The most common GDPR violations on websites, and how to fix them

Ask ten website owners what a GDPR violation looks like and most will describe something dramatic: a data breach, a hacked database, customer records for sale. The violations we actually measure, every day and at scale, are quieter than that. They happen in the first seconds of an ordinary page load, before the visitor has touched the cookie banner, and most site owners have no idea they are there.

This guide ranks the violations we find most often, using our own data: the most recent scan of each of the 200,678 websites in our database, counted in August 2026. No industry surveys, no estimates. For each one you will find what the behaviour is, why the rules treat it as a problem, and how to fix it, which in most cases is an afternoon of configuration rather than a legal project.

Where these numbers come from

Every figure below is the share of websites whose most recent scan showed the behaviour. The scanner visits each site the way a first-time visitor would, does not touch the consent banner, and records every network request, script and cookie that appears before any consent is given. What it reports is measurement: what the website did, at that moment, observed directly.

One honest note on scope. Our database is not a random sample of the whole internet: it leans towards European websites, popular websites, and sites people chose to scan. So read each number as "measured across the 200,678 sites in our data", not as a statistic about every website in the world. The counts are published alongside the percentages so every claim shows exactly what it rests on.

The eight violations, ranked by how often we measure them

• External fonts loaded before consent: 106,375 sites, 53%
• Analytics running before consent: 94,636 sites, 47%
• Advertising trackers loaded before consent: 67,267 sites, 34%
• Tracking cookies set before consent: 50,108 sites, 25%
• Fake consent signals: 7,584 sites, 3.8%
• Session recording running before consent: 5,007 sites, 2.5%
• Google Consent Mode v2 leaking data: 2,640 sites, 1.3%
• Browser fingerprinting: 544 sites, 0.3%

1. External fonts loaded before consent (53% of sites)

The most common finding in our data is also the least deliberate. When a page loads fonts from an external service such as Google Fonts, the visitor's browser contacts that service directly, handing over their IP address and browser details before any consent question has been asked. German courts have ruled that this is a transfer of personal data requiring a lawful basis, and other EU authorities have taken the same line.

The fix is the simplest on this list: download the font files and serve them from your own domain. Most themes and site builders support self-hosted fonts, the visual result is identical, and pages usually load faster too. An hour of work removes the most common violation in our data.

2. Analytics running before consent (47% of sites)

Nearly half the sites we measure load an analytics tool, most often Google Analytics, before the visitor has answered the banner. Analytics feels harmless to site owners because the data is "just statistics", but the tool sets identifiers and records behaviour, and under the EU ePrivacy rules that requires consent first in most member states.

The fix is configuration: set your tag manager or consent tool so the analytics tag waits for consent instead of firing on page load. A small number of privacy-focused analytics tools can be configured to run without consent in some countries; if you use one, check the vendor's consent-exemption guidance for your country rather than assuming.

3. Advertising trackers loaded before consent (34% of sites)

A third of measured sites load advertising trackers, such as the Meta Pixel or Google Ads tags, before consent. These do more than count visits: they link the visitor to advertising profiles that follow them across the web, which is exactly the kind of processing the consent requirement exists for.

The fix mirrors analytics: gate every marketing tag behind consent in your tag manager, then hunt for strays. Old campaign pixels are the classic offender; they outlive the campaign, keep firing for years, and nobody remembers adding them. If you no longer use the platform, delete the tag entirely.

4. Tracking cookies set before consent (25% of sites)

One site in four sets at least one identified tracking cookie before the visitor has agreed to anything. Mostly these are written by the scripts in the two sections above, so fixing those fixes this too. The catch worth knowing: third-party scripts often write cookies under your own domain name, so a cookie that looks first-party can still belong to an advertising platform. Check what actually lands in the browser rather than judging by the cookie's domain.

5. Fake consent signals (3.8% of sites)

Around one site in twenty-six sends tracking platforms a pre-programmed "consent granted" signal before the visitor has been shown any real choice. The receiving platform sees what looks like valid consent and starts full tracking immediately, while the banner is still innocently asking its question. Regulators across the EU have acted on this pattern, and we treat it as one of the most serious findings a scan can return, because it defeats the entire consent mechanism while looking correct from the outside.

The fix: find where the signal is hardcoded, usually a consent default in a tag manager template or a theme snippet copied from a tutorial, and remove it. Then verify from the network tab, not the consent tool's dashboard, because the dashboard reports intent, not behaviour.

6. Session recording running before consent (2.5% of sites)

Session recording tools rebuild a copy of the visit: mouse movements, scrolling, clicks and keystrokes, which can include personal data typed into forms. Our count here is deliberately strict: it includes only sites where the scan captured the recorder actually running before consent, not merely a matching script name. If your site uses one of these tools, gate it behind consent and switch on the vendor's input masking so form contents are never captured.

7. Google Consent Mode v2 leaking data (1.3% of sites)

Consent Mode is Google's mechanism for telling its tags whether consent exists, and installed correctly it is genuinely useful. Installed backwards, it tells Google consent exists at a moment when it demonstrably does not: the default is set to "granted", or Google cookies appear despite a "denied" signal. Set every Consent Mode default to denied and re-test; our cookie banner guide covers the mechanism in detail.

8. Browser fingerprinting (0.3% of sites)

The rarest finding on the list and the hardest to defend. Fingerprinting builds an identifier from device characteristics, screen size, installed fonts, graphics behaviour, so the visitor can be recognised without any cookie to delete. When used for tracking, it needs the same consent as any other tracking, and because a fingerprint cannot be cleared the way cookies can, the practical fix is usually to remove the script rather than gate it.

A sensible fixing order

If your scan shows several of these, work in effort-to-impact order:

• Self-host your fonts. About an hour, and it removes the most common finding outright.
• Configure your tag manager so analytics and marketing tags wait for consent. This clears findings 2, 3 and most of 4 in one pass.
• Test rejection. Click reject on your own banner and watch the network tab; if requests keep flowing, the gating is not real yet.
• Check your consent defaults. No hardcoded "granted" signals, Consent Mode defaults set to denied.
• Delete what you no longer use, then re-scan. The score moving is your confirmation that each fix took.

Common questions

This guide and any scan result are factual measurements and general information, not legal advice. For questions about your specific obligations, a data-protection professional is the right person to ask.