Banner Scanner
Everyone has a cookie banner. Almost nobody has it configured right.
The fact that a website shows a cookie banner tells you almost nothing about whether that banner does anything at all.
You'd think the two went together. Banner appears, trackers wait, user chooses, tags fire in that order. That's the arrangement us privacy people quietly assume is happening behind the scenes.
But no.
We pointed Banner Scanner at 100 privately held US mid-market B2B SaaS companies, the sort of names you already know, Notion, Figma, Gong, Rippling, Zendesk, and scanned every one of them from London, Germany and California. Same clean browser session each time. Same sequence: load the page, find the banner, click reject, send a GPC privacy signal. And almost everywhere, the same pattern came back. The banner is present. The machinery behind it is asleep.
The full report is free, and there's no email wall in front of it. But before you go and grab it, here are the four findings that made me want to publish this in the first place.
Nine in ten sites fire trackers before you touch a thing
Across all three regions, roughly nine in ten site scans loaded at least one non-essential tracker before the user interacted with the banner. In London it was 89%. The typical site laucnhed five non-essential trackers before offering any choice at all. In California the median was ten.
And it's the same familiar faces doing it every time. Google Analytics and Ads through Tag Manager turned up in 56% of scans, LinkedIn Insight in 27%, Facebook Pixel in 22%. This isn't exotic technology misbehaving. It's the standard tag-manager setup firing on page load, before consent, on autopilot.
The reject button that quietly does nothing
This is the one that should keep people up at night. In the UK region, 51% of sites had a reject button that registers the click and then changes precisely nothing. The trackers carry on. The median site still loaded two non-essential trackers after the user had explicitly said no.
Think about what that actually is. You offer someone a refusal. They take it. And you ignore it while telling them you haven't. The banner says one thing and the browser does another.
The CNIL levied 150 million euro in fines in 2022 specifically targeting the gap between how easy it is to accept versus reject.
GPC: read by everyone, obeyed by almost no one
On the Global Privacy Control signal, the picture is arguably worse, and it's worse in a way that's almost comic. 99% of California-facing CMPs detected the GPC opt-out signal correctly. Only 20% were actually configured to honour it.
I'll say that again because it's the whole point. Every CMP read the signal. Almost none of them did anything with it. The failure isn't detection. It's the bit that comes after, the bit that costs nothing to switch on. The CPPA fined Sephora $1.2 million in part for exactly this, so it's an unwise place to be leaving the door open.
And the easiest fix nobody has made
In the German region, 79% of cookie banners were served in English. Under GDPR, a banner a visitor cannot read produces invalid consent, so this is a real problem and not a cosmetic one. And yet the fix takes seconds. It's a locale setting in the CMP, not a development project. Every major platform supports it. Most sites simply haven't turned it on.
Where to get the rest
Those four are the headline acts. The report itself goes much wider: pre-consent tracker loading broken down by region and by service, reject presence and effectiveness, CMP vendor market share, GPC detection versus active honouring, after-reject persistence, CIPA exposure for California, a pack analysis of what the median site in this cohort really looks like, and a set of good-practice fixes tiered by enforcement risk rather than by effort. No individual company is named against any data point. Everything is cohort-level and aggregated.
Read it, then go and look at your own banner properly. Not whether it appears, everyone clears that bar now, but whether clicking reject actually stops anything. If you want to check your own site or a competitor's while you're at it, that's what Banner Scanner is for.
Just because you can see a banner, it doesn't mean anything is being blocked.
