---
title: "Cookie consent on the Polish web: who draws the banner"
description: "One Polish homepage in four runs a cookie consent tool we can name, most of them not a consent platform. Sites with one pass CLS on phones as often as the rest."
canonical_url: "https://www.outofplace.space/blog/cookie-consent-polish-web"
language: "en"
last_updated: "2026-09-25"
alternates:
  pl: "https://www.outofplace.space/pl/blog/baner-cookies-na-polskich-stronach.md"
---

# Cookie consent on the Polish web: who draws the banner

> One Polish homepage in four runs a cookie consent tool we can name, most of them not a consent platform. Sites with one pass CLS on phones as often as the rest.

Published 2026-09-25 · Category: Performance · Tags: Cookie consent, Core Web Vitals, Third-party scripts, Poland

About one Polish homepage in four runs a cookie consent tool we can recognise in its HTML, and most of those tools are not the consent platforms people compare online. We read the homepages of the 7,785 .pl sites in [the Tranco list of popular sites](https://tranco-list.eu/list/Y8YYG/full) that answered with HTML, the same sample as [our study of third-party scripts on Polish sites](https://www.outofplace.space/blog/third-party-scripts-polish-web), and named the tool behind each cookie consent banner. 27% have one we could name. Hosted platforms such as Cookiebot and OneTrust account for only 40% of them; the rest are WordPress plugins, banners built into shop platforms and open-source scripts.

Then we looked the sites up in the [Chrome UX Report](https://developer.chrome.com/docs/crux), Google's record of how fast sites are for real Chrome users. Banners are a known source of layout shift, yet sites with a consent tool pass [Cumulative Layout Shift](https://web.dev/articles/cls) (CLS) on phones as often as sites without one. The gaps we do find are small and follow the kind of tool: sites with a hosted consent platform or a CMS plugin reach a good [Largest Contentful Paint](https://web.dev/articles/lcp) (LCP) a little less often, and responsiveness moves with the platform more than with the banner.

- 27% of .pl homepages run a consent tool we can name. Cookiebot is the most common single tool, on 3.5%.
- Shops lead: 47% of them have a consent tool, against 20% of other sites, mostly because IdoSell, Shoper and Shopify build one in.
- Of the homepages with a Google tag, 29% set Google Consent Mode defaults in their HTML, and of the homepages that set defaults, 97% already use v2.
- Sites with a consent tool pass CLS on phones as often as sites without one. Those with a hosted consent platform or a CMS plugin pass LCP slightly less often; responsiveness follows the platform more than the banner.

## What draws a cookie consent banner

A cookie consent banner asks the visitor which cookies and scripts the site may use, remembers the answer and tells the site's other code what it is allowed to do. Something has to draw it, and on the Polish web that something comes in four kinds:

- **Hosted consent management platforms** (CMPs) such as Cookiebot, OneTrust, CookieYes or Didomi, loaded from the vendor's servers and set up in the vendor's dashboard.
- **CMS plugins**: WordPress plugins such as Complianz, CookieYes for WordPress or Cookie Notice, and their Drupal and Joomla equivalents, served from the site's own server.
- **Shop platforms and modules**: the banner built into IdoSell, Shoper and Shopify, and the cookie modules PrestaShop shops install.
- **Open-source scripts** a site hosts itself, such as CookieConsent by Orest Bida or Klaro.

**Hosted consent platforms lead, but plugins and shop banners come close** (Share of .pl homepages running a consent tool of each kind · n = 7,785 · 95% intervals)

| Item | Value | 95% interval | n |
| --- | --- | --- | --- |
| Consent platforms (hosted) | 11% | 10%–12% | 7,785 |
| Shop platforms and modules | 7.9% | 7.4%–8.6% | 7,785 |
| CMS plugins | 7.6% | 7%–8.2% | 7,785 |
| Open-source scripts | 1.1% | 0.9%–1.4% | 7,785 |

Source: Outofplace census, 24 Sept 2026; Tranco list Y8YYG. Chart: https://www.outofplace.space/data/blog/cookie-consent-polish-web/charts/en/chart-hosted-consent-platforms-lead-but-plugins-and-shop-banners-come.png Data: https://www.outofplace.space/data/blog/cookie-consent-polish-web/2026-09-24/families.csv

Hosted platforms are the largest group, on 11% of homepages. Together, the tools that come with the site's own software (plugins, shop banners and self-hosted scripts) are on more. Few run more than one: 0.9% of the homepages with a tool run two different tools.

These shares are floors. A banner the site built itself has no signature we can match, and a consent platform loaded through Google Tag Manager arrives after the HTML we read. We count only what the homepage's HTML loads or draws; a mention of a vendor or a link to its site doesn't count.

