Does your website load trackers before anyone agrees?

Many business websites load Google Analytics, the Meta pixel or Google Ads the moment someone opens them, without a banner and without anyone agreeing to anything. We measured it on 19 September 2026 on the old website of a bar in Puerto Banús: ten tracking requests and four cookies on the first visit, with no notice at all. That is not a rare case; it is the norm for sites built a few years ago and not touched since. Checking your own site takes five minutes and needs no technical skills.

What did the old site load without consent?

We opened the home page once, clicked nothing, and noted what went out. Ten requests left the page: to Google Analytics, to Google Ads with DoubleClick and to Meta. Four cookies were created, among them the identifiers of Google Analytics, Google Ads and the Meta pixel. A parameter in the requests also showed that no Consent Mode existed, so no setting told Google whether consent had been given. A tag manager was installed but empty; it did nothing.

An agency had set all this up years earlier, and it had been running with every visitor since. Nobody at the bar knew, because nobody could see it: the code shows nothing, the data leaves quietly.

What do the rules say where you are?

It depends on where your customers are. In the European Union, and that includes anyone serving EU visitors, the General Data Protection Regulation and the cookie rules apply: non-essential cookies only after consent, and declining must be as easy as agreeing. Switzerland has its revised data protection act since 1 September 2023, which requires transparency about who processes which data and why. In the United States there is no single federal cookie law, but several states have privacy laws, California among them, and the trend points the same way. Your lawyer checks the details for your market; what we contribute as builders is the technical part: nothing loads before someone says yes, and no is a button just as visible as yes.

A banner is not the same as consent. A banner that merely informs while everything already loads is decoration. What counts is that the services start after the click, not before.

How do you see what your site loads?

Without tools, in the browser: open the developer tools, the «Network» tab, reload the page and click nothing. Every line with google-analytics, doubleclick, googleadservices or facebook is a request before consent. The «Application» or «Storage» tab lists the cookies; names such as _ga, _gcl_au or _fbp belong to tracking services.

Easier: our cookie check opens your site exactly like that, without clicking, and counts the third-party services before consent. The result carries the evidence, so your webmaster knows where to look.

What does a site that gets it right do?

Two examples from our builds. The new site of the same bar has a banner with «Accept all», «Reject all» and settings; Google Analytics and the Meta pixel load only after the yes, and on the first visit zero requests go to third parties. The site of an investment firm in Zug takes the other route: it sets no tracking cookies at all, and its notice says exactly that. Both are honest. The only dishonest thing is a banner behind which everything already runs.

One side effect you should know: whoever measures only after consent sees fewer visitors in their statistics than before. Not because fewer come, but because not everyone is counted any more. In our case studies we say so before anyone gets a fright.