Does your shop load
before anyone agrees?
A cookie banner does not answer the question. What matters is timing: what happens between opening the page and the first click.
Timing is the point
Almost every check looks at whether there is a banner. The obligation depends not on the banner but on what already loaded before anyone answered it.
| What | EU reference |
|---|---|
| Before the first click In principle only what is technically necessary to run the page may load. An analytics script that fires on page load has not waited for consent. | Art. 5(3) Directive 2002/58/EC |
| After a click on Reject The more interesting half: some banners store the choice but keep loading. You can only tell by really clicking Reject and looking again. | Art. 5(3) Directive 2002/58/EC |
| On subpages, not just the home page Scripts are often added only on product or category pages. A home page test never sees them. | Art. 5(3) Directive 2002/58/EC |
| Through your own host name With CNAME cloaking, a subdomain of your own domain points to a third party via DNS. In the list of hosts it looks like your own site. | Art. 5(3) Directive 2002/58/EC, Art. 5 GDPR |
What a scan shows
It opens several pages without accepting the banner, notes every host and when it was first called, then clicks Reject and looks again. It never gets around bot protection: blocked means blocked, and the report says so. For every service, the report says how to load it only after consent in your banner tool. Guides per banner tool: Cookiebot, Usercentrics, Borlabs Cookie.
As of 9 October 2026. We name the reference so you can read it yourself; this is not legal advice.