Cookie consent on the Polish web: who draws the banner
One Polish homepage in four runs a cookie consent tool we can name, most of them not a consent platform. Sites with one pass CLS on phones as often as the rest.
About one Polish homepage in four runs a cookie consent tool we can recognise in its HTML, and most of those tools are not the consent platforms people compare online. We read the homepages of the 7,785 .pl sites in the Tranco list of popular sites (opens in a new tab) that answered with HTML, the same sample as our study of third-party scripts on Polish sites, and named the tool behind each cookie consent banner. 27% have one we could name. Hosted platforms such as Cookiebot and OneTrust account for only 40% of them; the rest are WordPress plugins, banners built into shop platforms and open-source scripts.
Then we looked the sites up in the Chrome UX Report (opens in a new tab), Google's record of how fast sites are for real Chrome users. Banners are a known source of layout shift, yet sites with a consent tool pass Cumulative Layout Shift (opens in a new tab) (CLS) on phones as often as sites without one. The gaps we do find are small and follow the kind of tool: sites with a hosted consent platform or a CMS plugin reach a good Largest Contentful Paint (opens in a new tab) (LCP) a little less often, and responsiveness moves with the platform more than with the banner.
- 7,785
- 27%
- 40%
- 97%
What draws a cookie consent banner
A cookie consent banner asks the visitor which cookies and scripts the site may use, remembers the answer and tells the site's other code what it is allowed to do. Something has to draw it, and on the Polish web that something comes in four kinds:
- Hosted consent management platforms (CMPs) such as Cookiebot, OneTrust, CookieYes or Didomi, loaded from the vendor's servers and set up in the vendor's dashboard.
- CMS plugins: WordPress plugins such as Complianz, CookieYes for WordPress or Cookie Notice, and their Drupal and Joomla equivalents, served from the site's own server.
- Shop platforms and modules: the banner built into IdoSell, Shoper and Shopify, and the cookie modules PrestaShop shops install.
- Open-source scripts a site hosts itself, such as CookieConsent by Orest Bida or Klaro.
Hosted consent platforms lead, but plugins and shop banners come close
Share of .pl homepages running a consent tool of each kind · n = 7,785 · 95% intervals
Show the data
| Item | Value | 95% interval | n |
|---|---|---|---|
| Consent platforms (hosted) | 11% | 10%–12% | 7,785 |
| Shop platforms and modules | 7.9% | 7.4%–8.6% | 7,785 |
| CMS plugins | 7.6% | 7%–8.2% | 7,785 |
| Open-source scripts | 1.1% | 0.9%–1.4% | 7,785 |
The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.
Hosted platforms are the largest group, on 11% of homepages. Together, the tools that come with the site's own software (plugins, shop banners and self-hosted scripts) are on more. Few run more than one: 0.9% of the homepages with a tool run two different tools.
These shares are floors. A banner the site built itself has no signature we can match, and a consent platform loaded through Google Tag Manager arrives after the HTML we read. We count only what the homepage's HTML loads or draws; a mention of a vendor or a link to its site doesn't count.
Which cookie consent tools Polish sites use
No single tool dominates. Cookiebot is on the most homepages. Behind it, close together within the margin of error, come PrestaShop's cookie modules, the banners built into IdoSell and Shoper and the most common WordPress plugins, Complianz and CookieYes for WordPress, with OneTrust just behind.
