The consent banner that sets cookies before anyone clicks
A study of one million websites found in 2025: on roughly 43 percent, tracking cookies run without valid consent. The TDDDG requires the opposite. Why the gap almost always comes down to nobody knowing what their own site really loads, and how to find out.
The cookie banner promises: nothing loads before you agree. Reality often looks different. A study of one million websites reached an uncomfortable result in 2025: on roughly 43 percent, tracking cookies ran without valid consent. The banner says one thing, the site does another.
What the law requires
Section 25 of the German TDDDG is clear: before a service accesses the user's device, meaning it sets or reads cookies, it needs active consent. Only strictly necessary cookies, for example for login or the shopping cart, are exempt. Marketing, analytics and tracking are not. Courts have repeatedly confirmed that rejecting must be as easy to reach as accepting.
Why the gap is almost always the same
Hardly any operator sets trackers before consent on purpose. The problem is different: embedded tools, a tag manager, an analytics script added later, a chat widget, an embedded map service load their own resources, often on the very first page view. How the consent banner is configured says nothing about what the site actually does.
Trust is not a check
The only reliable way to close this gap is not the banner configuration but measurement: load your own site with a real browser and observe what loads before consent and what is added after agreement. Only this before-and-after comparison shows whether the banner keeps its promise. Whoever derives their cookie declaration only from the CMP configuration documents an intention, not a behavior.
How isidaten measures it
That is exactly what the cookie scan module in isidaten is for. It loads your pages with a real browser, before and after consent, detects common consent banners and records which cookies, localStorage entries, tracking pixels and third-party requests actually run in each case. Every finding is categorized via a knowledge base, transfers to third countries are flagged. This builds the data basis for your cookie declaration from what the site measurably does, not from an assumption.
Whether your banner keeps its promise can be shown in a single scan. If you want to know what your pages load before consent, talk to us.
Questions about this update?
Talk to us – we are happy to show you this feature in a demo.