State of Consent 2026

1. Key findings

• Lab. 270 automated runs over 5 days on our own identical WordPress installs (Complianz, Cookiebot, CookieYes, iubenda, Klaro, Real Cookie Banner), tag insertion method A (our tags hardcoded in the theme header). One tested configuration (CookieYes config 1) showed a listed tracker request before any choice on first load, in every run on two days. After a verified "reject all", no listed tracker activity on page 2 met our counting rule for any countable configuration (CookieYes: one Google tag loader request in 1 of 6 runs, on one day only). Per vendor:
  • Complianz (free plugin, as tested): config1: no counted finding on first load (the pre-choice requests came from our own test tags and are withdrawn; section 3); config2: no counted finding on first load (the pre-choice requests came from our own test tags and are withdrawn; section 3).
  • Cookiebot (free plan, dashboard snippet unchanged; see the note on automatic blocking in 3.2): config1: no counted finding on first load (the pre-choice requests came from our own test tags and are withdrawn; section 3).
  • CookieYes (free plan, as tested): config1: counted finding on first load, requests to ad.doubleclick.net, region1.google-analytics.com, www.google.com; tracking storage _ga, _ga_LABTEST000, _gcl_au, _gcl_ls; www.facebook.com from our own test tag withdrawn (section 3).
  • iubenda (free plan, as tested): config1: no counted finding on first load.
  • Klaro (open source, as tested): config1: no counted finding on first load; config2: no counted finding on first load.
  • Real Cookie Banner (free plugin; Pro with a free reviewer licence): free plugin (config 1): not countable (the plugin's banner was never switched on in our free setup; section 3); configpro (Pro, configured, desktop Chrome user agent string): no listed tracker request or tracking storage before a choice on first load (0 of 6 runs, 11 and 12 Oct 2026), and none on page 2 after a verified reject (0 of 6 runs).
• Wild. On sampled homepages that use one of 5 CMPs, the observed share that loaded a listed tracker request before the visitor chose ranged from 46% to 77% by CMP (Wilson 95% intervals in section 4; a site counts only if seen on both measurement days; CookieYes measured on 28 and 29 Sep 2026). Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product. Real Cookie Banner's wild figure is withdrawn: by default it accepts all services for visitors it classes as bots (a setting the plugin describes as being for bots, which it says cannot give consent), and our measurement browser is one (section 5).
• Descriptive index. The equal-weight mean across 5 CMPs at first load is 66% ³. This is a descriptive index, not market prevalence.
• After a reject (wild). Where the reject click could be verified, listed tracker activity on page 2 was observed on a minority of sites (section 4.2). Klaro and Real Cookie Banner could not be measured on this state.

³ Index arithmetic: (68.1% + 73.2% + 76.9% + 65.6% + 45.8%) / 5 = 65.9%, from Complianz, Cookiebot, CookieYes, iubenda and Klaro.