Cookiebot is the most common consent tool, on one Polish homepage in thirty
Share of .pl homepages running each consent tool, tools on at least 30 homepages · hosted consent platforms highlighted · n = 7,785 · 95% intervals
Show the data
| Item | Value | 95% interval | n |
|---|---|---|---|
| Cookiebot | 3.5% | 3.1%–3.9% | 7,785 |
| PrestaShop modules | 2.7% | 2.4%–3.1% | 7,785 |
| IdoSell (built in) | 2.5% | 2.2%–2.9% | 7,785 |
| Other tools | 2.4% | 2.1%–2.7% | 7,785 |
| Shoper (built in) | 2% | 1.8%–2.4% | 7,785 |
| Complianz | 2% | 1.7%–2.3% | 7,785 |
| CookieYes for WordPress | 1.6% | 1.3%–1.9% | 7,785 |
| CookieYes | 1.4% | 1.2%–1.7% | 7,785 |
| OneTrust | 1.4% | 1.2%–1.7% | 7,785 |
| Cookie Notice & Compliance | 1.3% | 1.1%–1.6% | 7,785 |
| Other WordPress plugins | 1.3% | 1.1%–1.6% | 7,785 |
| Didomi | 0.8% | 0.7%–1.1% | 7,785 |
| Google Privacy & messaging | 0.7% | 0.5%–0.9% | 7,785 |
| Shopify (built in) | 0.6% | 0.5%–0.9% | 7,785 |
| GDPR Cookie Compliance | 0.6% | 0.5%–0.8% | 7,785 |
| CookieConsent (Orest Bida) | 0.6% | 0.5%–0.8% | 7,785 |
| Cookie-Script | 0.5% | 0.4%–0.7% | 7,785 |
| Usercentrics | 0.5% | 0.3%–0.6% | 7,785 |
| Pandectes (Shopify app) | 0.4% | 0.3%–0.6% | 7,785 |
| consentmanager | 0.4% | 0.3%–0.6% | 7,785 |
| EU Cookie Compliance (Drupal) | 0.4% | 0.3%–0.6% | 7,785 |
The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.
CookieYes shows up twice because it comes in two forms: a hosted platform and a WordPress plugin, which can run on its own or connect to CookieYes's servers. We count a plugin connected to the servers as the hosted platform. Counted once either way, CookieYes is on 3% of homepages, level with Cookiebot within the margin of error.
Shops show a consent banner more often than other sites
Online shops run a consent tool we can name more than twice as often as other sites. The difference is almost entirely the platform: 28% of shops use a banner built into their platform or a store module, while among other sites plugins and hosted platforms carry almost all of it.
Shops get their consent banner from the platform; other sites from a plugin or a hosted service
Share of .pl homepages running a consent tool of each kind, shops against other sites · shops n = 2,172, other sites n = 5,613
- Shops
- Other sites
Show the data
| Item | Shops | Other sites |
|---|---|---|
| Consent platforms (hosted) | 12% | 11% |
| CMS plugins | 6% | 8.2% |
| Shop platforms and modules | 28% | 0.1% |
| Open-source scripts | 1.5% | 1% |
The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.
By platform, the shops on IdoSell, Shopify and Shoper lead, since those platforms draw a banner themselves once the shop turns it on. PrestaShop and WooCommerce shops land in the middle, with a module, a plugin or a hosted platform. Custom-built, Magento and headless shops and those on AtomStore have the lowest shares, but partly because of our blind spot: we have no rules for a banner built into their themes or platforms, so it is invisible to us.
Nine IdoSell shops in ten show a consent banner we can name
Share of shops with a consent tool we can name, by shop platform, platforms with at least 30 shops · platforms with a built-in banner highlighted · 95% intervals
Show the data
| Item | Value | 95% interval | n |
|---|---|---|---|
| IdoSell | 92% | 88%–95% | 217 |
| Shopify | 87% | 81%–92% | 127 |
| Shoper | 73% | 67%–78% | 227 |
| WooCommerce | 49% | 44%–54% | 368 |
| PrestaShop | 44% | 40%–48% | 557 |
| Custom-built | 21% | 16%–27% | 224 |
| Magento | 17% | 13%–23% | 202 |
| Headless | 11% | 5%–24% | 44 |
| AtomStore | 8.3% | 2.9%–22% | 36 |
The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.
Google Consent Mode v2 on Polish sites
Google's tags read the visitor's choice through Consent Mode. The page sets defaults, usually "denied", with a gtag('consent', 'default', …) call, and the banner updates them once the visitor chooses. Google's Consent Mode documentation (opens in a new tab) says to call the default command "before any commands that send measurement data", and version 2 added two parameters, ad_user_data and ad_personalization, which Google says Consent Mode users need to send for traffic from the European Economic Area (read on 25 September 2026).
66% of Polish homepages load a Google tag (Tag Manager, the Google tag, Analytics or Ads). Of those, 29% set Consent Mode defaults in the HTML. Where they do, the setup is current: of the homepages that set defaults, 97% name both v2 parameters, and 91% deny ad storage until the visitor agrees.