## Which cookie consent tools Polish sites use

No single tool dominates. Cookiebot is on the most homepages. Behind it, close together within the margin of error, come PrestaShop's cookie modules, the banners built into IdoSell and Shoper and the most common WordPress plugins, Complianz and CookieYes for WordPress, with OneTrust just behind.

**Cookiebot is the most common consent tool, on one Polish homepage in thirty** (Share of .pl homepages running each consent tool, tools on at least 30 homepages · hosted consent platforms highlighted · n = 7,785 · 95% intervals)

| Item | Value | 95% interval | n |
| --- | --- | --- | --- |
| Cookiebot | 3.5% | 3.1%–3.9% | 7,785 |
| PrestaShop modules | 2.7% | 2.4%–3.1% | 7,785 |
| IdoSell (built in) | 2.5% | 2.2%–2.9% | 7,785 |
| Other tools | 2.4% | 2.1%–2.7% | 7,785 |
| Shoper (built in) | 2% | 1.8%–2.4% | 7,785 |
| Complianz | 2% | 1.7%–2.3% | 7,785 |
| CookieYes for WordPress | 1.6% | 1.3%–1.9% | 7,785 |
| CookieYes | 1.4% | 1.2%–1.7% | 7,785 |
| OneTrust | 1.4% | 1.2%–1.7% | 7,785 |
| Cookie Notice & Compliance | 1.3% | 1.1%–1.6% | 7,785 |
| Other WordPress plugins | 1.3% | 1.1%–1.6% | 7,785 |
| Didomi | 0.8% | 0.7%–1.1% | 7,785 |
| Google Privacy & messaging | 0.7% | 0.5%–0.9% | 7,785 |
| Shopify (built in) | 0.6% | 0.5%–0.9% | 7,785 |
| GDPR Cookie Compliance | 0.6% | 0.5%–0.8% | 7,785 |
| CookieConsent (Orest Bida) | 0.6% | 0.5%–0.8% | 7,785 |
| Cookie-Script | 0.5% | 0.4%–0.7% | 7,785 |
| Usercentrics | 0.5% | 0.3%–0.6% | 7,785 |
| Pandectes (Shopify app) | 0.4% | 0.3%–0.6% | 7,785 |
| consentmanager | 0.4% | 0.3%–0.6% | 7,785 |
| EU Cookie Compliance (Drupal) | 0.4% | 0.3%–0.6% | 7,785 |

Source: Outofplace census, 24 Sept 2026. Chart: https://www.outofplace.space/data/blog/cookie-consent-polish-web/charts/en/chart-cookiebot-is-the-most-common-consent-tool-on-one-polish-homepage.png Data: https://www.outofplace.space/data/blog/cookie-consent-polish-web/2026-09-24/tools.csv

CookieYes shows up twice because it comes in two forms: a hosted platform and a WordPress plugin, which can run on its own or connect to CookieYes's servers. We count a plugin connected to the servers as the hosted platform. Counted once either way, CookieYes is on 3% of homepages, level with Cookiebot within the margin of error.

## Shops show a consent banner more often than other sites

Online shops run a consent tool we can name more than twice as often as other sites. The difference is almost entirely the platform: 28% of shops use a banner built into their platform or a store module, while among other sites plugins and hosted platforms carry almost all of it.

**Shops get their consent banner from the platform; other sites from a plugin or a hosted service** (Share of .pl homepages running a consent tool of each kind, shops against other sites · shops n = 2,172, other sites n = 5,613)

| Item | Shops | Other sites |
| --- | --- | --- |
| Consent platforms (hosted) | 12% | 11% |
| CMS plugins | 6% | 8.2% |
| Shop platforms and modules | 28% | 0.1% |
| Open-source scripts | 1.5% | 1% |

Source: Outofplace census, 24 Sept 2026. Chart: https://www.outofplace.space/data/blog/cookie-consent-polish-web/charts/en/chart-shops-get-their-consent-banner-from-the-platform-other-sites-fro.png Data: https://www.outofplace.space/data/blog/cookie-consent-polish-web/2026-09-24/sites.csv

By platform, the shops on IdoSell, Shopify and Shoper lead, since those platforms draw a banner themselves once the shop turns it on. PrestaShop and WooCommerce shops land in the middle, with a module, a plugin or a hosted platform. Custom-built, Magento and headless shops and those on AtomStore have the lowest shares, but partly because of our blind spot: we have no rules for a banner built into their themes or platforms, so it is invisible to us.