2. Methodology summary

• Two separate studies, never mixed. Lab: one identical WordPress install per CMP on our own lab domain, product comparison allowed. Wild: public homepages that use each CMP, aggregates only, never a named site, never a ranking.
• Browser. Automated Chromium (Playwright), fresh context per run, German (EU) IP. Unmodified headless Chromium: its user agent contains "HeadlessChrome" and navigator.webdriver is true (section 5, measurement browser). Exception: the Real Cookie Banner Pro runs presented a desktop Chrome user agent string, because that plugin's default bot setting accepts all services for a HeadlessChrome user agent; the headless runs on that configuration are a labelled diagnostic (section 3).
• States. 1 first load; 2 reject all then page 2; 3 accept all then page 2; 4 return visit after reject; 5 first load with Global Privacy Control. The wild study uses states 1-3. States 2, 3 and 5 begin with the same first page load as State 1, so what is seen before their click is reported once, with State 1.
• GPC. GPC is a browser signal; EU law does not require consent tools to act on it. State 5 is a diagnostic, not a compliance test.
• Click verification. A click state counts only if the banner closed and the CMP's own stored consent decoded to the expected choice. Failed automation and clicks whose stored state did not update are reported separately, never merged into results.
• Observation classes. O1: a listed third-party tracker request before a choice. O2: listed tracking storage (cookie or localStorage name) before a choice. O3: O1/O2 activity after a verified reject. Consent Mode cookieless pings, CMP consent logging and first-party collectors are counted separately and never as findings (lab: the CMP's own logging requests are removed at aggregation; wild re-run of CookieYes and Real Cookie Banner: classified as consent logging during measurement, and the CMP's own script hash is recorded per run).
• Lists. EasyPrivacy (CC BY-SA 3.0, attribution) plus a curated list of vendor-documented endpoints for the lab tag set (GA4, Google Ads, Meta Pixel, YouTube). Each list pinned by version.
• Configurations. Config 1 = default install via the vendor's wizard. Config 2 = the vendor's own documented setup, as far as the tested plan allows, doc version archived. No tuning by us. A vendor-supplied config is re-run as config 3. Config Pro (Real Cookie Banner only) = the vendor's onboarding steps on the Pro plugin, with a free reviewer licence.
• Counted finding (protocol 5.5). Seen in at least 2 of 3 runs on at least 2 different days; HAR, screenshot, list versions and the SHA-256 of the CMP's loaded script stored on every supporting run; one human review with a per-item checkbox. Anything less is not a finding and is not reported as one.
• Dates. Lab run dates are lab days in Israel time (UTC+3); run timestamps are UTC.
• Statistics (wild). Counts, eligible denominators and Wilson 95% intervals. n < 30 suppressed; 30-99 counts only; n >= 100 share plus interval. A site is eligible when the state was verified on both days, and a hit when the rule held on both days. Pooled figures weight each CMP equally. Alphabetical order.
• Controls. A known-good site (no tags) and a known-bad site (tags, no CMP) are run before every batch. Controls gate per lab day: 2026-09-24: gate recorded in that day's findings file (no batch summary); 2026-09-25: passed (6 of 6 control runs); 2026-09-26: passed (6 of 6 control runs); 2026-10-11: passed (6 of 6 control runs); 2026-10-12: passed (6 of 6 control runs).

Full method, published before any result: Methodology.

3. Lab results per CMP

All lab rows: free tier as tested (except the Real Cookie Banner Pro configuration, free reviewer licence), insertion method A (tags hardcoded in the theme header). "Verified" means the automation worked; it is not a verdict on the product. The tables give raw per-run counts; only the finding wording is a finding, and only after human review.

4. Wild prevalence

Sampled homepages detected as using each CMP; automated browser, Germany; measurement days: 24 and 25 Sep 2026; CookieYes and Real Cookie Banner (re-run): 28 and 29 Sep 2026. Aggregates only; no site is named. Alphabetical order, not a ranking. Overlapping intervals are not a claim of equivalence.

4.1 State 1: first load, no interaction

The intervals cover sampling error only, not errors in CMP detection, list matching or click automation. Ten homepages had two CMPs and are counted under both.