Shop platform banners and open-source scripts set Consent Mode defaults most often
Share of .pl homepages with a Google tag that set Consent Mode defaults in their HTML, by the consent tool detected · 95% intervals
Show the data
| Item | Value | 95% interval | n |
|---|---|---|---|
| Shop platforms and modules | 64% | 60%–68% | 540 |
| Open-source scripts | 56% | 44%–66% | 72 |
| Consent platforms (hosted) | 37% | 33%–41% | 669 |
| No tool detected | 22% | 21%–24% | 3,402 |
| CMS plugins | 20% | 17%–24% | 447 |
The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.
Defaults written into the HTML are only one way to set them. A consent platform's template in Google Tag Manager sets them inside the container, where we can't see them, so a homepage without defaults in the HTML may still have them. The reverse shows how much the HTML hides: 53% of the homepages that set defaults have no consent tool we can name, and 59% of those load Google Tag Manager, which can load the banner after the page arrives.
Do cookie banners hurt Core Web Vitals?
A banner is drawn over or into the page, on every first visit, on the phone's small screen. Google's guide to cookie notices (opens in a new tab) calls them "a very common source of layout shifts", and notes that on phones a banner can even become the page's largest element, the one LCP times. We matched the homepages with the Chrome UX Report, which has data for 79% of them.
Layout shift: no difference
Sites with a consent tool pass CLS on phones as often as sites without one: 84% against 83%. Only open-source scripts, a small group, pass more often; the other kinds sit within each other's margins of error. A banner laid over the page shifts nothing, and CrUX judges a site by its 75th percentile across every page, so a shift on first visits alone may not move it.
Sites with a consent tool pass CLS on phones as often as sites without one
Share of sites whose p75 CLS on phones (the whole site, as CrUX measures it) is 0.1 or less, by the consent tool on the homepage · dot: share, line: 95% interval · CrUX, 28 days to 23 Sept 2026
Show the data
| Item | Value | Range | n |
|---|---|---|---|
| No tool detected | 83% | 82%–84% | 4,221 |
| Consent platforms (hosted) | 83% | 80%–85% | 798 |
| CMS plugins | 86% | 82%–89% | 445 |
| Shop platforms and modules | 82% | 78%–85% | 593 |
| Open-source scripts | 92% | 84%–96% | 78 |
The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.
Loading: hosted platforms go with a slightly slower LCP
Sites with a hosted consent platform reach a good LCP less often: 78% against 84% of sites without a tool. One possible reason: a hosted banner needs its script from another server before it can draw, and on a phone the banner may be the largest thing on the first screen. But sites with a CMS plugin, served from the site's own server, show a similar gap, so it may just as well come from the kind of site that picks these tools and the rest of its code. Sites with a shop platform's banner pass about as often as sites without a tool.
Sites with a hosted consent platform pass LCP on phones a little less often
Share of sites whose p75 LCP on phones (the whole site, as CrUX measures it) is 2.5 s or less, by the consent tool on the homepage · dot: share, line: 95% interval · CrUX, 28 days to 23 Sept 2026
Show the data
| Item | Value | Range | n |
|---|---|---|---|
| No tool detected | 84% | 82%–85% | 4,211 |
| Consent platforms (hosted) | 78% | 75%–81% | 797 |
| CMS plugins | 77% | 72%–80% | 445 |
| Shop platforms and modules | 87% | 84%–89% | 593 |
| Open-source scripts | 90% | 81%–95% | 78 |
The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.
Responsiveness follows the platform, not the banner
INP, the time a page takes to respond to a tap, also differs between some tools and sites without one. Sites with a CMS plugin pass INP more often than sites without a tool. Among the shop banners, the gap runs with the platform: Shoper shops pass far less often, and our study of Polish online shops found Shoper shops slower to respond with no banner in the picture. Sites with OneTrust or Cookie-Script pass less often too; CrUX measures whole sites, so these gaps may come from the kind of site that picks a tool rather than from its banner. Of the 18 tools with enough data, 11 make no difference to INP within the margin of error.
