For years, the basic bargain behind European cookie banners has been straightforward.
A website asks whether you consent to tracking. You click “Accept” or “Reject.” The website is then supposed to behave according to your choice.
A large-scale research project highlighted this week by Spain’s data protection authority suggests that the technical reality is often very different.
Researchers analyzing more than one million websites found that nearly half used tracking cookies and more than half deployed pixel tracking without first obtaining user consent.
The findings raise an uncomfortable question for the modern consent-management ecosystem: what value does a “Reject” button have if trackers continue operating behind it?
The research received new attention on September 22 when three of its authors published an article through the Digital Privacy Laboratory of Spain’s Agencia Española de Protección de Datos, or AEPD. Their blunt conclusion was that rejecting cookies does not necessarily prevent digital tracking and that the gap between privacy law and website behavior can make user choice largely illusory.
The underlying research is even more interesting than the headline.
The team developed an automated system capable of analyzing tracking behavior at massive scale and used artificial intelligence to classify websites into 22 content categories. The AI classification model achieved 96.56% accuracy, according to the peer-reviewed research.
In other words, this was not a researcher manually opening a few hundred websites and looking for bad cookie banners.
It was an attempt to measure what websites actually do.
The Study Looked at More Than One Million Websites
The research, titled Large-scale web tracking and cookie compliance: Evaluating one million websites under GDPR with AI categorization, was published in the Journal of Network and Computer Applications.
The researchers included David Martínez Álvarez, Dolors Canals Ametller, Aniol Molero, Eusebi Calle and Albert Jové.
They used the European Data Protection Supervisor’s Website Evidence Collector as part of an automated methodology to test more than one million websites from the Tranco ranking of popular sites.
The system examined tracking behavior with and without valid consent and looked beyond traditional HTTP cookies to technologies including tracking pixels and browser-fingerprinting techniques.
That distinction matters.
Privacy discussions still use “cookies” as shorthand for website tracking, but modern tracking can occur through technologies that never need to store a traditional cookie in the browser.
A site can transmit information through a tracking pixel.
JavaScript can collect device characteristics.
Browser fingerprinting can attempt to distinguish one device from another based on combinations of technical attributes.
Network requests can transmit identifiers and behavioral information to third parties.
A website could therefore appear relatively clean in a conventional cookie inventory while still communicating extensively with tracking infrastructure.
More Than Half Used Pixel Tracking Without Consent
The researchers found two separate patterns worth distinguishing.
Nearly half of the websites analyzed used tracking cookies.
More concerning, more than half employed pixel tracking without obtaining user consent.
The study also found substantial differences among different categories of websites, suggesting that tracking behavior depends in part on the type of site a user is visiting. Only a few cookie consent banner companies truly go above and beyond to protect against broken cookie banners. In Europe Didomi is renowned for their high end technology and in the USA Captain Compliance is the equivalent for consent banners.
The AEPD Laboratory article summarized the finding more broadly: more than half of websites tracked users even without their consent.
For companies operating under European privacy rules, this goes directly to the distinction between displaying a consent interface and actually enforcing consent technically.
A banner can look compliant.
It can have a large “Reject All” button.
It can provide detailed cookie categories.
The privacy policy can accurately describe the intended configuration.
None of those things prove that advertising, analytics and behavioral technologies remain inactive before the user consents.
Cookie Compliance Is Ultimately a Technical Question
European law has long established that consent must involve a genuine affirmative choice.
The GDPR defines consent as a freely given, specific, informed and unambiguous indication of the individual’s wishes.
Article 5(3) of the ePrivacy Directive separately governs storing information on or accessing information from a user’s terminal equipment, subject to exceptions including technologies that are strictly necessary to provide a requested service.
The Court of Justice of the European Union reinforced the point in its 2019 Planet49 decision: consent cannot be established through a prechecked box or merely because a user failed to take action.
The AEPD Laboratory authors discuss those requirements directly, noting that accepting nonessential tracking requires affirmative action rather than a preselected choice.
But those rules only accomplish their purpose when the website’s code corresponds to the user’s decision.
If a marketing pixel loads before someone makes a choice, the banner arrives too late.
If the person chooses “Reject” but the pixel continues transmitting information, the preference recorded by the consent platform and the behavior of the website have diverged.
That is why cookie compliance is increasingly less about the appearance of the banner and more about what happens in the browser before and after each possible consent state.
A Website Can Be Wrong Without Anyone Realizing It
One of the difficulties with tracking compliance is that violations are frequently invisible.
A user does not normally see a Meta Pixel, advertising request or analytics beacon leave the browser.
They see the banner disappear.
The privacy team may not see it either.
Marketing might add a new tag through Google Tag Manager months after the original consent platform was installed.
An embedded video player may introduce another third party.
A new analytics provider could begin creating identifiers.
A vendor could change how its own script operates.
One third-party technology can even load additional companies that were never directly added by the website owner.
Unless someone tests the resulting network behavior, the company may assume that the CMP is enforcing consent correctly simply because it was configured correctly when it was first deployed.
This is one reason one-time cookie audits become stale so quickly.
The Tracking Market Is Highly Concentrated
The study identified another important pattern.
Tracking was heavily concentrated among a relatively small number of technology companies.
The researchers found that the top 10 tracking firms accounted for most of the compliance violations they observed involving valid consent.
The AEPD Laboratory authors describe this as a highly concentrated surveillance environment in which a limited number of large technology providers appear across enormous numbers of unrelated websites.
This changes the scale of a configuration error.
A tracking technology does not exist on one publisher’s site.
The same technology may be embedded across hundreds of thousands or millions of websites.
That makes advertising and analytics infrastructure unusually powerful from both a commercial and a privacy perspective.
