Lab test, State of Consent 2026
CookieYes
[Former affiliate: notice given 24 Sep 2026, agreement ended 24 Oct 2026, $0 earned] · free plan, as tested
Counted finding(s) observed under stated conditions
The tested configuration showed listed tracker requests and tracking storage before any choice on first load, in every run on two days. After a verified "reject all", no listed tracker activity on page 2 met our counting rule (one Google tag loader request in 1 of 6 runs, on one day only).
Observed under stated conditions: our own identical WordPress test site, free plan, as tested, our tags (GA4, Google Ads, Meta Pixel, YouTube) hardcoded in the theme header (insertion method A), automated Chromium with a fresh profile per run from a German (EU) IP. Lab days 25 and 26 Sep 2026 (Israel time). Findings human-reviewed on 28 Sep 2026. These are observations of browser behaviour, not a legal assessment of the product.
Lab findings (exact report wording)
- CookieYes, config 1 (plugin defaults, free plan; our tags hardcoded in the theme header): on first load, before any choice, requests to ad.doubleclick.net, region1.google-analytics.com and www.google.com, and the storage names _ga, _ga_LABTEST000, _gcl_au and _gcl_ls, were observed in 3 of 3 runs on 25 Sep and 3 of 3 runs on 26 Sep 2026 (the same was seen in the pre-click phase of the reject, accept and GPC tests); a request to www.facebook.com in the same runs came from our own hardcoded test tags in a form the tested setup was not configured to block, and is withdrawn (see the context note). After a verified "reject all", no listed tracker activity on page 2 met the counting rule (one Google tag loader request in 1 of 6 runs, on one day). On a return visit the stored consent still read as the refusal (6 of 6).
Context: Requests to CookieYes's own consent-log endpoint (log.cookieyes.com) are the CMP's consent logging and are excluded from the findings, per the methodology. A request to www.facebook.com was also observed in every run. It came from our own Meta Pixel inline test snippet, which was not declared to CookieYes and which CookieYes's documentation handles with a consent-event wrapper rather than the data-cookieyes attribute, so it is not reported as a finding (corrections log, section 8). The Google requests and storage names came from our hardcoded Google tag loaders, which are external scripts. The configuration CookieYes served to our page listed no scripts to block. In a diagnostic on our own lab site (3 runs, 4 Oct 2026), with CookieYes's documented data-cookieyes attribute added to those two loaders and nothing else changed, none of the Google requests or storage names occurred. Whether CookieYes's automatic blocking on the free plan should cover these loaders without that attribute, for example after a cookie scan, is open; we asked CookieYes; no answer was received before publication (see the "Vendor response" box below).
CookieYes: what our lab test and our site sample showed before a consent choice
Observed under stated conditions: lab on our own identical WordPress test site, free plan, as tested, our tags hardcoded in the theme header (insertion method A), automated Chromium with a fresh profile per run from a German (EU) IP; wild figures are aggregates of sampled public homepages, never a named site. Not a legal assessment of the product.
- In our lab. On our own WordPress test site (free plan, plugin defaults, lab days 25 and 26 Sep 2026), requests to ad.doubleclick.net, region1.google-analytics.com and www.google.com, and the storage names _ga, _ga_LABTEST000, _gcl_au and _gcl_ls, were observed before any choice in 3 of 3 runs on each day. They came from our hardcoded Google tag loaders, which are external scripts; the configuration CookieYes served to our page listed no scripts to block.
- Correction. An earlier observation of a request to www.facebook.com in the same runs was withdrawn after our audit of 4 Oct 2026, because it came from our own inline test snippet; the report's corrections log (section 8) records it.
- Setup factors. The configuration CookieYes served to our page listed no scripts to block, and our two external Google tag loaders ran. In a diagnostic with CookieYes's documented data-cookieyes attribute added to those two loaders and nothing else changed, none of those requests or storage names occurred (3 runs, 4 Oct 2026). CookieYes's dashboard shows a cookie scan completed on 23 Sep 2026, before our lab days; the served list was still empty. We tested one insertion method only (our tags hardcoded in the theme header); tags added through Tag Manager or a plugin were not tested.
- On sampled homepages. On sampled public homepages detected as using CookieYes, 249 of 324 (77%; Wilson 95% interval 72% to 81%) made a request matching our tracker lists before any choice, on both 28 and 29 Sep 2026 (a second measurement with a corrected runner). Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
- CookieYes's reply. Published unedited in the "Vendor response" box below.
- Method. Our counting rules and limits: methodology.
Raw per-run counts
"Verified" means the automation worked; it is not a verdict on the product. Only the wording above is a finding. O1 = a listed third-party tracker request before a choice; O2 = listed tracking storage (cookie or localStorage name) before a choice; O3 = O1/O2 activity after a verified reject.