Most consent tools make no difference to INP within the margin of error
Difference in the share of sites passing INP on phones (p75 of 200 ms or less), sites with each tool minus sites with no tool detected · tools on at least 30 sites with CrUX data · line: 95% interval · CrUX, 28 days to 23 Sept 2026
Show the data
| Item | Value | Range | n |
|---|---|---|---|
| Shoper (built in) | -31% | -39%–-23% | 156 |
| OneTrust | -18% | -28%–-9% | 106 |
| Cookie-Script | -17% | -33%–-2.7% | 36 |
| Google Privacy & messaging | -8.9% | -23%–2.8% | 48 |
| consentmanager | -3.7% | -21%–8.9% | 32 |
| Pandectes (Shopify app) | -2.9% | -20%–9.4% | 33 |
| Cookiebot | 2.7% | -3%–7.5% | 253 |
| Shopify (built in) | 2.7% | -11%–12% | 46 |
| PrestaShop modules | 3.3% | -3.2%–8.8% | 185 |
| Other WordPress plugins | 6.2% | -4.8%–14% | 66 |
| CookieYes for WordPress | 6.6% | -2.6%–13% | 90 |
| CookieYes | 7.9% | -1.1%–14% | 91 |
| GDPR Cookie Compliance | 9% | -5.4%–17% | 39 |
| IdoSell (built in) | 9.8% | 4%–14% | 198 |
| CookieConsent (Orest Bida) | 10% | -2.9%–18% | 43 |
| Cookie Notice & Compliance | 12% | 2.2%–18% | 66 |
| Complianz | 13% | 5.8%–18% | 121 |
| Didomi | 20% | 11%–23% | 63 |
The chart as an image, free to reuse under CC BY 4.0 with credit to Outofplace and a link to this page.
How to set up cookie consent without slowing the site
Reserve the banner's place or lay it over the page
A banner inserted above the content after the page has drawn pushes everything down, which is layout shift. Put it at the bottom of the screen over the content, or in a modal, as Google's guide to cookie notices recommends, and give it a fixed size.
Load the consent script without blocking the page
Load a hosted platform's script with
asyncand keep it small. Where your tool offers a self-hosted or a plugin version, serving it from your own domain saves the connection to another server.Set Consent Mode defaults first, with all four parameters
If you use Google's tags, set the defaults before any tag sends data, and name the two v2 parameters:
head, before the Google tag <script> window.dataLayer = window.dataLayer || []; function gtag() { dataLayer.push(arguments); } gtag("consent", "default", { ad_storage: "denied", ad_user_data: "denied", ad_personalization: "denied", analytics_storage: "denied", }); </script>If a consent platform's Tag Manager template sets the defaults already, don't add a second call in the page.
Check it in the browser
Open the site in a private window and type
dataLayerin the developer console: theconsent,defaultentry should come before anyconfigorevent. Accept the banner and check that aconsent,updateentry follows.Check your field data
Look up your site in PageSpeed Insights (opens in a new tab): if it has enough Chrome traffic, the top of the report shows the same CrUX data as this study. A change shows in full after four weeks, since CrUX covers a rolling 28 days.
| Tool | Family | Homepages | Share |
|---|---|---|---|
| Cookiebot | Consent platforms (hosted) | 272 | 3.5% |
| PrestaShop modules | Shop platforms and modules | 210 | 2.7% |
| IdoSell (built in) | Shop platforms and modules | 198 | 2.5% |
| Shoper (built in) | Shop platforms and modules | 159 | 2% |
| Complianz | CMS plugins | 154 | 2% |
| CookieYes for WordPress | CMS plugins | 124 | 1.6% |
| CookieYes | Consent platforms (hosted) | 112 | 1.4% |
| OneTrust | Consent platforms (hosted) | 109 | 1.4% |
| Cookie Notice & Compliance | CMS plugins | 101 | 1.3% |
| Other WordPress plugins | CMS plugins | 100 | 1.3% |
| Didomi | Consent platforms (hosted) | 65 | 0.8% |
| Google Privacy & messaging | Consent platforms (hosted) | 53 | 0.7% |
| Shopify (built in) | Shop platforms and modules | 50 | 0.6% |
| GDPR Cookie Compliance | CMS plugins | 48 | 0.6% |
| CookieConsent (Orest Bida) | Open-source scripts | 47 | 0.6% |
20 more rows
| Tool | Family | Homepages | Share |
|---|---|---|---|
| Cookie-Script | Consent platforms (hosted) | 38 | 0.5% |
| Usercentrics | Consent platforms (hosted) | 35 | 0.5% |
| Pandectes (Shopify app) | Consent platforms (hosted) | 34 | 0.4% |
| consentmanager | Consent platforms (hosted) | 33 | 0.4% |
