Someone asked me to check twenty sites before anyone clicked "Accept"

Last month I got an email from Magda.

Magda builds sites for small local businesses. Not an agency with slides and "synergy". Just someone who ships WordPress, sometimes Next, and keeps getting the same question from clients: "We have a cookie banner, so the cookies are sorted, right?"

This time it came from an accountant at a small shop. The accountant had read somewhere that a banner equals compliance. Magda was not sure. She sent me a list: the client's store, company page, blog, campaign landing, plus a few competitors "for comparison". Twelve URLs at first. Then eight more. Exactly twenty.

My first plan was the usual one. Open a tab. Wait for the banner. Open DevTools. Watch Network and Application. See what appears before Accept. Close the tab. Repeat.

After five sites I was done.

Not because it is hard. Because it is boring in a way that makes you miss things. One site uses Cookiebot. Another OneTrust. Another a custom "Manage preferences" div. Another loads Google Tag Manager before the banner even paints. After an hour everything blends into one long string under Application → Cookies, and you stop trusting your own attention.

Magda did not want a legal memo. She wanted something practical: which pages fire tracking before the user clicks. So she could go back to the client and say "this one looks fine, these tags need fixing", not "according to Article 6...".

What "before consent" actually means

Under the GDPR and the ePrivacy rules in the EU, non-essential cookies and similar trackers generally need a valid consent first. Necessary cookies can be a different story. Analytics, ads, personalization, most marketing pixels usually are not.

A banner on the page is not consent. Consent is a clear action: Accept, Reject, Save preferences. Until that happens, the page should not behave as if the user already agreed.

A lot of sites get the visuals right and the timing wrong.

The banner is visible. Nobody has clicked. And yet:

• ga, gid, or similar analytics cookies are already there
• advertising IDs show up in first- or third-party cookies
• localStorage / sessionStorage already holds tracking keys
• requests go out to Google Analytics, Meta, Hotjar, or ad networks
• the CMP is present, but GTM still starts too early

From the user's point of view the site looks careful. From the browser's point of view tracking already started.

That gap matters. Regulators and courts in Europe have spent years saying consent has to be prior, informed, and freely given. A pre-ticked box is not enough. A banner that is hard to refuse is not enough. Loading the tracker first and asking later is also not enough, even if the UI looks polished.

I am not a lawyer. I do not write legal opinions. I look at timestamps.

A request to an analytics endpoint has a time. A click on Accept has a time. If the first one is earlier, the "but we have Consent Mode" conversation gets less comfortable.

What showed up on the list

I ran Magda's URLs plus a few public European sites as reference. News, e-commerce, classifieds. Nothing exotic.

The pattern showed up more often than I wanted.

Banner already on screen. No click yet. Something non-essential already sitting in the browser. Sometimes analytics. Sometimes ad tech. Sometimes the CMP was nicely embedded and the container still fired early.

The worst cases did not look like malice. They looked like a default setup:

1. paste GTM
2. paste a CMP
3. assume the banner handles order of operations

It often does not. GTM can fire tags on page load. A CMP can load asynchronously. A "necessary" category in the tag manager can be wider than the name suggests. Server-side tagging can hide third-party domains while the cookies still end up on the page. SPAs make it worse, because the consent UI may appear after scripts have already run.

One of Magda's pages was fine. Banner first, then the rest. I wrote her two sentences. She replied: "Good, at least I have one example to show." For the others I sent a simple list: URL, what appeared before consent, what looked necessary. No scare tactics. No fine amounts. Just: this fires too early.

Why people miss this

Because the demo looks fine.

You open the site, see a banner, click Accept, and everything feels intentional. The interesting moment is the few seconds before that click. Most people never inspect that window. Developers install the stack, design the banner, test the happy path, and move on. Clients see a popup and stop worrying.

Also, cookie tables in privacy policies age badly. A site can list ten cookies and ship thirty. Or list the right names and still set them too early. A policy that mentions Google Analytics does not prove the timing is correct. It only proves someone wrote a document.

Another common confusion: "reject all" that is harder to find than "accept all". That is a separate problem. Even sites with a decent reject button can still leak trackers before any choice is made. UI fairness and load order are two different checks.

The boring part that still matters

Doing this by hand works for one or two pages. At twenty, attention collapses. You start skipping Network waterfalls. You forget which tab had consent already clicked. You mix results in a notes file and then trust the wrong line when you write the summary.

I built a ConsentScope, mostly so I would not open twenty tabs and lose half the findings in a notepad. Magda got a normal report. That was enough.

A few days later she wrote that the accountant asked whether "this means we are GDPR compliant now". Magda said she is not a lawyer, but she knows which tags need fixing. Best answer in the whole thread.

What I take from this

A cookie banner is easy to add. Consent timing is easy to get wrong.

If you build sites, or audit them for clients, check the boring window before Accept at least once. Look at cookies, storage, and outbound requests. Compare them with the moment the user actually agrees. Sometimes the setup is clean. Sometimes it only looks clean.

The browser does not care about the banner copy. It cares what ran first.