State of Consent 2026: key figures

Numbered statements

Each statement gives a short summary, the exact sentence from the report, its sample size, interval and dates, the report section, and a line to cite it. Per-CMP figures are subsets of sampled homepages, listed alphabetically, and are not a ranking.

1. 1. Across 5 CMPs, the share of sampled homepages with a listed tracker request before any choice ranged from 46% to 77% by CMP (descriptive index 66%), observed under stated conditions.

   Wild. On sampled homepages that use one of 5 CMPs, the observed share that loaded a listed tracker request before the visitor chose ranged from 46% to 77% by CMP (Wilson 95% intervals in section 4; a site counts only if seen on both measurement days; CookieYes measured on 28 and 29 Sep 2026). Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product. Real Cookie Banner's wild figure is withdrawn: by default it accepts all services for visitors it classes as bots (a setting the plugin describes as being for bots, which it says cannot give consent), and our measurement browser is one (section 5).

   Per-CMP n: Complianz 382, Cookiebot 377, CookieYes 324, iubenda 378, Klaro 358. Per-CMP figures are statements 3 to 7; statement 8: Real Cookie Banner, withdrawn.

   Report section: 1. Key findings · Link to this statement

   Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 1. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-1

2. 2. Descriptive index: 66%, the equal-weight mean of the five reported per-CMP first-load shares. Not market prevalence.

   Descriptive index. The equal-weight mean across 5 CMPs at first load is 66%. This is a descriptive index, not market prevalence. Index arithmetic: (68.1% + 73.2% + 76.9% + 65.6% + 45.8%) / 5 = 65.9%, from Complianz, Cookiebot, CookieYes, iubenda and Klaro.

   Each CMP weighs equally, whatever its sample size; no interval is given for the index.

   Report section: 1. Key findings · Link to this statement

   Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 2. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-2

3. 3. Complianz homepages, first load: 68% (260 of 382) made a listed tracker request before any choice. A subset, not a ranking.

   Complianz: of 382 sampled homepages detected as using it and measured on both 24 and 25 Sep 2026, 260 (68%; Wilson 95% interval 63% to 73%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.

   n = 382 sites; 260 observed (68%); Wilson 95% interval 63% to 73%; measured on 24 and 25 Sep 2026.

   Report section: 4.1 Wild, first load · Link to this statement

   Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 3. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-3

4. 4. Cookiebot homepages, first load: 73% (276 of 377) made a listed tracker request before any choice. A subset, not a ranking.

   Cookiebot: of 377 sampled homepages detected as using it and measured on both 24 and 25 Sep 2026, 276 (73%; Wilson 95% interval 69% to 77%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.

   n = 377 sites; 276 observed (73%); Wilson 95% interval 69% to 77%; measured on 24 and 25 Sep 2026.

   Report section: 4.1 Wild, first load · Link to this statement

   Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 4. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-4

5. 5. CookieYes homepages, first load: 77% (249 of 324) made a listed tracker request before any choice. A subset, not a ranking.

   CookieYes: of 324 sampled homepages detected as using it and measured on both 28 and 29 Sep 2026, 249 (77%; Wilson 95% interval 72% to 81%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product. A site counts only if the CMP's own script was loaded and its SHA-256 recorded in each counted run. This CookieYes figure comes from a second measurement with a corrected runner, which classifies CookieYes's own consent-logging requests as consent logging, like every CMP's; the figure from our first wild run is withdrawn and not reported.

   n = 324 sites; 249 observed (77%); Wilson 95% interval 72% to 81%; measured on 28 and 29 Sep 2026.

   Report section: 4.1 Wild, first load · Link to this statement

   Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 5. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-5

6. 6. iubenda homepages, first load: 66% (248 of 378) made a listed tracker request before any choice. A subset, not a ranking.

   iubenda: of 378 sampled homepages detected as using it and measured on both 24 and 25 Sep 2026, 248 (66%; Wilson 95% interval 61% to 70%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.

   n = 378 sites; 248 observed (66%); Wilson 95% interval 61% to 70%; measured on 24 and 25 Sep 2026.

   Report section: 4.1 Wild, first load · Link to this statement

   Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 6. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-6

7. 7. Klaro homepages, first load: 46% (164 of 358) made a listed tracker request before any choice. A subset, not a ranking.