**Nine IdoSell shops in ten show a consent banner we can name** (Share of shops with a consent tool we can name, by shop platform, platforms with at least 30 shops · platforms with a built-in banner highlighted · 95% intervals)

| Item | Value | 95% interval | n |
| --- | --- | --- | --- |
| IdoSell | 92% | 88%–95% | 217 |
| Shopify | 87% | 81%–92% | 127 |
| Shoper | 73% | 67%–78% | 227 |
| WooCommerce | 49% | 44%–54% | 368 |
| PrestaShop | 44% | 40%–48% | 557 |
| Custom-built | 21% | 16%–27% | 224 |
| Magento | 17% | 13%–23% | 202 |
| Headless | 11% | 5%–24% | 44 |
| AtomStore | 8.3% | 2.9%–22% | 36 |

Source: Outofplace census, 24 Sept 2026. Chart: https://www.outofplace.space/data/blog/cookie-consent-polish-web/charts/en/chart-nine-idosell-shops-in-ten-show-a-consent-banner-we-can-name.png Data: https://www.outofplace.space/data/blog/cookie-consent-polish-web/2026-09-24/platforms.csv

## Google Consent Mode v2 on Polish sites

Google's tags read the visitor's choice through Consent Mode. The page sets defaults, usually "denied", with a `gtag('consent', 'default', …)` call, and the banner updates them once the visitor chooses. [Google's Consent Mode documentation](https://developers.google.com/tag-platform/security/guides/consent) says to call the default command "before any commands that send measurement data", and version 2 added two parameters, `ad_user_data` and `ad_personalization`, which Google says Consent Mode users need to send for traffic from the European Economic Area (read on 25 September 2026).

66% of Polish homepages load a Google tag (Tag Manager, the Google tag, Analytics or Ads). Of those, 29% set Consent Mode defaults in the HTML. Where they do, the setup is current: of the homepages that set defaults, 97% name both v2 parameters, and 91% deny ad storage until the visitor agrees.

**Shop platform banners and open-source scripts set Consent Mode defaults most often** (Share of .pl homepages with a Google tag that set Consent Mode defaults in their HTML, by the consent tool detected · 95% intervals)

| Item | Value | 95% interval | n |
| --- | --- | --- | --- |
| Shop platforms and modules | 64% | 60%–68% | 540 |
| Open-source scripts | 56% | 44%–66% | 72 |
| Consent platforms (hosted) | 37% | 33%–41% | 669 |
| No tool detected | 22% | 21%–24% | 3,402 |
| CMS plugins | 20% | 17%–24% | 447 |

Source: Outofplace census, 24 Sept 2026. Chart: https://www.outofplace.space/data/blog/cookie-consent-polish-web/charts/en/chart-shop-platform-banners-and-open-source-scripts-set-consent-mode-d.png Data: https://www.outofplace.space/data/blog/cookie-consent-polish-web/2026-09-24/families.csv

Defaults written into the HTML are only one way to set them. A consent platform's template in Google Tag Manager sets them inside the container, where we can't see them, so a homepage without defaults in the HTML may still have them. The reverse shows how much the HTML hides: 53% of the homepages that set defaults have no consent tool we can name, and 59% of those load Google Tag Manager, which can load the banner after the page arrives.

## Do cookie banners hurt Core Web Vitals?

A banner is drawn over or into the page, on every first visit, on the phone's small screen. Google's [guide to cookie notices](https://web.dev/articles/cookie-notice-best-practices) calls them "a very common source of layout shifts", and notes that on phones a banner can even become the page's largest element, the one LCP times. We matched the homepages with the Chrome UX Report, which has data for 79% of them.

### Layout shift: no difference

Sites with a consent tool pass CLS on phones as often as sites without one: 84% against 83%. Only open-source scripts, a small group, pass more often; the other kinds sit within each other's margins of error. A banner laid over the page shifts nothing, and CrUX judges a site by its 75th percentile across every page, so a shift on first visits alone may not move it.

**Sites with a consent tool pass CLS on phones as often as sites without one** (Share of sites whose p75 CLS on phones (the whole site, as CrUX measures it) is 0.1 or less, by the consent tool on the homepage · dot: share, line: 95% interval · CrUX, 28 days to 23 Sept 2026)

| Item | Value | Range | n |
| --- | --- | --- | --- |
| No tool detected | 83% | 82%–84% | 4,221 |
| Consent platforms (hosted) | 83% | 80%–85% | 798 |
| CMS plugins | 86% | 82%–89% | 445 |
| Shop platforms and modules | 82% | 78%–85% | 593 |
| Open-source scripts | 92% | 84%–96% | 78 |

Source: Chrome UX Report (Google); Outofplace census, 24 Sept 2026. Chart: https://www.outofplace.space/data/blog/cookie-consent-polish-web/charts/en/chart-sites-with-a-consent-tool-pass-cls-on-phones-as-often-as-sites-w.png Data: https://www.outofplace.space/data/blog/cookie-consent-polish-web/2026-09-24/families.csv

### Loading: hosted platforms go with a slightly slower LCP

Sites with a hosted consent platform reach a good LCP less often: 78% against 84% of sites without a tool. One possible reason: a hosted banner needs its script from another server before it can draw, and on a phone the banner may be the largest thing on the first screen. But sites with a CMS plugin, served from the site's own server, show a similar gap, so it may just as well come from the kind of site that picks these tools and the rest of its code. Sites with a shop platform's banner pass about as often as sites without a tool.

