What We Found Checking the Tracking on 85 European Websites

Laptop showing an analytics dashboard

Over the past weeks we checked the public tracking setup of webshops, tourism and service websites, mostly in Slovenia and also in the Netherlands, Ireland, Belgium and the Nordic countries. This article summarises the 85 websites where we found at least one problem, and what those problems were.

How we checked

We looked only at what any visitor can see: the page code, the Google Tag Manager containers loaded on the page, and the requests the browser sends before and after the cookie banner. We did not have access to anyone’s GA4, Google Ads or Meta accounts. Every automated finding was checked by hand before it was counted.

One note on the numbers: they describe the 85 websites with at least one confirmed issue, not all websites we looked at. They show which problems are common when something is wrong, not what share of all websites has them.

Most of the websites run on WooCommerce (43), followed by PrestaShop (13), Magento (12) and OpenCart (8). The rest are custom builds, WordPress without a shop and Webflow. 62 are in Slovenia and 23 in other European countries.

1. Universal Analytics is still there (50 of 85 websites)

Google stopped processing data in standard Universal Analytics in July 2023. On 50 websites we still found active UA code, either in the page itself or as active tags in Google Tag Manager. One container had 45 active UA tags.

On most of these websites GA4 runs next to the old code, so the problem is mainly clutter: extra requests and tags nobody maintains. On 18 websites, however, we found no GA4 at all, only the old UA code. These websites have not collected any analytics data for more than three years, and the owners may not know it.

2. The Meta pixel loads before consent (31 of 85)

On 31 websites the Meta pixel sent data to Meta as soon as the page loaded, before the visitor clicked anything in the cookie banner. The most common reasons were:

  • the pixel was added directly to the theme or by a plugin, outside the consent tool,
  • the cookie banner was only a notice, with no option to decline and no effect on any tag,
  • the pixel in Google Tag Manager fired on all pages without a consent condition.

Consent Mode does not help here. It controls Google tags only; the Meta pixel and other non-Google tags need their own consent logic.

3. Consent Mode v2 missing or set up incorrectly (27 of 85)

The problems we found most often:

  • no consent tool at all, while Google Ads, GA4 or the Meta pixel were active,
  • Google tags without any Consent Mode settings,
  • a default state of “granted”, which tells Google that consent exists before the visitor has chosen,
  • only consent updates and no default state,
  • only the two original parameters, without ad_user_data and ad_personalization.

Since March 2024, missing or incomplete Consent Mode v2 in the EEA limits remarketing and some conversion features in Google Ads, on top of the legal question.

4. Duplicate tags (21 of 85)

On 21 websites the same tag was installed twice, so the same data was sent twice. Typical combinations:

  • GA4 through a WordPress plugin (Site Kit, PixelYourSite or a WooCommerce analytics plugin) and again through Google Tag Manager,
  • the Meta pixel through a shop module and again in Google Tag Manager,
  • two Google Tag Manager containers on the same page, both sending the same GA4 property,
  • one Google Ads tag loaded three times.

Duplicates inflate page views and, worse, can double purchases or leads. Ad platforms then optimise on numbers that are too high.

Most websites had more than one problem

On 44 of the 85 websites we recorded two different problems. The most common pair was a Meta pixel firing before consent together with old Universal Analytics code (17 websites). Both usually point to the same cause: tags were added over the years by different people, and nobody has reviewed the whole setup since.

What you can check yourself in ten minutes

  1. Open your website in a private window and open the browser’s developer tools on the Network tab.
  2. Before clicking the cookie banner, filter for facebook.com/tr, google-analytics.com and googleadservices. Anything that appears here was sent before consent.
  3. Click “Reject” and reload. The same filters should stay empty, apart from cookieless Google requests if you use Consent Mode in advanced mode.
  4. Search the page source for UA-. If you find an ID like UA-12345678-1, old code is still there.
  5. Count how many times gtm.js and G- IDs appear. More than one GTM container, or the same GA4 ID loaded from two places, needs a closer look.

If you would rather have someone go through the whole setup, including GTM, GA4, ad platforms and consent, a tracking audit does exactly that and gives you a list of what to fix.