   Klaro: of 358 sampled homepages detected as using it and measured on both 24 and 25 Sep 2026, 164 (46%; Wilson 95% interval 41% to 51%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.

   n = 358 sites; 164 observed (46%); Wilson 95% interval 41% to 51%; measured on 24 and 25 Sep 2026.

   Report section: 4.1 Wild, first load · Link to this statement

   Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 7. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-7

8. 8. Real Cookie Banner homepages, first load: no figure. Withdrawn on 5 Oct 2026, because the CMP's default bot setting applies to our measurement browser.

   Real Cookie Banner: withdrawn. Real Cookie Banner has a setting, on by default, that accepts all services without showing a banner when the visitor's browser looks like a bot. Our measurement browser is headless Chromium, whose user agent contains "HeadlessChrome", and Real Cookie Banner classes it as a bot. On our own lab site, the same configuration showed its banner and loaded no tracker when the browser presented a desktop Chrome user agent, and accepted everything with our measurement browser. Our stored wild data cannot tell which sites had the setting on, so we do not report a figure. The plugin describes the setting as being for bots, which it says cannot give consent; it applies only while no consent decision is stored in the browser, and what we observed is the setting working as described, not a malfunction (method note in section 3).

   Report section: 4.1 Wild, first load · Link to this statement

   Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 8. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-8

9. 9. Complianz homepages, after a verified "reject all": 11% (31 of 284) showed listed tracker activity on the next page. A subset, not a ranking.

   Complianz: of the 284 sampled homepages where our automated reject click could be verified on both days, 31 (11%; interval 8% to 15%) showed listed tracker activity on the next page. Verified clicks depend on the banner's design, so these subsets differ in size and make-up between CMPs (section 4.3) and should not be compared as a ranking.

   n = 284 sites; 31 observed (11%); Wilson 95% interval 8% to 15%; measured on 24 and 25 Sep 2026.

   Report section: 4.2 Wild, reject all then page 2 · Link to this statement

   Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 9. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-9

10. 10. Cookiebot homepages, after a verified "reject all": 26% (58 of 225) showed listed tracker activity on the next page. A subset, not a ranking.

    Cookiebot: of the 225 sampled homepages where our automated reject click could be verified on both days, 58 (26%; interval 21% to 32%) showed listed tracker activity on the next page. Verified clicks depend on the banner's design, so these subsets differ in size and make-up between CMPs (section 4.3) and should not be compared as a ranking.

    n = 225 sites; 58 observed (26%); Wilson 95% interval 21% to 32%; measured on 24 and 25 Sep 2026.

    Report section: 4.2 Wild, reject all then page 2 · Link to this statement

    Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 10. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-10

11. 11. CookieYes homepages, after a verified "reject all": 15% (28 of 182) showed listed tracker activity on the next page. A subset, not a ranking.

    CookieYes: of the 182 sampled homepages where our automated reject click could be verified on both days, 28 (15%; interval 11% to 21%) showed listed tracker activity on the next page. Verified clicks depend on the banner's design, so these subsets differ in size and make-up between CMPs (section 4.3) and should not be compared as a ranking. A site counts only if the CMP's own script was loaded and its SHA-256 recorded in each counted run.

    n = 182 sites; 28 observed (15%); Wilson 95% interval 11% to 21%; measured on 28 and 29 Sep 2026.

    Report section: 4.2 Wild, reject all then page 2 · Link to this statement

    Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 11. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-11

12. 12. iubenda homepages, after a verified "reject all": 31% (38 of 124) showed listed tracker activity on the next page. A subset, not a ranking.

    iubenda: of the 124 sampled homepages where our automated reject click could be verified on both days, 38 (31%; interval 23% to 39%) showed listed tracker activity on the next page. Verified clicks depend on the banner's design, so these subsets differ in size and make-up between CMPs (section 4.3) and should not be compared as a ranking.

    n = 124 sites; 38 observed (31%); Wilson 95% interval 23% to 39%; measured on 24 and 25 Sep 2026.

    Report section: 4.2 Wild, reject all then page 2 · Link to this statement

    Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 12. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-12

13. 13. After a verified "reject all": a minority of sites in each measured subset. Klaro and Real Cookie Banner could not be measured on this state.

    After a reject (wild). Where the reject click could be verified, listed tracker activity on page 2 was observed on a minority of sites (section 4.2). Klaro and Real Cookie Banner could not be measured on this state.