• Complianz: of 382 sampled homepages detected as using it and measured on both 24 and 25 Sep 2026, 260 (68%; Wilson 95% interval 63% to 73%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
• Cookiebot: of 377 sampled homepages detected as using it and measured on both 24 and 25 Sep 2026, 276 (73%; Wilson 95% interval 69% to 77%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
• CookieYes: of 324 sampled homepages detected as using it and measured on both 28 and 29 Sep 2026, 249 (77%; Wilson 95% interval 72% to 81%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product. A site counts only if the CMP's own script was loaded and its SHA-256 recorded in each counted run. This CookieYes figure comes from a second measurement with a corrected runner, which classifies CookieYes's own consent-logging requests as consent logging, like every CMP's; the figure from our first wild run is withdrawn and not reported.
• iubenda: of 378 sampled homepages detected as using it and measured on both 24 and 25 Sep 2026, 248 (66%; Wilson 95% interval 61% to 70%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
• Klaro: of 358 sampled homepages detected as using it and measured on both 24 and 25 Sep 2026, 164 (46%; Wilson 95% interval 41% to 51%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
• Real Cookie Banner: withdrawn. Real Cookie Banner has a setting, on by default, that accepts all services without showing a banner when the visitor's browser looks like a bot. Our measurement browser is headless Chromium, whose user agent contains "HeadlessChrome", and Real Cookie Banner classes it as a bot. On our own lab site, the same configuration showed its banner and loaded no tracker when the browser presented a desktop Chrome user agent, and accepted everything with our measurement browser. Our stored wild data cannot tell which sites had the setting on, so we do not report a figure. The plugin describes the setting as being for bots, which it says cannot give consent; it applies only while no consent decision is stored in the browser, and what we observed is the setting working as described, not a malfunction (method note in section 3).

4.2 State 2: reject all, then page 2

• Complianz: of the 284 sampled homepages where our automated reject click could be verified on both days, 31 (11%; interval 8% to 15%) showed listed tracker activity on the next page. Verified clicks depend on the banner's design, so these subsets differ in size and make-up between CMPs (section 4.3) and should not be compared as a ranking.
• Cookiebot: of the 225 sampled homepages where our automated reject click could be verified on both days, 58 (26%; interval 21% to 32%) showed listed tracker activity on the next page. Verified clicks depend on the banner's design, so these subsets differ in size and make-up between CMPs (section 4.3) and should not be compared as a ranking.
• CookieYes: of the 182 sampled homepages where our automated reject click could be verified on both days, 28 (15%; interval 11% to 21%) showed listed tracker activity on the next page. Verified clicks depend on the banner's design, so these subsets differ in size and make-up between CMPs (section 4.3) and should not be compared as a ranking. A site counts only if the CMP's own script was loaded and its SHA-256 recorded in each counted run.
• iubenda: of the 124 sampled homepages where our automated reject click could be verified on both days, 38 (31%; interval 23% to 39%) showed listed tracker activity on the next page. Verified clicks depend on the banner's design, so these subsets differ in size and make-up between CMPs (section 4.3) and should not be compared as a ranking.

4.3 Measurement validity (wild)

Click-state outcomes per CMP, both days pooled (one row per origin and day). Only "verified" runs enter the tables above.

• 10 homepages appear in two CMP samples (two CMPs detected) and are counted under each.
• CookieYes first_load: 108 verified runs in which the CMP's own script was not loaded or not hashed (not counted; the CMP may no longer be on the page).
• CookieYes reject_then_page2: 6 verified runs in which the CMP's own script was not loaded or not hashed (not counted; the CMP may no longer be on the page).
• Real Cookie Banner first_load: 56 verified runs in which the CMP's own script was not loaded or not hashed (not counted; the CMP may no longer be on the page).
• Complianz first_load: 2 sites observed on one day only (uncertain, not counted).
• Complianz reject_then_page2: 4 sites observed on one day only (uncertain, not counted).
• Cookiebot first_load: 3 sites observed on one day only (uncertain, not counted).
• Cookiebot reject_then_page2: 7 sites observed on one day only (uncertain, not counted).
• CookieYes first_load: 2 sites observed on one day only (uncertain, not counted).
• CookieYes reject_then_page2: 7 sites observed on one day only (uncertain, not counted).
• iubenda first_load: 6 sites observed on one day only (uncertain, not counted).
• iubenda reject_then_page2: 2 sites observed on one day only (uncertain, not counted).
• Klaro first_load: 3 sites observed on one day only (uncertain, not counted).
• 24 Sep 2026 (day A): all 1600 sampled (site, CMP) pairs measured.
• 25 Sep 2026 (day B): 1505 of 1508 sampled (site, CMP) pairs measured; 3 not measured (runner hang on the last sites; the run was stopped on 27 Sep 2026): Klaro 3.
• 28 Sep 2026 (CookieYes re-run, day A): all 400 sampled (site, CMP) pairs measured.
• 29 Sep 2026 (CookieYes re-run, day B): all 381 sampled (site, CMP) pairs measured.
• 28 Sep 2026 (Real Cookie Banner re-run, day A): all 400 sampled (site, CMP) pairs measured.
• 29 Sep 2026 (Real Cookie Banner re-run, day B): all 391 sampled (site, CMP) pairs measured.

