Statable

I run a small analytics tool, and I kept hearing that cookie banners had solved

the tracking problem. So in July I crawled 1,000 Dutch sites and logged every

outgoing request, checking whether it fired before anyone touched the banner.

817 returned complete data.

795 of them sent data to a third party before any consent interaction. Ten sites

were clean.

The part that surprised me: 113 sites had a real consent platform installed —

Cookiebot, OneTrust, Complianz. 111 of them still leaked before consent. The

banner appears, records your answer, and the scripts fire anyway, because

blocking them is a separate configuration step that most people never do.

Also found 124 sites still running Universal Analytics, which Google shut off in

2023. They have been collecting nothing for two years and nobody noticed.

The tools marketed as privacy-first were not immune either. Matomo fired before

consent on 17 of the 31 sites where I found it, Plausible on 9 of 18. Cloudflare

Web Analytics did best at 5 of 65, and I think that is because there is almost

nothing to configure.

Happy to share the methodology if anyone wants to check their own stack.