Almost every consent banner is answered too late.

the finding

Having a banner barely changes what happens before you answer it.

Of 1,007 sites measured, 83% contacted at least one outside company inside the two-second window. That much is unsurprising. The surprise is that installing a consent tool made almost no difference to it: of the 382 sites where we detected one, 365 had already contacted a third party.

The fifteen widest gaps

Ranked by companies contacted before the banner could be answered.

Being on this table is not an accusation. Read what could make this fine before drawing a conclusion.

by consent platform

No consent platform stopped it on more than 6% of its own sites.

Grouped by the consent tool we detected. The question each row answers is: of the sites running this platform, how many had already contacted an outside company before that platform’s banner could have been answered? Denominators are shown because several are small — a 100% on eleven sites is not the same claim as 94% on a hundred and seventy-seven.

This is not a claim that these platforms are broken. A consent tool governs what fires after a choice; it cannot retroactively govern what the page already loaded before it appeared. That is exactly the gap, and it is the site’s to close, not the vendor’s.

before you draw a conclusion

Four things that can make early contact perfectly correct.

We are not saying any of this is unlawful, and the word does not appear anywhere in the data. You get the timestamps. The conclusion is yours.

method

How this was measured, and what was thrown away.

Sites came from the Tranco top-1M, visited in rank order until 1,000 measurements succeeded. 1492 were attempted and 485 were excluded — mostly infrastructure domains that serve no homepage (gtld-servers.net, gstatic.com), plus timeouts, certificate errors and non-HTML responses. Every exclusion and its reason is in the raw data.

Each site got one cold load in headless Chrome with an empty cookie jar, so no consent choice was ever remembered: this is the first visit, every time. No banner was clicked. Measurement is MurmStack’s own collector — the same code the extension runs — so if the index and the extension ever disagreed, the extension would be wrong.

Domains are merged to their parent company, and the site’s own sibling domains are excluded, so a publisher serving assets from a second domain it owns is not counted as contacting an outside company. Two figures are deliberately absent: bytes transferred, because browsers hide transfer size for most cross-origin requests, and per-company blocking time, because the browser exposes only a page-wide figure that cannot honestly be divided up.

Measured 5 August 2026 · Download the raw data (JSON, 1,007 sites) · CC BY 4.0, so quote it freely with a link.