4.4 Day A vs day B agreement (wild)

Sites whose state was verified on both days. "Agree" = the same verdict (tracker seen / not seen) on both days. Kappa corrects for chance agreement. Real Cookie Banner: withdrawn (section 4.1).

5. Limitations

• Free tiers as tested, except Real Cookie Banner, which was also tested on Pro with a free reviewer licence (section 3). Some features that affect blocking are paid and were not tested: Complianz lists Consent Mode v2 under its Premium plans. For Cookiebot's automatic blocking, see the note in section 3.2.
• Lab results use one insertion method (A, tags hardcoded in the theme header). Tag Manager (B) and plugin-inserted tags (C) may behave differently.
• Day-1 lab manifests (Complianz, Klaro, Real Cookie Banner free) were classified with the curated list only; days 2-3 also used EasyPrivacy. The one visible effect was on the free Real Cookie Banner install, which is not countable (section 3). Day-1 CMP script hashes were backfilled from the stored HARs.
• Real Cookie Banner, free plugin (config 1), is not countable in the lab: its banner was never switched on in our default free setup, so it showed no banner and loaded no banner script (section 3). The Pro configuration was measured separately on 11 and 12 Oct 2026, two to three weeks after the other lab days, with a desktop Chrome user agent string; see the method note in section 3.
• Our first wild run classified with no CMP-domain exclusion. For CookieYes this may have counted its own consent-logging request as a tracker, so that figure was withdrawn. CookieYes and Real Cookie Banner were measured on 28 and 29 Sep 2026 with a corrected runner that classifies each CMP's own domains as consent logging. The other CMPs' figures come from the first run; the logging endpoints we checked for them are not on EasyPrivacy. In the lab, the CMP's own logging requests are removed at aggregation.
• Wild CMP detection comes from discovery (HTTP Archive / homepage signatures); presence of the CMP on the page at measurement time was not re-verified per site, except in the CookieYes and Real Cookie Banner re-run, where the CMP's own script had to be loaded. Detection error is possible and is being sampled manually.
• Wild reject/accept states depend on the lab-verified selectors matching each site's banner; many sites use customised banners, so click-state coverage varies widely by CMP (section 4.3).
• The first wild run (Complianz, Cookiebot, iubenda, Klaro) did not store the CMP script hash; those wild figures are aggregates only (protocol 5.5 applies to named lab findings). In the CookieYes and Real Cookie Banner re-run a site counts only if the CMP's own script was loaded and hashed in each counted run; 170 verified runs without it were left out (section 4.3).
• Measurement browser. All lab and wild page loads used unmodified headless Chromium 151 driven by Playwright, except that the Real Cookie Banner Pro runs presented a desktop Chrome user agent string (below). Its user agent contains "HeadlessChrome", navigator.webdriver is true, and its client hints name HeadlessChrome. Some CMPs change behaviour for browsers they class as bots. We checked the client code of each CMP in this study and ran each lab site with three browser identities (default, a crawler user agent, and a desktop Chrome user agent with the automation flag hidden). Complianz, Cookiebot, CookieYes, iubenda and Klaro behaved identically with our measurement browser and with the desktop Chrome identity. Real Cookie Banner did not (section 4.1 and the method note in section 3), so its Pro configuration was measured with a desktop Chrome user agent string only (navigator.webdriver and the client hints unchanged), and the headless runs are reported only as a diagnostic. A site's own scripts may also treat an automated browser differently; we cannot measure that, and it is one of the reasons the wild figures describe what an automated browser saw, not what every visitor sees.
• Homepages only, one automated browser profile from Germany. Results describe sampled homepages, not EU-wide prevalence or product causation.
• "None observed in this window" is not proof of blocking or of Consent Mode basic mode. This applies to every CMP and configuration in this report: a lab result describes the runs we made under the stated conditions and does not show that a product always blocks.
• Hardcoded inline tags versus CMP blocking methods. Our method-A test tags are hardcoded in the theme header: an external Google tag loader plus an inline snippet (the GA4 and Google Ads gtag('config') commands, and the Meta Pixel initialisation, which itself loads the Pixel library). CMPs block in different ways: by rewriting known scripts for the services declared in their setup (Complianz), by blocking scripts their own scan or settings have identified (Cookiebot, CookieYes), or by markup the site owner adds (Cookiebot's free plan, CookieYes's attribute, Klaro). An inline snippet the CMP was not told about, or that its documented method does not cover, can run regardless of the CMP, and an inline command can also act through a tag library that the CMP itself loads (Complianz config 2). We did not mark up any tag for any CMP's manual method, except for Klaro, whose only documented method is markup. After auditing every counted lab finding on 4 Oct 2026, we withdrew the observations that came from such snippets (section 8); a lab finding is reported only where the request came from a script that the CMP's documented method for the tested setup covers, and, where that method depends on a documented prerequisite such as a completed scan, only after we have checked that it was met. The wild study does not use our test tags, but real sites can carry the same pattern, and the wild figures cannot separate it from the product.
• Complianz configuration switches were written directly to the plugin's settings, which bypasses its 30-minute blocked-script cache; this affected no reported result.
• Real Cookie Banner (wild): its figure is withdrawn (section 4.1 and the measurement-browser item above). It was measured on first load only; at the time there were no lab-verified selectors for its banner, so no click state was measured. The lab Pro result does not restore it. Many installs serve its script from an obfuscated path; the script was identified by its element id.
• Wild day B (25 Sep 2026): 3 of 1508 sampled (site, CMP) pairs were not measured (runner hang on the last sites; the run was stopped on 27 Sep 2026). They are absent from both-day denominators, not counted as no-hit.

