What the browser loads before anyone clicks “Accept”

For each site a second, fresh browser context is opened: no cookie, no storage, no history. The context used for the accessibility scan itself is unsuitable, because it has already collected cookies after the first page. In that fresh context the home page is loaded exactly once. All outgoing requests and all cookies set afterwards are recorded. What is measured is therefore the state before any consent.

Nothing is clicked. Neither “Accept” nor “Reject” — either would be a declaration of intent in someone else’s name, and we do not presume to make one for anybody. That costs us information: we do not know what happens after a click. But it makes the measurement clean, because the state before consent is exactly the one § 25 addresses.

The run takes between 3.5 and 5.2 seconds per site and runs in parallel with the accessibility scan; the total duration of a scan hardly changes as a result.

Instead of “breach” there are five levels. Finding means substantiated. Indication means ambiguous. Observation objects to nothing. Nothing noted means nothing was found. Not testable means the basis was missing. Every doubtful case is downgraded, not upgraded. And nowhere does it say “compliant”: a clean bill of health would be just as much a legal verdict about someone else’s business as an accusation.

During the test run we found and eliminated three false positives of our own: Cloudflare’s bot-detection cookie __cf_bm was counted as an advertising cookie; our own legal notice was flagged as a reference to the discontinued dispute resolution platform, although it explains that the platform was shut down; and an empty basket showing “0.00 €” on an information page was flagged as an offer without a VAT statement. We say so because a measurement without known sources of error is not a measurement but an assertion.

On an outdoor retailer’s site, the measurement recorded on the first load of the home page, in a fresh browser, without any interaction: 17 calls to services with a recognisable measurement or advertising purpose and 5 cookies set with a known measurement or advertising purpose. A consent banner was visible at the time.

The services contacted, with the number of calls: Google Ads (16), Google DoubleClick (16), Criteo (14), a real-time-bidding ad network (7), a DoubleClick synchronisation endpoint (6, expressly an endpoint for data transfer), a second RTB ad network (6), Microsoft Advertising (6) and a content recommendation network (6). Added to that were calls classified as ambiguous, to a tag manager and to a trust seal.

The cookies set included test_cookie (doubleclick.net), _fbp (Meta pixel), MUID (bing.com) and two Criteo cookies. In total, after that single load, 36 cookies sat in the browser — 4 of them in a known technical function, 27 with no purpose we could determine.

What we do not conclude from this. We do not say that this site breaches § 25 TDDDG. Whether an individual instance of storage is “strictly necessary” within the meaning of subsection 2 depends on a purpose only the operator knows. What we say is: this is the state a visitor encounters before deciding anything. That finding is verifiable — anyone can reproduce it in two minutes.

The tag manager fires independently of the banner. The most common case: the consent tool is installed and works, but a single tag in the container is triggered on “all pages” instead of on the consent event. The banner appears, the tag runs anyway. From the outside the two are indistinguishable.

Third-party components bring their own networks. A trust seal, a chat widget, a map embed, a video player: each often loads further hosts that do not appear in your own consent tool at all, because they only join at runtime.

Server-side integrations bypass the consent layer. What runs through your own server is not seen by the browser as a third party — but the storage in the terminal device still takes place, and that is what § 25 addresses.

And pre-connections count. preconnect and dns-prefetch hints to ad networks establish the connection before the actual call has been decided. The intention is speed; what gets measured is a call.

Because an online shop owes considerably more than accessibility — and because every competitor in this field tests accessibility only. Legal notice (§ 5 German Digital Services Act), privacy notice (Article 13 GDPR), consent (§ 25 TDDDG), price indications (§§ 3, 4 and 6 of the Price Indication Ordinance), withdrawal instructions (§ 312d German Civil Code in conjunction with Article 246a EGBGB): five sets of rules that apply to the same page as EN 301 549.

With us that part runs additively in the same pass. The accessibility result is untouched by it — same rule sets, same numbers — and if the compliance check fails, the scan still completes.

Deliberately not tested, by contrast: the ordering process and the button labelling under § 312j German Civil Code (that would require filling the basket), the substantive correctness of legal texts, the dispute-resolution notice under §§ 36 and 37 VSBG (freely worded and not reliably distinguishable from a passing mention), product-specific labelling duties, and the design of the consent banner in detail. A “Reject” that is harder to find than an “Accept” is something we do not measure — that would be an assessment, not a measurement.