In the EU, the cookie that loads before the click is the one that gets fined

A consent banner is not consent if the cookies were already there when it appeared.

What regulators fined

France's data protection authority, the CNIL, has fined sites for cookies written as soon as the visitor arrived, before any click on the banner:

• SHEIN, €150 million, for cookies placed without consent (CNIL, Sep 1, 2025).
• Condé Nast, publisher of vanityfair.fr, €750,000, for the same reason (CNIL, Nov 20, 2025).

These are not isolated cases. In October 2026 the CNIL fined FNAC Darty €7 million for a tracker in its mobile app, placed without consent (CNIL, Oct 22, 2026). And the CNIL sanctioned 21 organizations over cookies and other trackers in 2025 alone (Solutions Numériques, Feb 9, 2026).

The rule, in one paragraph

EU law asks for the visitor's consent before a site stores or reads non-essential information on their device: analytics, advertising and social media trackers, among others. Cookies that the site strictly needs to work are a different case. European regulators have also said that scrolling down the page is not consent (EDPB, Guidelines 05/2020 on consent). So the question a regulator asks is simple: what did the page do before the visitor chose anything?

What the report records before the choice

SiteMerit opens your page in a real browser, scrolls to the end and clicks nothing. Everything it records happened before any choice. The full report shows:

• Tracking before consent: requests to advertising, analytics and social media domains, tracking cookies and storage keys (localStorage, sessionStorage, IndexedDB), session recorders, and Google Fonts fetched from Google's servers before the choice.
• Every cookie written on load, grouped by the company that owns its domain, with its attributes and its effective lifetime.
• Who the page talks to: each third-party domain that received a request during the first load, with the count.
• The privacy policy link: whether the page links to the site's own policy, and whether it opens.
• The accessibility statement: whether the page leads to one, and whether that link opens a real statement. The European Accessibility Act asks many businesses for it; micro-enterprises that provide services are exempt (CCPC, Ireland).

Each item comes with the evidence we observed, so your developer can find the script that set it and your DPO or counsel can see exactly what happened.

What it does not do

We detect signals of tracking before the choice. We don't say whether that breaks the law on your site, because that depends on the purpose, the legal basis and where you operate. We don't assess your consent banner, we don't test what happens after the click, and we don't issue compliance opinions. Each report covers one page, the address you give us.

The same problem on any site: your site sets cookies before anyone clicks accept

It runs 8 checks on your page, 2 per area. Tracking before consent is not one of them: it needs the real browser of the full report. The full report runs all 45 checks, with evidence and a fix guide, for US$ 29.70, once, and your card is charged only when the report is delivered.