Your cookie banner is there. Has anyone checked it works?

An online clothing shop, one of the French consumer brands we visited in October 2026. You land on the home page and a cookie banner comes up, as it should. It comes from one of the consent tools on the market, it asks for your permission, and it offers a button to say no. Everything looks in order. Whoever runs this shop has, by all appearances, done what was expected.

We wanted to know whether the banner does what it says. So on October 22, 2026, we opened the site in a fresh browser, with no history, and watched what the browser itself was doing: which cookies were stored, and which data left the page, before and after we refused.

Two terms first. A tracker is a cookie or a script that lets an advertising or analytics company recognize you from one page or visit to the next. An ad network is the company that receives that data: Meta, Pinterest, TikTok and the like.

Six trackers before the first click

We arrived, clicked nothing and waited seven seconds. The banner was on screen, still waiting for an answer.

Six tracker cookies were already in the browser: one each for Meta, Microsoft Ads, Microsoft Clarity and TikTok, and two for Pinterest. Microsoft Clarity is a tool that records how a visitor moves around a site, clicks and scrolling included. Data had also already gone out to Meta, Pinterest, TikTok, Microsoft and Google.

A consent banner exists to ask visitors for their permission before this kind of tracking starts. Here, the question arrives after the answer has already been given.

Nothing on the screen gives this away. The page looks like any shop page with a banner on top.

We clicked "Continue without accepting"

The first screen of the banner had a refuse button, worded "Continue without accepting" ("Continuer sans accepter" on the French site). We clicked it.

The refusal was recorded properly. The consent tool now showed no partner authorized, with advertising and audience measurement both refused. On that side, the setup worked.

Then we looked at the cookies. All six were still there. Not one had been deleted after the refusal. We reloaded the page: six. We went to another page of the site: still six.

What left the page tells a more mixed story. After the refusal, Pinterest, TikTok and Microsoft Ads received nothing more. Meta, though, still received a "PageView" event, the signal that a page has been viewed, together with its visitor identifier. And Microsoft Clarity kept sending data about the visit.

On screen, all is well. The banner has gone, the choice appears to be respected, the shop carries on as normal. You would have to look at what the browser is doing behind the page to notice that the visitor's "no" stopped part of the traffic and erased nothing that was already stored.

We do not know why this shop behaves this way, and we will not guess how its trackers were installed. We describe what the browser did.

Not an isolated case

Between October 19 and 22, 2026, we visited 22 online shops of French consumer brands, in fashion, food and well-being. On 15 of them, advertising cookies were set as soon as the page loaded, without a single click on the banner. All 15 had a consent banner from a tool on the market. Meta's trackers were there before any choice on 13 of those sites, Pinterest's on 7.

On 9 of the 15 we clicked the refuse button, as on the clothing shop. None of the 9 deleted its tracker cookies. One removed some of them just after the click; they were back after a reload.

On 7 of those 9, we could measure what left the page after the refusal. All 7 kept sending data to at least one recipient, ad network or analytics tool, most often Microsoft Clarity (6 sites) and Meta (5). One site still sent data, after the refusal, to all nine destinations we had seen on it before: Amazon Ads, Google Ads, Google Analytics, Meta, Microsoft Clarity, Pinterest, Reddit, Snapchat and TikTok. On the remaining 2, the measurement did not work: nothing was visible even before the refusal on one, and the reload failed on the other.

Four different consent tools appeared on these 15 sites, and the same tool also shows up on sites that set nothing before the visitor chooses. The tool is not at fault. Its configuration is.

These figures have limits. The shops were not chosen by random sampling, so the sample is not representative. The visits date from October 2026, and a site may have changed since. We only clicked refuse on the first screen of the banner, without going through "Customize". And we describe what the browser does, without giving a legal assessment of each case.

Five banners with no button to refuse

That leaves 6 of the 15 sites. One is a second address of a brand we had already tested. On the other 5, the first screen of the banner offered no way to refuse: only "Accept", "Customize" or "OK". To say no, the visitor has to go further. On one of the five, no banner was visible at all when we checked.

That is why our refusal test covers 9 sites, not 15.

You can check this one yourself, on your own site, with no tool at all. Open the site, look at the first screen of the banner, and see whether one of its buttons lets you refuse.

Nobody went to look

We do not believe these shops set out to get around the rules. They installed a banner, the visible part of the job, and the banner gave everyone the feeling that the job was done.

What is missing is simpler than bad faith. Nobody took the time to check whether the cookies were set before the visitor's choice or after it, or whether they went away after a refusal. That is our reading of what we saw, not a proven fact for every site.

It is easy to see how it happens. Everything that goes wrong here happens behind the banner. A check done by eye passes every time: the banner appears, the button closes it, the page works. Nobody opens the list of cookies, and nobody watches what leaves the page. A test that only looks at the screen cannot fail.

Qaviar records the cookies set before the visitor makes any choice, ad network by ad network. That is how we saw these fifteen sites. It does what people tend to put off: testing even what does not show on screen.

Ask for the same visit on your site

Ask your agency, or your team, to repeat our visit on your site in a fresh browser: arrive without clicking, refuse, reload, go to another page. At each step, have them show you which cookies are present and what is sent to the ad networks. And today, open your site in a private window and check that the first screen of the banner has a button to refuse.