30% of 1,775 Scanned Websites Leak Tracking Data Before Users Give Consent

A developer who built a consent-management tool scanned 1,775 real websites to measure how often trackers fire before any user interaction. The scan found that on 30% of sites, a known tracker set a cookie or a Google tag ran with consent granted before the visitor clicked anything. The methodology used headless Chromium to simulate a first-time visitor with no prior consent, logging all network requests, cookies, and storage writes on page load. Only definitive violations were counted — cookieless tags and tools operating in Google Consent Mode's denied state were excluded, making the 30% figure a conservative floor. Under GDPR and ePrivacy rules, non-essential trackers must not run until a visitor has made an explicit choice, meaning a consent banner appearing after page load is already too late.