Lab test, State of Consent 2026
Klaro
[Never a commercial relationship] · open source, as tested
No counted finding under stated conditions
No counted finding in either tested configuration: no listed tracker request or storage met the counting rule on first load, and after a verified "reject all" none met it on page 2 (0 of 6 runs).
Observed under stated conditions: our own identical WordPress test site, open source, as tested, our tags (GA4, Google Ads, Meta Pixel, YouTube) hardcoded in the theme header (insertion method A), automated Chromium with a fresh profile per run from a German (EU) IP. Lab days 24 and 25 Sep 2026 (Israel time). Findings human-reviewed on 28 Sep 2026. These are observations of browser behaviour, not a legal assessment of the product.
Lab findings (exact report wording)
- Klaro, config 1 (vendor-documented script wrapping, opt-in; our tags hardcoded in the theme header): on first load, no listed tracker request or tracking storage met the counting rule (6 of 6 runs verified; 2026-09-24, 2026-09-25). After a verified "reject all", no listed tracker activity on page 2 met the counting rule (0 of 6 runs). On a return visit the stored consent still read as the refusal (6 of 6).
- Klaro, config 2 (config 1 plus a YouTube service with the documented default:true; our tags hardcoded in the theme header): on first load, no listed tracker request or tracking storage met the counting rule (6 of 6 runs verified; 2026-09-24, 2026-09-25). After a verified "reject all", no listed tracker activity on page 2 met the counting rule (0 of 6 runs). On a return visit the stored consent still read as the refusal (6 of 6).
Context: Klaro has no WordPress wizard; its documented integration wraps each tag as type="text/plain", which is what both configs use. No listed tracker request or storage was observed in any state in this window. Known gaps in our test: no persistent reopen/withdraw control on the lab page, and the YouTube iframe is not yet wrapped.
Klaro: what our lab test and our site sample showed before a consent choice
Observed under stated conditions: lab on our own identical WordPress test site, open source, as tested, our tags hardcoded in the theme header (insertion method A), automated Chromium with a fresh profile per run from a German (EU) IP; wild figures are aggregates of sampled public homepages, never a named site. Not a legal assessment of the product.
- In our lab. On our own WordPress test site (two configurations using Klaro's documented script wrapping, lab days 24 and 25 Sep 2026), no listed tracker request or tracking storage met our counting rule before a choice.
- Setup factors. Klaro's documented integration wraps each tag as type="text/plain", which is how both configurations were set up; it is the only CMP in our lab whose tags we marked up, because markup is its only documented method. Known gaps in our test: no persistent reopen or withdraw control on the lab page, and the YouTube iframe was not wrapped.
- On sampled homepages. On sampled public homepages detected as using Klaro, 164 of 358 (46%; Wilson 95% interval 41% to 51%) made a request matching our tracker lists before any choice, on both 24 and 25 Sep 2026. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
- Klaro's reply. Published unedited in the "Vendor response" box below.
- Method. Our counting rules and limits: methodology.
Raw per-run counts
"Verified" means the automation worked; it is not a verdict on the product. Only the wording above is a finding. O1 = a listed third-party tracker request before a choice; O2 = listed tracking storage (cookie or localStorage name) before a choice; O3 = O1/O2 activity after a verified reject.
