Almost every consent banner is answered too late.

the finding

Having a banner barely changes what happens before you answer it.

Of 5,294 sites measured, 92% contacted at least one outside company inside the two-second window. That much is unsurprising. The surprise is that installing a consent tool made almost no difference to it: of the 2,033 sites where we detected one, 1,945 had already contacted a third party.

The fifteen widest gaps

Ranked by companies contacted before the banner could be answered.

Being on this table is not an accusation. Read what could make this fine before drawing a conclusion.

by consent platform

No consent platform stopped it on more than 8% of its own sites.

Grouped by the consent tool we detected. The question each row answers is: of the sites running this platform, how many had already contacted an outside company before that platform’s banner could have been answered? Denominators are shown because they differ by orders of magnitude, and a 100% on a handful of sites is not the same claim as 95% on 853.

This is not a claim that these platforms are broken. A consent tool governs what fires after a choice; it cannot retroactively govern what the page already loaded before it appeared. That is exactly the gap, and it is the site’s to close, not the vendor’s.

before you draw a conclusion

Every company, platform and country, measured separately.

The index above is the whole corpus at once. These break it apart: one page per company seen on 50 or more sites, per platform, per consent tool and per top-level domain, each carrying only what was measured for it.

• Third-party companies — 88 seen on 50+ sites
• Platforms and frameworks — 13 groups
• Consent platforms — 9 measured
• By top-level domain — 9 domains

Four things that can make early contact perfectly correct.

We are not saying any of this is unlawful, and the word does not appear anywhere in the data. You get the timestamps. The conclusion is yours.

method

How this was measured, and what was thrown away.

Sites came from the Tranco top-1M, visited in rank order. 10,491 were attempted and 5,197 were excluded — mostly infrastructure domains that serve no homepage (gtld-servers.net, gstatic.com), plus timeouts, certificate errors and non-HTML responses. Every exclusion and its reason is in the raw data.

Each site got one cold load in headless Chrome with an empty cookie jar, so no consent choice was ever remembered: this is the first visit, every time. No banner was clicked. Measurement is MurmStack’s own collector — the same code the extension runs — so if the index and the extension ever disagreed, the extension would be wrong.

Domains are merged to their parent company, and the site’s own sibling domains are excluded, so a publisher serving assets from a second domain it owns is not counted as contacting an outside company. Two figures are deliberately absent: bytes transferred, because browsers hide transfer size for most cross-origin requests, and per-company blocking time, because the browser exposes only a page-wide figure that cannot honestly be divided up.

0% of the sites measured (0) contacted nobody outside themselves at all. The most-contacted company across the whole set was Google, present on 3,207 of 5,294 sites.

Measured 5 August 2026 · Download the raw data (JSON, 5,294 sites) · CC BY 4.0, so quote it freely with a link.