Cookies before consent: the banner is decoration on most Baltic sites

A cookie banner asks the visitor a question. The Baltic Web Audit, our near-census of the web in Latvia, Estonia and Lithuania in July and August 2026, checked whether sites wait for the answer before setting cookies. Most do not, and the sites that installed a tool for exactly that job do worst of all.

In short

Nine in ten Baltic sites that installed a cookie consent tool still set cookies before the visitor answers: 90% in Latvia, 91% in Estonia and 89% in Lithuania. Across all sites the share is 76% in Latvia, 71% in Lithuania and 65% in Estonia. The law asks for consent before any cookie a site does not strictly need, and analytics and advertising cookies are not strictly needed. A banner shows the question; whether the answer is respected depends on whether the site’s scripts were ever connected to it. You can check your own site in two minutes with a private browser window, and the fix is usually configuration rather than a new tool.

What the audit found

The audit’s browser loaded each homepage the way a visitor’s browser does and gave no consent, so every cookie it recorded was set before any choice was made. On that measure, the report’s privacy chapter finds cookies set before consent on 76% of Latvian sites, 71% of Lithuanian and 65% of Estonian. In the report’s words, “consent itself is mostly decorative”.

The sharper finding is inside that number. The audit detected a consent management tool, software whose entire purpose is to hold cookies back until a visitor chooses, on at least 2,886 Latvian sites, 5,932 Estonian and 7,844 Lithuanian. Of those, 2,594 in Latvia, 5,403 in Estonia and 7,007 in Lithuania still set cookies before any consent was given. That is 90%, 91% and 89%. Having the tool installed did not go with waiting for the answer: in all three countries, sites with one set cookies before consent more often than the average site did.

The tools behind the banners are the same across the region. CookieYes was detected on 1,399 Latvian, 3,772 Estonian and 4,126 Lithuanian sites, Complianz on 472, 1,024 and 1,401, and Cookiebot on 533, 629 and 1,384, with OneTrust, Usercentrics, Osano and iubenda behind them. None of this says any of these tools is broken. Each of them can block cookies before consent. The numbers say that on most sites, nobody finished setting them up.

What the rule actually asks

The EU rule on cookies is Article 5(3) of the ePrivacy Directive, the subject of the European Data Protection Board’s Guidelines 2/2023. Each member state writes it into its own law. In Latvia it is Article 7.1 of the Information Society Services Law. Its first paragraph allows a site to store information on a visitor’s device, or read what is stored there, only once the visitor has consented after receiving clear and comprehensive information about the purpose. Its second paragraph makes the exception: no consent is needed where the storage is necessary to carry the communication, or for the provider to deliver a service the visitor asked for.

That exception matters for reading the audit fairly. A cookie that keeps a shopping cart or a login working can fall under it and be set before consent. The audit counted cookies; it did not sort each one into necessary and optional. So 76% is not 76% of sites breaking the law. What the rule does settle is the common case: analytics and advertising cookies are not needed to deliver the page the visitor asked for, so they wait for the answer. And among sites that set cookies before consent, the median number set was four: in the report’s words, “not one stray session cookie, a handful”.

Why an installed banner does not block cookies by itself

A consent tool is a gate, and a gate only holds back what passes through it. The tool can hold a script back only if it recognises that script or has been told about it. A Google Analytics snippet pasted into the theme header, a pixel added through another plugin’s settings, or a tag manager container that was never connected to the banner will usually run on page load, whatever the visitor clicks a second later.

The tools document this themselves. CookieYes’s documentation describes automatic blocking of third-party scripts such as Google Analytics and the Facebook Pixel until the visitor consents, and next to it an option to specify third-party scripts to block by hand. Complianz’s help centre has an entry for owners who think their scripts are not being blocked properly, and says most integrations can be created in its script center. Both are the same admission: installing the tool is the first step, not the whole job.

Google tags have their own switch. Google’s consent mode documentation, last updated 30 July 2026, describes two ways to connect them to a banner. In basic mode, tag loading is “blocked until user interaction with a consent banner”, and “no data is sent before a user consents”. In advanced mode, tags load with consent set to denied and send measurements without cookies until the visitor accepts. Either works. A site whose Google tags use neither, and are not held back by the consent tool, loads them before the question has been answered.

What you can check yourself, and what needs a developer

Four steps need no developer:

• Look at what a stranger gets. Open your homepage in a private window in Chrome and do not touch the banner. Open DevTools (F12 on Windows, Option+Command+I on a Mac) and go to Application, then Storage, then Cookies, as Chrome’s own documentation describes, and select your site. Everything in that list was set before you answered.
• Read the names. A cookie called _ga, or one starting _ga_, is Google Analytics; Google’s cookie table lists _ga as “Used to distinguish users”, with a lifetime of two years. If it is in the list before you clicked anything, your analytics is not waiting for consent.
• Switch on the tool’s blocking. In CookieYes, that is automatic blocking, plus the manual list for anything it missed. In Complianz, it is the script center. If the tool offers a cookie scan, run it afterwards so the banner lists what the site really sets.
• Check again in a new private window. A fix that is not visible in a fresh window has not reached visitors. If your site sits behind a cache, clear it first.

What needs a developer is everything the tool cannot see: scripts written into the theme’s templates, cookies set by the server rather than by a script, a tag manager that has to be rewired to consent mode, and the judgement of which remaining cookies are genuinely necessary. That is the work our cookie consent service is built around, and it starts with the same private window.

Why we can say any of this

The figures come from the Baltic Web Audit, which measured 293,806 of the 306,872 Baltic domains in its frame in one continuous run over July and August 2026, with every request carrying a user agent that named the study. The full method is in the report. The audit recorded which cookies a homepage set before any consent and which consent tool it detected; it did not classify each cookie as necessary or optional, and it names no site beside a weakness. Nothing here is a legal opinion on any particular site. The same report measured our own site with the same method: greenwiremedia.com set zero cookies before consent.

If you have looked at the list in your private window and are not sure what you are seeing, send us the address and we will tell you which cookies should not be there before anyone quotes for anything.