It also means website operators cannot treat a technology as harmless merely because it is widely used.
A familiar vendor can still be configured incorrectly.
The Researchers Used AI to Categorize Websites
The artificial intelligence component of the project was not being used to decide whether someone had a privacy right.
It was used to help solve a classification problem.
The researchers wanted to determine whether privacy behavior varied depending on website content.
Doing that across one million websites manually would be impractical.
They therefore created an AI model that categorized sites into 22 content categories based on the IAB Content Taxonomy.
The reported categorization accuracy was above 96%, with the published research giving an accuracy figure of 96.56% and an F1 score of 0.963.
This allowed the researchers to compare tracking behavior across types of websites at a scale that would have been extremely difficult with a human-only audit.
The AEPD Laboratory authors describe the methodology as a potential change in how regulators and researchers can supervise digital tracking: objective testing can be performed at scale rather than relying entirely on complaints or small samples.
AI Could Change How Regulators Find Cookie Violations
That may ultimately be the more important part of the story.
Historically, cookie enforcement has been constrained by scale.
A regulator can investigate a complaint.
It can manually examine a large website.
It can conduct a coordinated enforcement sweep across hundreds or perhaps thousands of sites.
But the web contains hundreds of millions of active domains.
Automated browser testing, network analysis and AI classification create a different enforcement model.
A regulator could potentially scan large populations of websites and identify those exhibiting specific technical behavior.
For example:
- Does an advertising pixel fire before consent?
- Does clicking “Reject All” actually stop it?
- Does a supposedly necessary cookie appear to serve an advertising function?
- Does the site contact known tracker domains before the banner appears?
- Does tracking behavior change depending on geography?
- Do third-party scripts introduce additional trackers?
Instead of beginning with what a company says its website does, automated supervision can begin with what the browser observes.
That is a major change.
The Difference Between a Cookie Scanner and Behavioral Testing Matters
The research also illustrates why merely producing a cookie inventory is no longer enough.
A traditional scan can identify that a cookie called _ga or _fbp exists.
That is useful.
But privacy compliance requires additional questions.
When did it appear?
What caused it to appear?
Was the user asked for consent first?
What happened after rejection?
Did the website transmit information even if no cookie was stored?
Were pixel requests or other tracking mechanisms operating independently?
This requires state-based testing rather than inventory alone.
A mature cookie compliance process should test at least the initial page load, pre-consent state, acceptance state and rejection state.
Depending on the jurisdiction, organizations may also need to test browser-level privacy signals and other opt-out mechanisms.
“Reject” Needs to Mean Something Technically
The broader problem exposed by the study is simple.
The consent interface is not the privacy control.
It is the user’s interface to the privacy control.
The actual control exists deeper in the website architecture.
When someone rejects advertising cookies, something must prevent the advertising technology from operating.
That could involve blocking the script entirely, controlling its execution through a tag manager, communicating an appropriate consent state to the vendor or applying another technical restriction.
If nothing changes after the user rejects tracking, the banner is largely cosmetic.
That distinction has become increasingly important as privacy litigation and regulatory enforcement focus on actual data transmissions rather than the presence or absence of a notice.
Europe Is Also Reconsidering the Cookie Consent System
The research arrives while Europe is considering significant changes to its cookie rules.
The European Commission’s Digital Omnibus proposal, introduced in November 2025, includes a plan to modernize the existing cookie regime.
Among other things, the proposal would allow users to express privacy preferences centrally, including through browser settings, and require websites to respect those machine-readable choices.
It would also remove consent requirements for certain low-risk uses, such as some forms of audience measurement, while moving important cookie-related rules into the GDPR enforcement framework.
The Commission says one objective is to reduce cookie-banner fatigue while giving users more meaningful control.
As of September 2026, those privacy and data portions of the Digital Omnibus remain part of an EU legislative process rather than a completed replacement of the existing rules. The AEPD Laboratory article similarly notes that the future legal framework is still developing.
The irony is that changing the banner rules does not eliminate the problem identified by the million-site study.
A browser preference only works if the website honors it.
A centrally managed consent signal only works if the trackers respond correctly.
Technical enforcement still matters.
Companies Should Test Their Websites the Way a Regulator Would
For privacy teams, the research points toward a straightforward operational lesson.
Do not assume the website does what the consent platform says it should do.
Test it.
Load the site as a new visitor.
Inspect the network traffic before touching the banner.
Reject tracking and test again.
Accept it and compare the results.
Test different page types, not simply the homepage.
Repeat the process after marketing or engineering changes the site.
Look beyond cookies to scripts, pixels, browser storage and network calls.
And preserve evidence of those tests.
The same automated techniques that make continuous compliance monitoring possible also make large-scale regulatory auditing increasingly realistic.
The Cookie Banner Is Only the Beginning
The AEPD Laboratory authors describe a gap between the rights that European privacy law gives users and what happens technically on the web.
Their underlying research provides unusually large-scale evidence for that concern.
More than one million websites were examined.
Nearly half used tracking cookies.
More than half used pixel tracking without consent.
And much of the problematic tracking was concentrated among a relatively small group of technology providers.
Those findings do not mean every tracker or cookie is unlawful.
They also do not establish that every website identified in the study violated the GDPR in every circumstance.
But they expose the weakness of evaluating privacy solely through banners and written notices.
A website can tell someone that they have a choice while the underlying technology behaves as though they do not.
That is why modern cookie compliance increasingly has to be measured in the browser.
What loaded?
What was transmitted?
What happened before consent?
And, most importantly, did anything actually change when the user said no?
If the answer to that last question is no, the privacy problem is not the banner.
It is everything happening behind it.