6. Independence note

• Our former affiliate relationships and our paid monitoring service are described at the top of this report. Rows carry a relationship label. The report contains no affiliate links and no offer for our own service.
• Selection rule and methodology were fixed before results. A former affiliate's adverse result is published the same way.
• No vendor paid for or approved these results. Any free test licence a vendor grants is disclosed here.
• Reviewer licence: The Real Cookie Banner Pro licence used in our lab was provided free by devowl.io on 5 Oct 2026 as a reviewer licence; there is no other relationship. devowl.io took part in the review and gave feedback on our setup. The configuration we measured is the one we set up on 5 Oct 2026; it was not changed between then and the measured runs (the same configuration fingerprint on 5, 11 and 12 Oct 2026). devowl.io was not asked to approve the results.
• Tests measure specified browser behaviour, not GDPR or ePrivacy compliance. List matches identify candidate tracking activity; names, domains and CNAMEs alone do not establish purpose.

Required by the CookieYes affiliate terms (§6.3) while that agreement was in force (it ended on 24 October 2026); kept unchanged:

Disclaimer: This content is for informational and educational purposes only and does not constitute legal advice. CookieYes is a technology platform that assists with privacy compliance. However, it is the sole responsibility of each user to ensure compliance with applicable laws and regulations. Consult a qualified legal professional for advice specific to your situation.

See also our independence statement.

7. Vendor responses

Each named vendor received the passages, table rows, charts and labels that name it, with its evidence, at least 10 business days before publication, an offer to re-run with a configuration it supplies, and space for a reply of up to 200 words, published unedited next to its results (we omit only text that is against the law or concerns third parties, and tell the vendor first). Edits made after that material was sent did not change any vendor's results: they record a vendor's statement or that none was received, or add explanation. No veto. Silence is not agreement.

