Lab test, State of Consent 2026
Complianz
[Former affiliate, exited 24 Sep 2026, $0 earned] · free plugin, as tested
No counted finding under stated conditions
No counted finding in either tested configuration. The requests observed before a choice came from our own hardcoded test tags, not from a script the plugin was set up to manage, and were withdrawn on 4 Oct 2026 (see the context note). After a verified "reject all", no listed tracker activity on page 2 met our counting rule (0 of 6 runs).
Observed under stated conditions: our own identical WordPress test site, free plugin, as tested, our tags (GA4, Google Ads, Meta Pixel, YouTube) hardcoded in the theme header (insertion method A), automated Chromium with a fresh profile per run from a German (EU) IP. Lab days 24 and 25 Sep 2026 (Israel time). Findings human-reviewed on 28 Sep 2026. These are observations of browser behaviour, not a legal assessment of the product.
Lab findings (exact report wording)
- Complianz, config 1 (vendor wizard defaults, free plugin; our tags hardcoded in the theme header): on first load, the listed tracker activity observed before any choice (requests to www.facebook.com, in 3 of 3 runs on 24 Sep and 3 of 3 runs on 25 Sep 2026) came from our own hardcoded test tags in a form the tested setup was not configured to block, and is withdrawn (see the context note). No other listed tracker request or tracking storage met the counting rule. After a verified "reject all", no listed tracker activity on page 2 met the counting rule (0 of 6 runs). On a return visit the stored consent still read as the refusal (6 of 6).
- Complianz, config 2 (free plugin, the vendor's Consent Mode guide followed as far as the free plugin allows, analytics ID entered; our tags hardcoded in the theme header): on first load, the listed tracker activity observed before any choice (requests to region1.google-analytics.com and www.facebook.com, and the storage names _ga and _ga_LABTEST000, in 3 of 3 runs on 24 Sep and 3 of 3 runs on 25 Sep 2026) came from our own hardcoded test tags in a form the tested setup was not configured to block, and is withdrawn (see the context note). No other listed tracker request or tracking storage met the counting rule. After a verified "reject all", no listed tracker activity on page 2 met the counting rule (0 of 6 runs). On a return visit the stored consent still read as the refusal (6 of 6).
Context: The requests observed before a choice in both configurations came from our own test setup, not from a script the plugin was set up to manage, so they are not reported as findings about Complianz (corrections log, section 8). Our test page carried the Meta Pixel as a hardcoded inline snippet. In config 1 Facebook was not declared in the plugin's setup wizard, and in config 2 we entered it under a service name the plugin does not recognise. In a diagnostic on our own lab site (3 runs per variant, 4 Oct 2026), with Facebook declared, the plugin held the snippet back and no request to www.facebook.com occurred, in both configurations. In config 2, the GA4 request and the _ga and _ga_LABTEST000 cookies came from the inline Google Analytics command in our test tag, which ran once the plugin's Consent Mode integration loaded Google's tag library; with only that command removed, or with only the integration turned off, neither appeared (3 of 3 runs each). The plugin held back our hardcoded Google tag loader in every run, in both configurations. Complianz states that config 2 is not a supported setup on the free plugin (see its statement below; Complianz lists Consent Mode v2 under its Premium plans).
Complianz: what our lab test and our site sample showed before a consent choice
Observed under stated conditions: lab on our own identical WordPress test site, free plugin, as tested, our tags hardcoded in the theme header (insertion method A), automated Chromium with a fresh profile per run from a German (EU) IP; wild figures are aggregates of sampled public homepages, never a named site. Not a legal assessment of the product.
- In our lab. On our own WordPress test site (free plugin, two configurations, lab days 24 and 25 Sep 2026), no listed tracker request or tracking storage met our counting rule before a choice. The plugin held back our hardcoded Google tag loader in every run, in both configurations.
- Correction. An earlier lab observation for Complianz was withdrawn after our audit of 4 Oct 2026, because it came from our own test tags; the report's corrections log (section 8) records it.
- Setup factors. What mattered in our test was how our tags reached the page and how we declared them to the plugin. Our Meta Pixel was a hardcoded inline snippet; Facebook was not declared in config 1 and was entered under a service name the plugin does not recognise in config 2. In a diagnostic with Facebook declared, the plugin held the snippet back (3 runs per configuration, 4 Oct 2026). In config 2, an inline Google Analytics command in our test tag ran once the plugin's Consent Mode integration loaded Google's tag library; whether config 2 is a supported setup on the free plugin is open (Complianz's pricing page lists Consent Mode v2 among its paid plans). We tested one insertion method only (our tags hardcoded in the theme header); tags added through Tag Manager or a plugin were not tested.
- On sampled homepages. On sampled public homepages detected as using Complianz, 260 of 382 (68%; Wilson 95% interval 63% to 73%) made a request matching our tracker lists before any choice, on both 24 and 25 Sep 2026. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
- Complianz's reply. Published unedited in the "Vendor response" box below.
- Method. Our counting rules and limits: methodology.
Raw per-run counts
"Verified" means the automation worked; it is not a verdict on the product. Only the wording above is a finding. O1 = a listed third-party tracker request before a choice; O2 = listed tracking storage (cookie or localStorage name) before a choice; O3 = O1/O2 activity after a verified reject.
