We checked 320 SaaS websites: 47% set tracking cookies before consent

In November 2026 we ran an automated check on the home pages of 320 software companies. 282 of them could be opened in a real browser. On 133 of those (47%), analytics or advertising tools set cookies before the visitor had made any choice. About half of these sites had a cookie banner that simply did not hold the tools back. The other half had no banner at all.

This article explains what we measured, how, and what the results mean for a small team. We do not name any company: the goal is to show common patterns, not to point at anyone. It is general information, not legal advice.

#What exactly did we check?

The 320 websites are the SaaS companies featured in SaaSFrame, a design library run by the founder of Privacyboard. They range from early-stage startups to large software vendors, and most sell to businesses.

For each site, an automated browser opened the home page three times, each time as a brand-new visitor with no stored cookies:

1. Without touching anything. This shows what runs before any choice.
2. After clicking the banner's reject button, when there was one.
3. After clicking the accept button, to see which tools the banner normally holds back.

The browser was located in France and ran on 12 and 13 November 2026. For each visit we recorded the cookies set and the requests sent to known analytics and advertising services, and we looked for a cookie banner and a link to a privacy policy.

The rules are the same as in our free GDPR checker, which uses the same engine. We count a problem only when there is evidence: a cookie from an analytics or advertising tool, or data sent to such a tool that also set its own cookie. Fonts, maps, chat widgets and cookieless analytics on their own are not counted as tracking.

#What did we find?

The other 38 sites blocked automated browsers or returned an error, so we could not check them.

The most striking line is the second "of which". On 65 sites, a banner was there and asked the visitor to choose, but analytics or advertising cookies were already set before the visitor clicked anything. The banner looked compliant. It just did not do its job.

#Which tools ran before consent most often?

On the 65 sites where the banner did not hold tools back, these were the tools that set cookies before any choice (a site can appear in several rows):

Across all 282 sites, the most common tools were Google Tag Manager (on 202 sites), Google Analytics (175), Google Ads (172), the LinkedIn Insight Tag (107), the Meta Pixel (101) and Microsoft Clarity (69). B2B software companies use many marketing tools, and each one is a tool the banner has to control.

#Why does a banner fail to block tools?

From what we saw, the usual causes are technical, not intentional:

• The tool is loaded before the banner. A script tag placed high in the page, or a tag manager that fires tags on page view, runs before the banner script has a chance to decide anything.
• The tool is added through a tag manager that ignores consent. Google Tag Manager can respect consent, but only if each tag is set up to wait for it.
• The banner only knows some tools. A tool added later by the marketing team is not in the banner's list, so nothing holds it back.
• "Essential" is used too broadly. Some banners place analytics in a category that cannot be turned off.

The European Data Protection Board's cookie banner taskforce listed similar problems in its 2023 report, including cookies wrongly labelled as essential and banners that make refusing harder than accepting.

#What do the rules say about cookies before consent?

In the EU, the rule comes from Article 5(3) of the ePrivacy Directive: storing or reading information on a visitor's device needs their consent, unless it is strictly necessary for the service they asked for. The GDPR then defines what valid consent is: freely given, specific, informed and unambiguous, through a clear positive action.

Three points from official sources matter here:

• Consent must come first. The French authority, the CNIL, says consent is needed before any cookie or tracker is written or read, and that simply continuing to browse is not consent.
• Refusing must be as easy as accepting. This is the CNIL's wording. The EDPB taskforce found that most authorities consider a banner without any way to refuse on its layers to be an infringement.
• Pre-ticked boxes are not consent. The Court of Justice ruled so in Planet49 (C-673/17, 1 October 2019), whether or not the data stored is personal data.

Some audience measurement can be exempt from consent under strict conditions, for example in France. Most of the tools in the table above are advertising or full analytics tools, which are not covered by such exemptions in their default setup.

#What happened when visitors clicked Reject?

Our browser looked for buttons on 165 of the banners it found:

• On 112, no analytics or advertising tool ran after Reject. That is the expected result.
• On 30, there was no button to refuse on the banner itself, only an accept button or a settings link.
• On 21, no tracking cookie was set after Reject, but services such as analytics endpoints were still contacted. Some of these may be cookieless pings, which is why we flag them for checking rather than as failures.
• On 2, tools still set cookies after the visitor had refused.

A banner that is ignored after Reject is the most serious case, but it was rare. A missing reject button was much more common.

#What are the limits of this study?

Automated checks have blind spots, and we prefer to say so:

• Some consent tools hide from automated browsers. A site where we saw no banner may show one to real visitors. This is why our checker rates "tracking without a banner" as something to check, not as a proven failure. The 68 sites in that row should be read with this in mind.
• One page, one moment. We checked the home page only, once, from France. Other pages, other countries and logged-in areas can behave differently, and sites change often.
• Cookies, not intentions. We record what happened in the browser. We do not know each company's legal analysis, and some may rely on exemptions we cannot see.
• The sample is not random. SaaSFrame features companies with well-designed websites, many of them well funded. Smaller sites may do better or worse.

The figures are counts from our own data, as of 13 November 2026. They describe this sample, not the whole SaaS market.

#How can you check your own website?

You can repeat the same test on your site in a few minutes:

• Open your home page in a private window, without clicking the banner.
• In the browser's developer tools, list the cookies. Look for _ga, _gcl_au, _fbp, li_ cookies, hubspotutk, ajs_ or ph_ cookies.
• Check the network tab for requests to analytics and advertising domains before you click anything.
• Click Reject, reload, and check again: nothing from those tools should appear.
• Make sure the reject option is on the first layer and as visible as accept.
• Check every tool your marketing team added through a tag manager, not only those in the page code.
• Repeat after each new tool or website change.

Or run the free GDPR checker, which does these steps for you and gives a report you can share with your developer. Privacyboard's cookie banner holds back known analytics and advertising tools until the visitor accepts, as described in blocking before consent. Whatever tool you use, the check above is worth doing.

#FAQ

#Is a cookie banner enough to comply?

No. The banner has to actually stop analytics and advertising tools from running until the visitor accepts. In our sample, 65 sites had a banner but the tools ran anyway, which means the banner was there in appearance only.

#Which cookies can be set before consent?

Cookies that are strictly necessary for the service the visitor asked for, such as a session cookie for a logged-in area, a shopping cart or the cookie that remembers the consent choice itself. Analytics and advertising cookies generally need consent, with narrow exemptions for some audience measurement in some countries.

#Why did you not name the companies?

Because an automated check from one country at one moment is not a verdict on a company. Several sites may show a banner to real visitors, and some may have fixed the issue since. The patterns are useful; naming companies would not be fair.

#Does this apply to companies outside the EU?

The ePrivacy and GDPR rules apply when a site targets people in the EU. A US or UK software company selling to European customers is in scope for those visitors. The UK has similar rules under PECR and the UK GDPR.

#How often should I check my site?

After every change to your marketing tools or tag manager, and at least every few months. Tools are added quickly and banners rarely know about them unless someone updates the list.

#Sources

• ePrivacy Directive 2002/58/EC, Article 5(3), EUR-Lex
• Regulation (EU) 2016/679 (GDPR), Articles 4(11) and 7, EUR-Lex
• EDPB, Report of the work undertaken by the Cookie Banner Taskforce, 17 January 2023
• CNIL, Cookies et autres traceurs : lignes directrices modificatives et recommandation
• Court of Justice of the EU, Planet49, case C-673/17, press release of 1 October 2019