    Klaro: not measured (0 sites verified on both days). Real Cookie Banner: not measured (first load only; no click attempted).

    Report section: 4.2 Wild, reject all then page 2 · Link to this statement

    Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 13. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-13

14. 14. Lab: on our own identical test installs, one tested configuration showed a listed tracker request before any choice on first load, in every run on two days.

    Lab. 270 automated runs over 5 days on our own identical WordPress installs (Complianz, Cookiebot, CookieYes, iubenda, Klaro, Real Cookie Banner), tag insertion method A (our tags hardcoded in the theme header). One tested configuration (CookieYes config 1) showed a listed tracker request before any choice on first load, in every run on two days. After a verified "reject all", no listed tracker activity on page 2 met our counting rule for any countable configuration (CookieYes: one Google tag loader request in 1 of 6 runs, on one day only).

    Lab days 24, 25 and 26 Sep 2026, and 11 and 12 Oct 2026 for Real Cookie Banner Pro (Israel time); free tiers, except Real Cookie Banner Pro with a free reviewer licence; our tags hardcoded in the theme header (insertion method A). Per-vendor wording and the corrections of 4 and 12 Oct 2026: report section 3 and section 8.

    Whether another setup step on our side would have changed the CookieYes result is still open; see the CookieYes page and its vendor response.

    Report section: 3. Lab results per CMP · Link to this statement

    Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 14. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-14

15. 15. Lab, Real Cookie Banner Pro set up with the vendor's onboarding steps (free reviewer licence; desktop Chrome user agent string): no listed tracker request or tracking storage before a choice on first load, and no listed tracker activity after a verified "reject all", in 0 of 6 runs each, observed under stated conditions.

    Real Cookie Banner, Pro configuration (Real Cookie Banner Pro 5.3.8 with a free reviewer licence, set up with the vendor's onboarding steps: scanner run, services and content blockers created from the vendor's templates for our four test tags, banner switched on, every other setting at its default; our tags hardcoded in the theme header; runs with a desktop Chrome user agent string, see the method note): on first load, no listed tracker request or tracking storage met the counting rule (6 of 6 runs verified; 2026-10-11, 2026-10-12). After a verified "reject all", no listed tracker activity on page 2 met the counting rule (0 of 6 runs). On a return visit the stored consent still read as the refusal (6 of 6).

    6 verified runs per state over 11 and 12 Oct 2026 (3 per day); desktop Chrome user agent string; the free plugin (config 1) is not countable; the headless-browser diagnostic is a method note, not a result (report section 3.6).

    Report section: 3.6 Real Cookie Banner · Link to this statement

    Cite this: CookieTelemetry, "State of Consent 2026: key figures", statement 15. Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/stats/#s-15

Cite the whole report: CookieTelemetry, "State of Consent 2026". Published 3 Nov 2026. https://cookietelemetry.com/report/state-of-consent-2026/

Charts

The three charts from the report, as SVG and PNG files with stable addresses. Each carries its conditions, the relationship label for every vendor, the source and its licence or rights notice. Please keep the notes with the chart when you use it.

Use this chart (copy-paste HTML)

<figure>
  <a href="https://cookietelemetry.com/report/state-of-consent-2026/stats/"><img src="https://cookietelemetry.com/report/state-of-consent-2026/charts/wild-first-load.png" alt="Interval chart, State of Consent 2026, sampled public homepages, first load: share that made a listed tracker request before any choice, on both measurement days. Complianz 68% of 382 (95% interval 63% to 73%); Cookiebot 73% of 377 (95% interval 69% to 77%); CookieYes 77% of 324 (95% interval 72% to 81%); iubenda 66% of 378 (95% interval 61% to 70%); Klaro 46% of 358 (95% interval 41% to 51%). Real Cookie Banner: figure withdrawn. Alphabetical, not a ranking." width="960" loading="lazy"></a>
  <figcaption>Wild: sites with a listed tracker request before a choice (first load). Source: <a href="https://cookietelemetry.com/report/state-of-consent-2026/stats/">CookieTelemetry, State of Consent 2026</a>, licensed <a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>.</figcaption>
</figure>

Use this chart (copy-paste HTML)

