Can a cookie be set before consent?
Only if they are strictly necessary: for a shopping basket, a login or the visitor’s own choice. Everything else, such as Hotjar, the Meta pixel or TikTok, only after your visitor has said ‘yes’. So a cookie banner alone is not enough: the trackers also have to wait until a choice has been made.
- Meta pixel loads before consentArt. 5(3) ePrivacy Directive
Art. 5(3) ePrivacy Directive
Checked at the source on 27 September 2026.
Who it applies to
Everyone with a website, with no lower limit: a sole trader too, and a site without a shop too. It is not only about cookies, but about anything that stores or reads information on the visitor’s device, so local storage and tracking pixels as well.
- Just me
- Applies to youEven if you work alone: the rule has no lower limit.
- 2 to 9
- Applies to youYes. The rule has no lower limit.
- 10 or more
- Applies to youYes. The rule has no lower limit.
What the law asks
Art. 5(3) ePrivacy Directive
Storing information on a visitor’s device, or reading it, is only allowed if they have been given clear and comprehensive information and have given their consent. The only exception is what is strictly necessary for the service the visitor explicitly asks for.
Art. 4(11) GDPR
That consent must be freely given, specific, informed and unambiguous. A pre-ticked box, or scrolling on, is not consent.
Art. 7(3) GDPR
Withdrawing consent must be as easy as giving it. A banner with only an ‘accept’ button, or a reject button three clicks deep, does not take that into account.
National law
Every EU country has written this rule into its own law: the Netherlands in article 11.7a of the Telecommunications Act, Germany in § 25 TDDDG, France in article 82 of the loi Informatique et Libertés. Some countries, such as the Netherlands and France, allow analytics with little impact on privacy without consent, under strict conditions. An analytics package in its default settings rarely meets them.
Check it yourself, in five minutes
- Open your site in a private window, so your own earlier choice does not count.
- Click nothing yet. Open your browser’s developer tools (F12), the Application or Storage tab, and look at which cookies are already there.
- Look for names you do not need yourself: _ga and _gid (Google Analytics), _fbp (Meta), _hjSession (Hotjar), _ttp (TikTok). If they are there before your choice, that is the finding.
- Check that the banner has a button to refuse, as clear as the button to accept.
- Click refuse, reload the page and look again: the tracking cookies should still be gone.
What our scan sees
- Which cookies were there before your visitor chose anything, and which service they come from.
- Which trackers already send requests before that choice, even if they store nothing.
- What is in local storage and session storage.
- Whether there is a consent banner, and whether it has a button to refuse.
What our scan does not see
- Whether a cookie is really strictly necessary: that depends on what it is for.
- Whether your analytics are set up in a way that qualifies for an exception.
- What happens after a visitor clicks accept: we click nothing.
- Whether your cookie policy is complete and correct.
Who enforces it
The data protection authority in your country, and in some countries also the consumer or telecoms regulator: in the Netherlands the ACM and the Dutch Data Protection Authority, in Germany the data protection authorities of the Länder, in France the CNIL. The Dutch authority checks cookie banners with software, and the European Data Protection Supervisor publishes its own inspection tool.
Questions
Is a cookie banner enough?
No. The banner asks for consent; the trackers also have to wait for it. If Hotjar already loads while the banner is still open, the banner does not help.
Can Google Analytics run without consent?
Only where your country allows an exception for analytics with little impact on privacy, and only if it is set up to meet it. That takes more than the default settings; have it checked by whoever installed it. We report it when it loads before consent, and say that the exception may apply.
Does this apply without an online shop?
Yes. The rule covers every website that stores or reads something on a visitor’s device, including a brochure site or a blog.
Read it yourself
- Directive 2002/58/EC, article 5(3) (opens in a new tab)
The ePrivacy Directive, on which every national cookie rule rests.
- Regulation (EU) 2016/679, the GDPR (opens in a new tab)
What consent is (article 4(11)) and how it is withdrawn (article 7).
See where your site stands
The free scan measures this and the four other rules in one go, from a European address, without clicking anything.