• Complianz [Former affiliate, exited 24 Sep 2026, $0 earned]

  Statement from Complianz (received 19 October 2026)

  Complianz can block any script until the visitor gives consent: automatically for the integrations and services it recognises, and manually for custom scripts, including through Google Tag Manager. As with any consent management platform, blocking depends on the site owner declaring the scripts their site uses. In this test, the pre-consent requests came from tags hardcoded in the theme header that were not declared, or were declared under a service name the plugin does not recognise. Once they were declared, Complianz held them back in every run. Google Consent Mode v2 is part of Complianz Premium and is not a supported setup on the free plugin.

• Cookiebot [Never a commercial relationship]

  Cookiebot received its results and evidence on 4 October 2026 and was invited to send a statement by 19 October 2026. No statement was received.

• CookieYes [Former affiliate: notice given 24 Sep 2026, agreement ended 24 Oct 2026, $0 earned]

  CookieYes received its results and evidence on 4 October 2026 and was invited to send a statement by 19 October 2026. No statement was received.

• iubenda [No direct relationship; same group (team.blue) ran the Complianz programme we left on 24 Sep 2026]

  iubenda received its results and evidence on 4 October 2026 and was invited to send a statement by 16 October 2026. No statement was received.

• Klaro [Never a commercial relationship]

  Klaro received its results and evidence on 4 October 2026 and was invited to send a statement by 16 October 2026. No statement was received.

• Real Cookie Banner [No affiliate or paid relationship; free Pro reviewer licence from devowl.io (5 Oct 2026)]

  Real Cookie Banner received its results and evidence on 13 October 2026 and was invited to send a statement by 23 October 2026. No statement was received.

8. Corrections log

• 4 Oct 2026, before publication: a diagnostic on our own lab site showed that the Complianz config 2 GA4 request and _ga cookies came from our own hardcoded test tag. We then audited every counted lab finding for the same kind of test-setup effect and withdrew, as findings: Complianz config 1 (www.facebook.com); Complianz config 2 (_ga, _ga_LABTEST000, region1.google-analytics.com, www.facebook.com); Cookiebot config 1 (www.facebook.com); CookieYes config 1 (www.facebook.com). In each case the request or storage came from our own hardcoded test tags in a form the tested setup was not configured to block, not from a script that the CMP's documented method for that setup covers (see each context note in section 3 and the limitation in section 5). The diagnostic run data is available on request. Each affected vendor is told of the correction and receives a new reply period.
• 5 Oct 2026, before publication: Real Cookie Banner's default "accept all services for bots" setting treats our measurement browser as a bot. Its wild figure is withdrawn and the index is recomputed over 5 CMPs (66%). The other five CMPs were checked in code and in a lab A/B and are not affected.
• 12 Oct 2026, before publication: the Real Cookie Banner lab section said the free plugin "did not load" in our setup. That was inaccurate: the plugin was installed, but its cookie banner setting was off in our install and was never switched on in our default free setup, so it showed no banner and our test tags ran without a consent step. The free configuration stays not countable. We added a configured test of Real Cookie Banner Pro (free reviewer licence from devowl.io, 5 Oct 2026), set up with the vendor's onboarding steps and measured on 11 and 12 Oct 2026; its result is in section 3, with a method note on the plugin's default bot setting. The Real Cookie Banner wild figure stays withdrawn. devowl.io receives the configured result and a new reply period.

To report an error, write to agency@cookietelemetry.com. Corrections are dated and listed here.

Data download

state-of-consent-2026-aggregates.csv: the lab counts (verified-run counts per configuration and state after the withdrawals of 4 Oct 2026, with the raw count before them) and the wild aggregates (eligible sites, hits, share and Wilson 95% interval per CMP and state), with the relationship label on every row. Aggregates only; no site is named. Real Cookie Banner's lab install is listed as not countable, without counts. Licensed CC BY 4.0, like the charts: see key figures, charts and how to cite.