On this page
Does my website set cookies before consent?
The cookie scanner counts what your homepage loads before a visitor clicks your banner: the cookies your server sends with the page, and the trackers in it, from Google Analytics and Tag Manager to the Meta pixel, TikTok, LinkedIn, Hotjar and embedded YouTube videos. For each tracker you see whether it loads at once or waits for consent, and the first line of the result gives the count. On vbsmarketing.eu itself it is zero: we measure visitors without cookies, with our own function on AWS.
The test is the EU one, not a US-style banner check. Under the ePrivacy rules, as Belgium applies them, nothing that is not strictly necessary may be stored on or read from a visitor's device before they agree. A banner that shows while Google Analytics already ran does not meet that, however polished it looks. That is the mistake a company from outside the EU most often makes when it sells into Europe: the banner is there, the order is wrong.
What may run without consent, and what may not
As the Belgian data protection authority explains the rule, in line with the ePrivacy directive.
- Shopping and accounts
- Allowed without consenta cart, a login session
- Needs consent firsta pixel that reports the purchase to an ad platform
- Preferences
- Allowed without consentthe chosen language, the banner choice itself
- Needs consent firsta profile of what the visitor reads
- Measurement
- Allowed without consentmeasurement that stores nothing on the device
- Needs consent firstGoogle Analytics, Hotjar, Clarity
- Advertising
- Allowed without consentnothing
- Needs consent firstMeta pixel, TikTok pixel, LinkedIn Insight Tag, Google Ads
- Embeds
- Allowed without consentYouTube in its no-cookie mode
- Needs consent firsta regular YouTube embed that sets cookies
Consent is an active choice: no pre-ticked boxes, no consent by scrolling, no cookie wall, and rejecting as easy as accepting.
What the scanner reads, and what it leaves to you
The scanner fetches the page the way a new visitor gets it, without clicking anything and without running JavaScript. That catches the most common error: a pixel or analytics snippet written into the page that fires before the banner exists. It also reads your consent tool, such as Cookiebot, OneTrust, CookieYes or Complianz, and whether it holds scripts back with a blocking type, and which default Google Consent Mode is set to.
| Result | Meaning |
|---|---|
| Loads before consent | the tracker is in the page and runs at once |
| Loads cookieless until consent | a Google tag with Consent Mode defaulting to denied |
| Waits for consent | the script is held back by your consent tool |
| Loads at once, functional | a map or video player; a judgement call, often fine |
What a script or Tag Manager loads later is not in the HTML. To see it yourself, open your site in a private window, press F12, pick the Network tab, reload and click nothing. Search the list for google-analytics, googletagmanager, facebook, tiktok, linkedin or hotjar. Anything there before you clicked fired before consent. Under Application, Cookies, you see what was already set.
Enforcement in practice
The Belgian authority fined the publisher Roularta 50,000 euros in 2022, among other things for pre-ticked boxes and some sixty cookies set before consent, and in 2024 ordered Mediahuis to pay a penalty per site and per day until it complied. Other EU authorities act on the same rule. Whether you need a banner at all depends on what you run; do I need a cookie banner goes through it tool by tool.
The order of the first seconds
How it goes wrongTwo trackers before consent
- Page loads
- Google Analytics
- Meta pixel
- Banner shows
- consent
As the law asksNothing before consent
- Page loads
- Language cookie
- Banner shows
- consent
- Analytics and pixel
A reject button is as visible as the accept button, and a no keeps the trackers out. What is strictly necessary, such as a cart or a language choice, may run without consent.
Google Consent Mode, and the rules in motion
If you run Google Analytics or Google Ads in the EU you work with Consent Mode. In basic mode the tags load only after a yes. In advanced mode they load at once with the default set to denied: no cookies, only cookieless pings that Google uses to model your numbers. A default of granted is not consent, and the cookies fire immediately. The scanner reads which default your page sets. What changed in 2026 is covered in the Consent Mode change for Google Analytics, and what a pixel does in Meta pixel.
The European Commission proposed simpler cookie rules in November 2025, and the Council agreed its own position on 21 October 2026, with more purposes that need no consent, such as measuring your own audience. Parliament has yet to vote, so for now nothing changes: running Google Analytics without consent breaks the rule today. Follow the state of play in the Digital Omnibus and cookies.
A banner also needs an explanation behind it: which cookies, what for and for how long, in your cookie and privacy notice. When you need one is in do I need a privacy policy. And whether your banner works with a screen reader, test with the accessibility checker.
Cookie consent questions
Does my website set cookies before consent?
Scan your homepage: the first line of the result gives the number of trackers and cookies that load before anyone says yes. Zero is what EU rules ask.
Is Google Analytics allowed without consent in the EU?
Not under the ePrivacy rules as Belgium and most member states apply them. With Consent Mode defaulting to denied, Google Analytics sets no cookies until a yes.
Does the scanner see everything?
It sees what is in the page and in your server's answer. What a script or Tag Manager adds later shows in your browser's developer tools, on the Network tab.
Can I measure visitors without cookies?
Yes. Measurement that stores nothing on the visitor's device falls outside the cookie rule. This site measures that way, with its own function on AWS.