Your site sets cookies before anyone clicks accept
The banner controls what happens after the click. Plenty of trackers fire before it — and nothing on screen tells you.
The problem
You installed a consent banner, picked a known vendor, and moved on.
The banner governs what happens after someone clicks. But much of what sets cookies — analytics, ad pixels, chat widgets, embedded maps, external fonts — loads with the page, before any click.
The banner is asking permission for something that already happened. And the moment it matters is rarely a regulator. It's a client asking what their site sends to third parties, a security questionnaire from an enterprise buyer, or a privacy review before a contract closes. You need an answer, and "we have a banner" isn't one.
Why this happens
A modern page doesn't come from one place. It pulls scripts from several third-party domains, and each can set a cookie the moment it loads.
Whoever installs the banner controls the banner. They don't control what the theme, the plugin, the tag manager or an embedded widget load on their own.
And it's invisible. The site opens normally, the banner appears where it should, and nothing indicates that dozens of cookies were already written and a dozen domains already got a request.
How to find out
You can check by hand: open DevTools, go to Application → Cookies and look right after load, without clicking anything. Then Network, and see which domains received requests.
It works. One page at a time, and it takes knowing the tool.
That's what SiteMerit observes automatically. We open your page in a real browser and record the cookies written during the initial load, with no interaction — each with the domain that set it, the path, the timestamp and its security attributes. And we list the third-party domains that received requests, with the count for each.
We show you what happened. What to do about it is your call, and your counsel's if the situation calls for it. We don't issue compliance opinions and we don't assess your banner.
What to do with the list
- Separate necessary from the rest. Session and security cookies usually need to exist. Analytics, ad pixels and A/B tools usually don't need to load before consent.
- Find the loader, not the cookie. A third-party cookie rarely shows up alone. Tag manager, plugin, theme, or an embedded component called it.
- Defer what can be deferred. Most analytics and ad tools support loading only after acceptance. Usually configuration, not a rewrite.
- Re-check after every site change. A new plugin can bring a tracker nobody asked for, and nothing warns you.