent

The most galling variant, because it comes from good intentions. Somewhere there is a small script telling Consent Mode: consent granted, as long as no decision has been stored yet. It is meant as a stopgap so measurement does not break during a rebuild. In practice it does the opposite of what was intended: every first-time visitor, precisely the group that has never clicked, gets reported as having consented. A cookieless ping becomes a full hit.

This is the case you never see in the front end and spot immediately in the Network tab.

2. Analytics with no gating at all

The classic left over from the days when analytics counted as harmless: the measurement tag sits in the header, placed by a plugin or by hand, and loads unasked. No banner in front of it, no default consent state, nothing. Such embeds survive relaunches because nobody goes looking. They live in a theme field, a plugin setting or a snippet manager, and from the outside they are invisible.

In what we saw, this is the most common pattern on small sites.

3. A banner that blocks nothing

Consent plugin installed, banner appears, analytics fires anyway. That is not a fault in the plugin but a misunderstanding of what it does. A notice banner shows a notice. Whether other plugins' scripts wait for it is not its decision, unless you explicitly place them behind it.

This cause is so widespread precisely because it feels right. The owner installed something, sees the result on screen, and considers the matter closed.

4. The grey area Google considers solved

The milder category: cookieless Consent Mode pings before any decision, recognisable by the parameter gcs=G100. In Google's reading that is the clean path, since no cookies are set and no users are recognised. The German data protection conference disagrees, because the ping still transmits an IP address to a recipient.

We do not count such cases as hits, while considering the safe path to be the one where nothing goes out before the click.

The self-test, two minutes

1. Open a private window, so no old consent is stored.
2. Press F12 and select the Network tab.
3. Load your front page. Do not click the banner.
4. Type collect into the filter box, or google-analytics, or facebook.
5. If a request is listed, you have your answer.

For a closer look, click the request and search the address for gcs=:

One caveat that belongs to honesty: on sites carrying a lot of ad tech, the result varies between runs, because ad auctions start at different speeds. If you get a finding, check it a second time before drawing a conclusion from it.

If you find something

• Find the source before you act. Do not deactivate plugins at random. Look in the page source for the measurement ID (GA4 ones start with G-) and search that string across plugin settings, theme and any snippet manager.
• Look for a warm-up script. Search the source for consent and granted. If any line grants consent before somebody clicked, that is your cause.
• Put the scripts behind the decision rather than trusting the banner.
• Measure again after the fix, using the same method. A change you do not re-measure is a hope.
• Expect your numbers to drop. If you were counting every first-time visitor and now count only those who consent, you will see a collapse that is not one. The traffic was always like this, the measurement was wrong.

If you serve ads anyway, our ad plugin Adjet includes consent gating for the common consent tools: ad scripts only run after the click. Which consent tool fits is something we went through in our comparison of cookie consent plugins.

Why these four and not others

This is not a catalogue of every theoretically conceivable failure, it is the four that actually occur in practice.

What they have in common is that none of them is a decision. Nobody resolves to measure without consent. It is a stopgap nobody removed, a plugin somebody assumed was responsible, a setting from a time when different rules applied. Conditions nobody checked, because checking costs two minutes and nobody asks for it.

You have just read the two minutes.