| EU Cookie Compliance (Drupal) | CMS plugins | 32 | 0.4% |
| cookieconsent (Osano, open source) | Open-source scripts | 25 | 0.3% |
| optAd360 CMP | Consent platforms (hosted) | 22 | 0.3% |
| Sirdata | Consent platforms (hosted) | 20 | 0.3% |
| CookieFirst | Consent platforms (hosted) | 20 | 0.3% |
| Joomla extensions | CMS plugins | 20 | 0.3% |
| Klaro | Open-source scripts | 17 | 0.2% |
| TermsFeed / FreePrivacyPolicy | Consent platforms (hosted) | 13 | 0.2% |
| InMobi Choice | Consent platforms (hosted) | 10 | 0.1% |
| Consentmo (Shopify app) | Consent platforms (hosted) | 10 | 0.1% |
| Real Cookie Banner | CMS plugins | 10 | 0.1% |
| Cookie Information | Consent platforms (hosted) | 6 | 0.1% |
| WPConsent | CMS plugins | 4 | 0.1% |
| Sourcepoint | Consent platforms (hosted) | 3 | 0% |
| TrustArc | Consent platforms (hosted) | 3 | 0% |
| iubenda | Consent platforms (hosted) | 1 | 0% |
How we measured
How we checked the rules
For the 10 most common tools we drew 4 detections each, in a fixed random order, and read the HTML behind every one. 39 of the 40 were right. The one miss was a Cookiebot tag whose type attribute has a typographic quote, so the browser never runs it. Two rules failed an earlier round of the same check and were narrowed: every Shoper shop ships the banner's template, switched on or not, and some sites use the id of a popular WordPress plugin for a banner of their own.
What this data can't tell you
We saw the homepage only, as its HTML arrived, and ran none of it. A banner loaded through a tag manager and a banner the site built itself are invisible, so every share here is a floor, and shop platforms with a built-in banner we recognise come out ahead of those without one. We didn't check whether a banner offers a real choice, blocks cookies before consent or meets the law. A homepage longer than 1 MiB was cut there (331 of them). The field data covers every page of a site, not just the homepage, and only sites with enough Chrome traffic: 89% of the sites with a tool are in CrUX, against 75% of those without, so the sites without a tool are on average smaller.
What is a consent management platform?
A service that draws the cookie banner, records each visitor's choice and tells the site's other scripts what they may do, served from the vendor's servers: Cookiebot, OneTrust, CookieYes, Didomi and others. On the Polish web they are the minority: 40% of the homepages with a consent tool we could name used one in September 2026; the rest ran a CMS plugin, a banner built into their shop platform or an open-source script.
What is Google Consent Mode v2?
A way for a site to tell Google's tags what the visitor agreed to. The page sets defaults with gtag('consent', 'default', …) before any tag sends data, and the banner updates them after the visitor chooses. Version 2 added two parameters, ad_user_data and ad_personalization, to the older ad_storage and analytics_storage.
Is Consent Mode v2 mandatory?
Google's documentation says that Consent Mode users need to send ad_user_data and ad_personalization in addition to ad_storage and analytics_storage, as part of its EU user consent policy for traffic from the European Economic Area. A site that uses Google's advertising tags for visitors from Poland should therefore send all four.
Does a cookie banner slow down a site?
Not in layout shift, in our data: 84% of Polish sites with a consent tool we could name passed CLS on phones, against 83% of those without one. Sites with a hosted consent platform or a CMS plugin passed LCP a little less often, which may be the banner or the rest of their stack. Google's web.dev guide calls cookie notices "a very common source of layout shifts", so the way a banner is placed matters more than whether there is one.
How do I check Consent Mode v2 on my site?
Open the page in a private window, open the browser's developer console and type dataLayer. A 'consent', 'default' entry should come first, before any 'config' or 'event', and it should name ad_user_data and ad_personalization. After you click the banner, a 'consent', 'update' entry should follow with your choice.