<figure>
  <a href="https://cookietelemetry.com/report/state-of-consent-2026/stats/"><img src="https://cookietelemetry.com/report/state-of-consent-2026/charts/wild-reject.png" alt="Interval chart, State of Consent 2026, sampled public homepages, after a verified reject all: share with listed tracker activity on page 2. Complianz 11% of 284 (95% interval 8% to 15%); Cookiebot 26% of 225 (95% interval 21% to 32%); CookieYes 15% of 182 (95% interval 11% to 21%); iubenda 31% of 124 (95% interval 23% to 39%); Klaro not measured (0 sites verified on both days); Real Cookie Banner not measured (first load only; no click attempted). Subsets differ between CMPs; not a ranking." width="960" loading="lazy"></a>
  <figcaption>Wild: sites with listed tracker activity on page 2 after a verified reject. Source: <a href="https://cookietelemetry.com/report/state-of-consent-2026/stats/">CookieTelemetry, State of Consent 2026</a>, licensed <a href="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0</a>.</figcaption>
</figure>

Data

state-of-consent-2026-aggregates.csv (CC BY 4.0): the lab counts (verified-run counts per configuration and state after the withdrawals of 4 Oct 2026, with the raw count before them) and the wild aggregates (eligible sites, hits, share and Wilson 95% interval per CMP and state), with the relationship label on every row. Aggregates only; no site is named. The same file the report links.

How our figure differs from other published figures

Our 66% index will be read next to other figures about tracking before consent. They measure different things. Here is what each one counts, as stated by its source, next to what ours counts.

• Singh, Jin and Kim, "When the Abyss Looks Back: Unveiling Evolving Dark Patterns in Cookie Consent Banners", arXiv 2603.21515 (March 2026)

  Reports: DP16 ("cookies set before any user action") at 68% for its Tranco top-10,000 set, computed over the consent banners the crawl extracted, not over all 10,000 sites.

  What it counts: Cookies (in its standard mode, third-party cookies), with tracking domains taken from the Disconnect list; popular websites from the Tranco list plus EU and US subsets; crawled between January and October 2025; all consent banners, not a fixed set of CMPs. It is one of nineteen dark patterns the paper measures.

  Read on 2 Nov 2026 (HTML version v1, section 5.1.1 and table 3).

• Privado AI, Google Consent Mode study, announced on privado.ai (25 Jun 2026); SecurityBrief UK coverage (26 Jun 2026)

  Reports: 48% of 250 heavily visited websites tested had a misconfigured Google Consent Mode, which Privado describes as personal data reaching Google Ads despite an opt-out (consent granted by default, kept after a Global Privacy Control opt-out, or not switched to denied after "reject all").

  What it counts: The Consent Mode state that sites signal to Google, in simulated sessions in California, France and the UK, on 250 heavily visited websites excluding .edu, .gov and .org domains. Privado sells a web-auditing product.

  Read on 2 Nov 2026.

• CookieRisk, homepage of cookierisk.eu

  Reports: 83% of 22,952 sites scanned with its tool (counter as displayed on 2 Nov 2026) had tracking before any banner interaction.

  What it counts: Cookies and trackers firing before any banner interaction, on the sites scanned with its tool. The page we read does not state scan dates or a sampling method, so we cannot set the two side by side in more detail. CookieRisk sells paid monitoring plans.

  Read on 2 Nov 2026.

What our figures count

• Requests, not cookies: on first load, a site counts when the browser made a request matching our tracker lists (EasyPrivacy plus a curated list of documented endpoints, each pinned by version) before any choice.
• Both days: a site counts only if the same result was seen on both measurement days, and only sites measured on both days are in the denominator.
• Five CMP frames: each figure covers sampled homepages detected as using one of five named consent management platforms, not all websites and not a top-sites list.
• Consent Mode kept apart: Google Consent Mode cookieless pings (both storage purposes signalled as denied) and the CMP's own consent logging are counted separately and never as a tracker request.
• Descriptive, not prevalence: the 66% index is the unweighted mean of five per-CMP shares. It does not estimate how common this is across the web, and per-CMP figures are not a ranking.
• September 2026, one automated browser profile from Germany, homepages only. The intervals cover sampling error only, not detection, list-matching or click-automation errors.

These figures answer different questions with different counting rules, samples and dates. They are not contradictory, and none of them, ours included, should be read as if it measured the same thing as the others.

Corrections

Corrections to the report and to these figures are dated and listed in the report's corrections log. To report an error, write to agency@cookietelemetry.com.