What cookie banners really do, in real scans

Real scans from our study of 168 online shops, with the names removed. Three banners that looked fine and weren’t, and one that works, on the same consent tool.

A Spanish menswear brand48/100“Reject All” on OneTrust, and four trackers kept goingThe banner looked right: Accept and Reject side by side. But nine trackers loaded before anyone chose, and after “Reject All” the Meta Pixel, Microsoft Clarity, Klaviyo and the TikTok Pixel still sent data.DOneTrust A Nordic multi-brand fashion retailer45/100“Only necessary” on Didomi, and six ad tags still firedAds tracking started before the banner was answered, carried on after “Only necessary”, and carried on again after we accepted and then withdrew.DDidomi A German sports-nutrition shop on Shopify71/100Shopify’s banner and a fingerprinting script that ignored itA script that sends a browser fingerprint ran before consent, after “Ablehnen” (Reject) and after withdrawal. Klaviyo also kept sending data after Reject.CShopify Privacy (Customer Privacy API)A Scandinavian homeware chain97/100Same consent tool, grade A: what working looks likeNothing tracked before a choice, Reject stopped everything, and withdrawing worked. The only note: a few cookies set to last longer than 13 months after accepting.AOneTrust

Real scans from the October 2026 study. Each was checked by hand against its own evidence. Shops aren’t named without permission. The full numbers are in the study, and you can open a complete sample report.

Questions people ask

Are these real shops?

Yes. Each case is a real scan from our October 2026 study of 168 European shops. We checked every finding by hand against its own evidence: the request, the cookies and the screenshot.

Why are the shops not named?

A scan is one visit on one date, and shops fix things. We show the pattern so you can check your own shop, not a list of offenders. We name a shop only with its permission.

Can my shop have the same problem with a big consent tool?

Yes. Two of the cases use OneTrust: one failed and one got grade A. The tool matters less than whether every tag waits for the visitor’s choice.

What does your own banner do?

See every tracker before a choice, after Reject and after Accept. Free, about a minute.