Config 1: plugin defaults, free plan
| State | Runs | O1 before a choice | O2 before a choice | O3 after a verified reject | Days |
|---|---|---|---|---|---|
| State 1: first load, no interaction | 6 (verified 6) | 6/6 ³ | 6/6 | n/a | 25 and 26 Sep 2026 |
| State 2: reject all, then page 2 | 6 (verified 6) | 6/6 before the click ¹ ³ | 6/6 before the click ¹ | 1/6 ² | 25 and 26 Sep 2026 |
| State 3: accept all, then page 2 | 6 (verified 6) | 6/6 before the click ¹ ³ | 6/6 before the click ¹ | n/a | 25 and 26 Sep 2026 |
| State 4: return visit after reject | 6 (verified 6) | n/a | n/a | n/a | 25 and 26 Sep 2026 |
| State 5: first load with GPC (synthetic diagnostic) | 6 (verified 6) | 6/6 ³ | 6/6 | n/a | 25 and 26 Sep 2026 |
¹ States 2 and 3 begin with the same first page load as State 1. Their O1/O2 counts come from that page load, before the reject or accept click: the same observation as State 1, not a separate result. Activity after a verified reject is O3.
² Single observations below the repetition rule; not findings.
³ Raw counts include requests or storage from our own hardcoded test tags that were withdrawn as findings on 4 Oct 2026 (see the finding text and context note below, and section 8). Where every counted item of that kind was withdrawn, the figure after withdrawal is shown first and the raw count in brackets.
Sampled public homepages (wild)
- State 1: first load, no interactionCookieYes: of 324 sampled homepages detected as using it and measured on both 28 and 29 Sep 2026, 249 (77%; Wilson 95% interval 72% to 81%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product. A site counts only if the CMP's own script was loaded and its SHA-256 recorded in each counted run. This CookieYes figure comes from a second measurement with a corrected runner, which classifies CookieYes's own consent-logging requests as consent logging, like every CMP's; the figure from our first wild run is withdrawn and not reported.
- State 2: reject all, then page 2CookieYes: of the 182 sampled homepages where our automated reject click could be verified on both days, 28 (15%; interval 11% to 21%) showed listed tracker activity on the next page. Verified clicks depend on the banner's design, so these subsets differ in size and make-up between CMPs and should not be compared as a ranking. A site counts only if the CMP's own script was loaded and its SHA-256 recorded in each counted run.
Wild figures are aggregates of sampled public homepages, never a named site. The intervals cover sampling error only, not errors in CMP detection, list matching or click automation. Verified reject clicks depend on each banner's design, so the subsets differ in size and make-up between CMPs and should not be compared as a ranking.
Method and limits
- States: 1 first load; 2 reject all, then page 2; 3 accept all, then page 2; 4 return visit after reject; 5 first load with Global Privacy Control. States 2, 3 and 5 begin with the same first page load as State 1, so what is seen before their click is reported once, with State 1.
- A click state counts only if the banner closed and the CMP's own stored consent decoded to the expected choice.
- Counted finding: seen in at least 2 of 3 runs on at least 2 different days, with the network capture, a screenshot, the list versions and the SHA-256 of the CMP's loaded script stored on every supporting run, and one human review per item. Anything less is not a finding.
- Lists: EasyPrivacy plus a curated list of vendor-documented endpoints for the lab tag set, each pinned by version. The CMP's own consent logging is not counted.
- Tested as labelled above (free tiers, except the Real Cookie Banner Pro configuration with a free reviewer licence); one insertion method (tags hardcoded in the theme header). Tag Manager or plugin-inserted tags may behave differently. "None observed" is not proof of blocking, for any vendor or configuration: a lab result describes the runs we made under the stated conditions and does not show that a product always blocks.
- GPC is a browser signal; EU law does not require consent tools to act on it. State 5 is a diagnostic, not a compliance test.
- Lab run dates are lab days in Israel time (UTC+3); run timestamps are UTC.
Full method: methodology. Full results for all six tested CMPs, with our commercial interests stated before any result: State of Consent 2026 report.
Vendor response
Before publication, CookieYes received the passages, table rows and labels that name it, with its evidence, and at least 10 business days to reply, to point out an error, or to supply a configuration for a re-run. A reply of up to 200 words is published here unedited (we omit only text that is against the law or concerns third parties, and tell the vendor first). No reply is not read as agreement.
CookieYes received its results and evidence on 4 October 2026 and was invited to send a statement by 19 October 2026. No statement was received.
Commercial interests: CookieTelemetry gave notice to leave its affiliate programmes on 24 Sep 2026 ($0 earned) and sells a paid website monitoring service that checks for tracking before consent. Both are described at the top of the report. This page contains no affiliate link and no product offer.