Lab test, State of Consent 2026
iubenda
[No direct relationship; same group (team.blue) ran the Complianz programme we left on 24 Sep 2026] · free plan, as tested
No counted finding under stated conditions
No counted finding on first load: no listed tracker request or tracking storage met the counting rule. After a verified "reject all", no listed tracker activity on page 2 met the counting rule (0 of 6 runs).
Observed under stated conditions: our own identical WordPress test site, free plan, as tested, our tags (GA4, Google Ads, Meta Pixel, YouTube) hardcoded in the theme header (insertion method A), automated Chromium with a fresh profile per run from a German (EU) IP. Lab days 25 and 26 Sep 2026 (Israel time). Findings human-reviewed on 28 Sep 2026. These are observations of browser behaviour, not a legal assessment of the product.
Lab findings (exact report wording)
- iubenda, config 1 (default install, free plan; our tags hardcoded in the theme header): on first load, no listed tracker request or tracking storage met the counting rule (6 of 6 runs verified; 2026-09-25, 2026-09-26). After a verified "reject all", no listed tracker activity on page 2 met the counting rule (0 of 6 runs). On a return visit the stored consent still read as the refusal (6 of 6).
Context: The isolated observations in the table are single Google tag beacons (googletagmanager.com/a?id=... or one GA4 collect) in 1 of 3 runs on one day; none repeated on a second day.
iubenda: what our lab test and our site sample showed before a consent choice
Observed under stated conditions: lab on our own identical WordPress test site, free plan, as tested, our tags hardcoded in the theme header (insertion method A), automated Chromium with a fresh profile per run from a German (EU) IP; wild figures are aggregates of sampled public homepages, never a named site. Not a legal assessment of the product.
- In our lab. On our own WordPress test site (free plan, default install, lab days 25 and 26 Sep 2026), no listed tracker request or tracking storage met our counting rule before a choice. Single Google tag beacons appeared in 1 of 3 runs on one day and did not repeat on a second day, so they are below our repetition rule and not a finding.
- Setup factors. We tested one insertion method only (our tags hardcoded in the theme header); tags added through Tag Manager or a plugin were not tested. Paid plans were not tested.
- On sampled homepages. On sampled public homepages detected as using iubenda, 248 of 378 (66%; Wilson 95% interval 61% to 70%) made a request matching our tracker lists before any choice, on both 24 and 25 Sep 2026. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
- iubenda's reply. Published unedited in the "Vendor response" box below.
- Method. Our counting rules and limits: methodology.
Raw per-run counts
"Verified" means the automation worked; it is not a verdict on the product. Only the wording above is a finding. O1 = a listed third-party tracker request before a choice; O2 = listed tracking storage (cookie or localStorage name) before a choice; O3 = O1/O2 activity after a verified reject.
Config 1: default install, free plan
| State | Runs | O1 before a choice | O2 before a choice | O3 after a verified reject | Days |
|---|---|---|---|---|---|
| State 1: first load, no interaction | 6 (verified 6) | 0/6 | 0/6 | n/a | 25 and 26 Sep 2026 |
| State 2: reject all, then page 2 | 6 (verified 6) | 0/6 before the click ¹ | 0/6 before the click ¹ | 0/6 | 25 and 26 Sep 2026 |
| State 3: accept all, then page 2 | 6 (verified 6) | 1/6 ² before the click ¹ | 0/6 before the click ¹ | n/a | 25 and 26 Sep 2026 |
| State 4: return visit after reject | 6 (verified 6) | n/a | n/a | n/a | 25 and 26 Sep 2026 |
| State 5: first load with GPC (synthetic diagnostic) | 6 (verified 6) | 3/6 ² | 0/6 | n/a | 25 and 26 Sep 2026 |
¹ States 2 and 3 begin with the same first page load as State 1. Their O1/O2 counts come from that page load, before the reject or accept click: the same observation as State 1, not a separate result. Activity after a verified reject is O3.
² Single observations below the repetition rule; not findings.
Sampled public homepages (wild)
- State 1: first load, no interactioniubenda: of 378 sampled homepages detected as using it and measured on both 24 and 25 Sep 2026, 248 (66%; Wilson 95% interval 61% to 70%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
- State 2: reject all, then page 2iubenda: of the 124 sampled homepages where our automated reject click could be verified on both days, 38 (31%; interval 23% to 39%) showed listed tracker activity on the next page. Verified clicks depend on the banner's design, so these subsets differ in size and make-up between CMPs and should not be compared as a ranking.
Wild figures are aggregates of sampled public homepages, never a named site. The intervals cover sampling error only, not errors in CMP detection, list matching or click automation. Verified reject clicks depend on each banner's design, so the subsets differ in size and make-up between CMPs and should not be compared as a ranking.
Method and limits
- States: 1 first load; 2 reject all, then page 2; 3 accept all, then page 2; 4 return visit after reject; 5 first load with Global Privacy Control. States 2, 3 and 5 begin with the same first page load as State 1, so what is seen before their click is reported once, with State 1.
- A click state counts only if the banner closed and the CMP's own stored consent decoded to the expected choice.
- Counted finding: seen in at least 2 of 3 runs on at least 2 different days, with the network capture, a screenshot, the list versions and the SHA-256 of the CMP's loaded script stored on every supporting run, and one human review per item. Anything less is not a finding.
- Lists: EasyPrivacy plus a curated list of vendor-documented endpoints for the lab tag set, each pinned by version. The CMP's own consent logging is not counted.
- Tested as labelled above (free tiers, except the Real Cookie Banner Pro configuration with a free reviewer licence); one insertion method (tags hardcoded in the theme header). Tag Manager or plugin-inserted tags may behave differently. "None observed" is not proof of blocking, for any vendor or configuration: a lab result describes the runs we made under the stated conditions and does not show that a product always blocks.
- GPC is a browser signal; EU law does not require consent tools to act on it. State 5 is a diagnostic, not a compliance test.
- Lab run dates are lab days in Israel time (UTC+3); run timestamps are UTC.
Full method: methodology. Full results for all six tested CMPs, with our commercial interests stated before any result: State of Consent 2026 report.
Vendor response
Before publication, iubenda received the passages, table rows and labels that name it, with its evidence, and at least 10 business days to reply, to point out an error, or to supply a configuration for a re-run. A reply of up to 200 words is published here unedited (we omit only text that is against the law or concerns third parties, and tell the vendor first). No reply is not read as agreement.
iubenda received its results and evidence on 4 October 2026 and was invited to send a statement by 16 October 2026. No statement was received.
Commercial interests: CookieTelemetry gave notice to leave its affiliate programmes on 24 Sep 2026 ($0 earned) and sells a paid website monitoring service that checks for tracking before consent. Both are described at the top of the report. This page contains no affiliate link and no product offer.