RegSentry Newsroom · Press Release
61% of small-business websites fired at least one tracker before the visitor consented. Among those running a recognized consent-management platform, 74% did.
A majority of scanned small-business sites contacted at least one third-party tracking server before the visitor was offered a consent choice.
Installing a consent-management platform did not correspond to fewer pre-consent trackers. Sites with one detected fired at a higher rate than sites with none.
Affected sites were rarely firing a single stray tag. The average carried more than two distinct pre-consent findings.
A substantial minority of affected sites were running three or more pre-consent trackers.
Advertising and analytics tags, not exotic scripts, accounted for the most common pre-consent findings.
Most findings were classified high severity, meaning the tracker transmitted identifiers rather than merely loading a script.
The result that stands out is not the headline rate. It is that buying a consent-management platform, the standard remedy a business is sold when it starts worrying about this, did not correspond to a cleaner result. Sites where our crawler detected a recognized platform fired pre-consent trackers more often than sites with nothing installed at all.
The likeliest explanation is not that the platforms fail. It is that a business large enough to buy one is also a business running more marketing tags, more tag-manager triggers and more third-party embeds, and those get added outside the consent tool. A banner that displays a choice and a banner that enforces one look identical to a visitor. The difference only appears in network traffic, which is the one place almost nobody looks.
That is why the finding is presented as a correlation rather than a verdict on any vendor. RegSentry is deliberately not publishing per-vendor rates from this corpus: several vendor cohorts number in the dozens, and a tag firing early is usually a configuration made by the site owner rather than a defect in the product they bought.
The practical implication for an owner is narrow and checkable. Having a consent tool installed is not evidence that consent is being enforced. The test is whether trackers wait for the banner's answer, and that can be verified in a private browsing window in about a minute, or automatically.
“Almost everyone we scan who has a problem already bought something to solve it. The tool is installed, the banner appears, and the pixels fire anyway because they were added somewhere the tool never sees.” John Arndt, Founder, Soxoa
Check your own site: see whether anything fires before your banner is answered.
Real browser scan, no signup to run it. You see a summary of the findings; the full report with every tracker unlocks with your email.
Figures come from RegSentry's own headless-browser scans of 3,891 business websites completed between March 14, 2026 and August 22, 2026; a further 207 crawls failed and are excluded. Each scan loads the site without interacting with any consent interface and records third-party requests that fire before a consent signal. A "recognized consent-management platform" means our crawler identified a known vendor script on the page; sites where none was identified may still run one we do not recognize, which would understate the with-platform cohort. The corpus is drawn from RegSentry's prospecting pipeline rather than a random sample of business websites, so rates describe this corpus and are not national estimates. The comparison between cohorts is observational and uncontrolled: sites that install a consent platform likely differ from sites that do not in size, traffic and marketing-tag volume, and that is a plausible explanation for the gap. A tracker firing before consent is a technical finding and is not by itself proof of a legal violation. Statutory-exposure figures elsewhere on this site apply the CIPA section 637.2 ceiling to self-reported traffic and are directional maxima, not predictions. None of this is legal advice.
RegSentry scans business websites with a real headless browser to find third-party trackers that fire before a visitor consents, then re-scans on a schedule so new marketing tags do not reintroduce the problem silently. It is built for business owners monitoring their own sites. RegSentry is not a law firm and does not provide legal advice.