Provendly
Field study · 11 August 2026

410 small-business websites, measured before anyone was asked.

Every site in this corpus was loaded twice in a real browser with a clean profile: once with the consent banner left untouched, and once with its reject control activated. Every outbound request was recorded with its offset from the moment the page began loading.

Every rate below is stated against the 367 sites actually observed, not the 410 attempted. The 43 that never loaded are excluded rather than counted as clean: they were never seen, so nothing can be concluded about them. Their breakdown is published lower down rather than left out.

What the corpus did

Sent data to a third party before any consent choice236 sites64.3%
Kept sending after the reject control was activated3 sites0.8%
Showed a consent banner at all23 sites6.3%
Banner present and a reject control could be activated12 sites3.3%
Showed a banner but still fired before any choice15 sites4.1%
No third-party tracker detected at all91 sites24.8%
Nothing before consent, nothing after reject131 sites35.7%

Median time to the first third-party transmission: 1.63s after page load began. On most of these sites a banner had not finished drawing by then.

Who received the data

Ordered by how many sites contacted them. The second column is the share of those sites that did so before any consent choice was made.

Google Analytics 4262 sites · 71.4%215 before consent
Google Tag Manager167 sites · 45.5%131 before consent
Google DoubleClick / Display & Video 360148 sites · 40.3%148 before consent
Google Ads Conversion / Remarketing104 sites · 28.3%100 before consent
Meta Pixel79 sites · 21.5%70 before consent
Microsoft Clarity20 sites · 5.4%18 before consent
TikTok Pixel8 sites · 2.2%7 before consent
HubSpot5 sites · 1.4%5 before consent
Hotjar5 sites · 1.4%5 before consent
Microsoft Advertising UET5 sites · 1.4%5 before consent
The Trade Desk4 sites · 1.1%4 before consent
Segment4 sites · 1.1%4 before consent
OneTrust3 sites · 0.8%0 before consent
LinkedIn Insight Tag3 sites · 0.8%3 before consent
Matomo3 sites · 0.8%3 before consent

Third parties per site

0
91
1-2
120
3-5
140
6-9
15
10+
1

What was observed, by rule

Each line is a statement of recorded technical behaviour, produced by a named rule. The rulesets are separate from the engine, so the same capture can be re-evaluated later without re-scanning.

No consent interface was present
pre-consent-tracking/no-consent-interface
221 · 60.2%
Advertising vendors were contacted without a TCF consent string
eu-prior-consent/tcf-string-absent-with-ad-tech
220 · 59.9%
Advertising network received data before any consent choice
pre-consent-tracking/ad-network-before-consent
86 · 23.4%
Google tags sent no denied consent signal before a choice was made
eu-prior-consent/consent-mode-not-defaulted-denied
77 · 21%
A long-lived third-party cookie was set before any consent choice
pre-consent-tracking/long-lived-third-party-cookie-pre-consent
54 · 14.7%
Session recording began before any consent choice
pre-consent-tracking/session-replay-before-consent
22 · 6%
Non-essential storage was written before any consent choice
eu-prior-consent/non-essential-storage-before-consent
15 · 4.1%
The consent banner offered no reject control
pre-consent-tracking/no-reject-control
11 · 3%
Accept was available on the banner but reject required extra steps
eu-prior-consent/banner-asymmetry
11 · 3%
Tracker continued sending data after the visitor clicked reject
pre-consent-tracking/tracker-fired-after-reject
2 · 0.5%
Transmission continued after a recorded rejection
eu-prior-consent/consent-not-honored-eu
2 · 0.5%
Identity resolution service contacted before any consent choice
pre-consent-tracking/identity-resolution-before-consent
1 · 0.3%

What could not be measured

Published because silence reads as a clean result to nobody but means only that we never looked. These sites are excluded from every rate above.

Domain does not resolve (dead listing)12 · 2.9%
Resolves but would not load (real coverage gap)31 · 7.6%

Only the second line is a genuine gap in the scanner. A domain that does not resolve is a dead listing, not a site we failed to read.

Method and limits

  • Consent platforms such as OneTrust and Cookiebot are reported but excluded from the counts above. A banner calling its own backend to record a rejection is the banner working, not a tracker defying it.
  • Only the homepage of each site was scanned. Deeper pages, forms and logged-in areas are out of scope.
  • Scans ran from a single location. Sites that vary their behaviour by geography may behave differently elsewhere.
  • “Reject control could be activated” means the engine found one and clicked it. A site with a reject option the engine could not locate is counted as not having one, which understates that number rather than flattering it.

This is one scan of one corpus, on one day.

The product is the series: the same measurement on your own site, every day, with a dated record of what changed and when.

Scan my site

Provendly reports what your site's pages did at the network level. It does not determine whether any law applies to you or was broken - that is a question for your lawyer.