Config 1: vendor-documented script wrapping, opt-in
| State | Runs | O1 before a choice | O2 before a choice | O3 after a verified reject | Days |
|---|---|---|---|---|---|
| State 1: first load, no interaction | 6 (verified 6) | 0/6 | 0/6 | n/a | 24 and 25 Sep 2026 |
| State 2: reject all, then page 2 | 6 (verified 6) | 0/6 before the click ¹ | 0/6 before the click ¹ | 0/6 | 24 and 25 Sep 2026 |
| State 3: accept all, then page 2 | 6 (verified 6) | 0/6 before the click ¹ | 0/6 before the click ¹ | n/a | 24 and 25 Sep 2026 |
| State 4: return visit after reject | 6 (verified 6) | n/a | n/a | n/a | 24 and 25 Sep 2026 |
| State 5: first load with GPC (synthetic diagnostic) | 6 (verified 6) | 0/6 | 0/6 | n/a | 24 and 25 Sep 2026 |
Config 2: config 1 plus a YouTube service with the documented default:true
| State | Runs | O1 before a choice | O2 before a choice | O3 after a verified reject | Days |
|---|---|---|---|---|---|
| State 1: first load, no interaction | 6 (verified 6) | 0/6 | 0/6 | n/a | 24 and 25 Sep 2026 |
| State 2: reject all, then page 2 | 6 (verified 6) | 0/6 before the click ¹ | 0/6 before the click ¹ | 0/6 | 24 and 25 Sep 2026 |
| State 3: accept all, then page 2 | 6 (verified 6) | 0/6 before the click ¹ | 0/6 before the click ¹ | n/a | 24 and 25 Sep 2026 |
| State 4: return visit after reject | 6 (verified 6) | n/a | n/a | n/a | 24 and 25 Sep 2026 |
| State 5: first load with GPC (synthetic diagnostic) | 6 (verified 6) | 0/6 | 0/6 | n/a | 24 and 25 Sep 2026 |
¹ States 2 and 3 begin with the same first page load as State 1. Their O1/O2 counts come from that page load, before the reject or accept click: the same observation as State 1, not a separate result. Activity after a verified reject is O3.
Sampled public homepages (wild)
- State 1: first load, no interactionKlaro: of 358 sampled homepages detected as using it and measured on both 24 and 25 Sep 2026, 164 (46%; Wilson 95% interval 41% to 51%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
- State 2: reject all, then page 2Klaro: not measured (0 sites verified on both days).
Wild figures are aggregates of sampled public homepages, never a named site. The intervals cover sampling error only, not errors in CMP detection, list matching or click automation. Verified reject clicks depend on each banner's design, so the subsets differ in size and make-up between CMPs and should not be compared as a ranking.
Method and limits
- States: 1 first load; 2 reject all, then page 2; 3 accept all, then page 2; 4 return visit after reject; 5 first load with Global Privacy Control. States 2, 3 and 5 begin with the same first page load as State 1, so what is seen before their click is reported once, with State 1.
- A click state counts only if the banner closed and the CMP's own stored consent decoded to the expected choice.
- Counted finding: seen in at least 2 of 3 runs on at least 2 different days, with the network capture, a screenshot, the list versions and the SHA-256 of the CMP's loaded script stored on every supporting run, and one human review per item. Anything less is not a finding.
- Lists: EasyPrivacy plus a curated list of vendor-documented endpoints for the lab tag set, each pinned by version. The CMP's own consent logging is not counted.
- Tested as labelled above (free tiers, except the Real Cookie Banner Pro configuration with a free reviewer licence); one insertion method (tags hardcoded in the theme header). Tag Manager or plugin-inserted tags may behave differently. "None observed" is not proof of blocking, for any vendor or configuration: a lab result describes the runs we made under the stated conditions and does not show that a product always blocks.
- GPC is a browser signal; EU law does not require consent tools to act on it. State 5 is a diagnostic, not a compliance test.
- Lab run dates are lab days in Israel time (UTC+3); run timestamps are UTC.
Full method: methodology. Full results for all six tested CMPs, with our commercial interests stated before any result: State of Consent 2026 report.
Vendor response
Before publication, Klaro received the passages, table rows and labels that name it, with its evidence, and at least 10 business days to reply, to point out an error, or to supply a configuration for a re-run. A reply of up to 200 words is published here unedited (we omit only text that is against the law or concerns third parties, and tell the vendor first). No reply is not read as agreement.
Klaro received its results and evidence on 4 October 2026 and was invited to send a statement by 16 October 2026. No statement was received.
Commercial interests: CookieTelemetry gave notice to leave its affiliate programmes on 24 Sep 2026 ($0 earned) and sells a paid website monitoring service that checks for tracking before consent. Both are described at the top of the report. This page contains no affiliate link and no product offer.