Config 1: vendor wizard defaults, free plugin
| State | Runs | O1 before a choice | O2 before a choice | O3 after a verified reject | Days |
|---|---|---|---|---|---|
| State 1: first load, no interaction | 6 (verified 6) | 0/6 (raw 6/6) ³ | 0/6 | n/a | 24 and 25 Sep 2026 |
| State 2: reject all, then page 2 | 6 (verified 6) | 0/6 (raw 6/6) before the click ¹ ³ | 0/6 before the click ¹ | 0/6 | 24 and 25 Sep 2026 |
| State 3: accept all, then page 2 | 6 (verified 6) | 0/6 (raw 6/6) before the click ¹ ³ | 0/6 before the click ¹ | n/a | 24 and 25 Sep 2026 |
| State 4: return visit after reject | 6 (verified 6) | n/a | n/a | n/a | 24 and 25 Sep 2026 |
| State 5: first load with GPC (synthetic diagnostic) | 6 (verified 6) | 0/6 (raw 6/6) ³ | 0/6 | n/a | 24 and 25 Sep 2026 |
Config 2: free plugin, the vendor's Consent Mode guide followed as far as the free plugin allows, analytics ID entered
| State | Runs | O1 before a choice | O2 before a choice | O3 after a verified reject | Days |
|---|---|---|---|---|---|
| State 1: first load, no interaction | 6 (verified 6) | 0/6 (raw 6/6) ³ | 0/6 (raw 6/6) ³ | n/a | 24 and 25 Sep 2026 |
| State 2: reject all, then page 2 | 6 (verified 6) | 0/6 (raw 6/6) before the click ¹ ³ | 0/6 (raw 6/6) before the click ¹ ³ | 0/6 | 24 and 25 Sep 2026 |
| State 3: accept all, then page 2 | 6 (verified 6) | 0/6 (raw 6/6) before the click ¹ ³ | 0/6 (raw 6/6) before the click ¹ ³ | n/a | 24 and 25 Sep 2026 |
| State 4: return visit after reject | 6 (verified 6) | n/a | n/a | n/a | 24 and 25 Sep 2026 |
| State 5: first load with GPC (synthetic diagnostic) | 6 (verified 6) | 0/6 (raw 6/6) ³ | 0/6 (raw 6/6) ³ | n/a | 24 and 25 Sep 2026 |
¹ States 2 and 3 begin with the same first page load as State 1. Their O1/O2 counts come from that page load, before the reject or accept click: the same observation as State 1, not a separate result. Activity after a verified reject is O3.
³ Raw counts include requests or storage from our own hardcoded test tags that were withdrawn as findings on 4 Oct 2026 (see the finding text and context note below, and section 8). Where every counted item of that kind was withdrawn, the figure after withdrawal is shown first and the raw count in brackets.
Sampled public homepages (wild)
- State 1: first load, no interactionComplianz: of 382 sampled homepages detected as using it and measured on both 24 and 25 Sep 2026, 260 (68%; Wilson 95% interval 63% to 73%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
- State 2: reject all, then page 2Complianz: of the 284 sampled homepages where our automated reject click could be verified on both days, 31 (11%; interval 8% to 15%) showed listed tracker activity on the next page. Verified clicks depend on the banner's design, so these subsets differ in size and make-up between CMPs and should not be compared as a ranking.
Wild figures are aggregates of sampled public homepages, never a named site. The intervals cover sampling error only, not errors in CMP detection, list matching or click automation. Verified reject clicks depend on each banner's design, so the subsets differ in size and make-up between CMPs and should not be compared as a ranking.
Method and limits
- States: 1 first load; 2 reject all, then page 2; 3 accept all, then page 2; 4 return visit after reject; 5 first load with Global Privacy Control. States 2, 3 and 5 begin with the same first page load as State 1, so what is seen before their click is reported once, with State 1.
- A click state counts only if the banner closed and the CMP's own stored consent decoded to the expected choice.
- Counted finding: seen in at least 2 of 3 runs on at least 2 different days, with the network capture, a screenshot, the list versions and the SHA-256 of the CMP's loaded script stored on every supporting run, and one human review per item. Anything less is not a finding.
- Lists: EasyPrivacy plus a curated list of vendor-documented endpoints for the lab tag set, each pinned by version. The CMP's own consent logging is not counted.
- Tested as labelled above (free tiers, except the Real Cookie Banner Pro configuration with a free reviewer licence); one insertion method (tags hardcoded in the theme header). Tag Manager or plugin-inserted tags may behave differently. "None observed" is not proof of blocking, for any vendor or configuration: a lab result describes the runs we made under the stated conditions and does not show that a product always blocks.
- GPC is a browser signal; EU law does not require consent tools to act on it. State 5 is a diagnostic, not a compliance test.
- Lab run dates are lab days in Israel time (UTC+3); run timestamps are UTC.
Full method: methodology. Full results for all six tested CMPs, with our commercial interests stated before any result: State of Consent 2026 report.
Vendor response
Before publication, Complianz received the passages, table rows and labels that name it, with its evidence, and at least 10 business days to reply, to point out an error, or to supply a configuration for a re-run. A reply of up to 200 words is published here unedited (we omit only text that is against the law or concerns third parties, and tell the vendor first). No reply is not read as agreement.
Statement from Complianz (received 19 October 2026)
Complianz can block any script until the visitor gives consent: automatically for the integrations and services it recognises, and manually for custom scripts, including through Google Tag Manager. As with any consent management platform, blocking depends on the site owner declaring the scripts their site uses. In this test, the pre-consent requests came from tags hardcoded in the theme header that were not declared, or were declared under a service name the plugin does not recognise. Once they were declared, Complianz held them back in every run. Google Consent Mode v2 is part of Complianz Premium and is not a supported setup on the free plugin.
Commercial interests: CookieTelemetry gave notice to leave its affiliate programmes on 24 Sep 2026 ($0 earned) and sells a paid website monitoring service that checks for tracking before consent. Both are described at the top of the report. This page contains no affiliate link and no product offer.