**Sites with a hosted consent platform pass LCP on phones a little less often** (Share of sites whose p75 LCP on phones (the whole site, as CrUX measures it) is 2.5 s or less, by the consent tool on the homepage · dot: share, line: 95% interval · CrUX, 28 days to 23 Sept 2026)

| Item | Value | Range | n |
| --- | --- | --- | --- |
| No tool detected | 84% | 82%–85% | 4,211 |
| Consent platforms (hosted) | 78% | 75%–81% | 797 |
| CMS plugins | 77% | 72%–80% | 445 |
| Shop platforms and modules | 87% | 84%–89% | 593 |
| Open-source scripts | 90% | 81%–95% | 78 |

Source: Chrome UX Report (Google); Outofplace census, 24 Sept 2026. Chart: https://www.outofplace.space/data/blog/cookie-consent-polish-web/charts/en/chart-sites-with-a-hosted-consent-platform-pass-lcp-on-phones-a-little.png Data: https://www.outofplace.space/data/blog/cookie-consent-polish-web/2026-09-24/families.csv

### Responsiveness follows the platform, not the banner

INP, the time a page takes to respond to a tap, also differs between some tools and sites without one. Sites with a CMS plugin pass INP more often than sites without a tool. Among the shop banners, the gap runs with the platform: Shoper shops pass far less often, and our [study of Polish online shops](https://www.outofplace.space/blog/core-web-vitals-polish-ecommerce) found Shoper shops slower to respond with no banner in the picture. Sites with OneTrust or Cookie-Script pass less often too; CrUX measures whole sites, so these gaps may come from the kind of site that picks a tool rather than from its banner. Of the 18 tools with enough data, 11 make no difference to INP within the margin of error.

**Most consent tools make no difference to INP within the margin of error** (Difference in the share of sites passing INP on phones (p75 of 200 ms or less), sites with each tool minus sites with no tool detected · tools on at least 30 sites with CrUX data · line: 95% interval · CrUX, 28 days to 23 Sept 2026)

| Item | Value | Range | n |
| --- | --- | --- | --- |
| Shoper (built in) | -31% | -39%–-23% | 156 |
| OneTrust | -18% | -28%–-9% | 106 |
| Cookie-Script | -17% | -33%–-2.7% | 36 |
| Google Privacy & messaging | -8.9% | -23%–2.8% | 48 |
| consentmanager | -3.7% | -21%–8.9% | 32 |
| Pandectes (Shopify app) | -2.9% | -20%–9.4% | 33 |
| Cookiebot | 2.7% | -3%–7.5% | 253 |
| Shopify (built in) | 2.7% | -11%–12% | 46 |
| PrestaShop modules | 3.3% | -3.2%–8.8% | 185 |
| Other WordPress plugins | 6.2% | -4.8%–14% | 66 |
| CookieYes for WordPress | 6.6% | -2.6%–13% | 90 |
| CookieYes | 7.9% | -1.1%–14% | 91 |
| GDPR Cookie Compliance | 9% | -5.4%–17% | 39 |
| IdoSell (built in) | 9.8% | 4%–14% | 198 |
| CookieConsent (Orest Bida) | 10% | -2.9%–18% | 43 |
| Cookie Notice & Compliance | 12% | 2.2%–18% | 66 |
| Complianz | 13% | 5.8%–18% | 121 |
| Didomi | 20% | 11%–23% | 63 |

Source: Chrome UX Report (Google); Outofplace census, 24 Sept 2026. Chart: https://www.outofplace.space/data/blog/cookie-consent-polish-web/charts/en/chart-most-consent-tools-make-no-difference-to-inp-within-the-margin-o.png Data: https://www.outofplace.space/data/blog/cookie-consent-polish-web/2026-09-24/tools.csv

A site that picks a given consent tool also differs in size, platform and build. None of these differences shows that the banner caused it, and the field data covers every page of a site over 28 days, not just the homepage.

## How to set up cookie consent without slowing the site

A banner inserted above the content after the page has drawn pushes everything down, which is layout shift. Put it at the bottom of the screen over the content, or in a modal, as Google's guide to cookie notices recommends, and give it a fixed size.

Load a hosted platform's script with `async` and keep it small. Where your tool offers a self-hosted or a plugin version, serving it from your own domain saves the connection to another server.

If you use Google's tags, set the defaults before any tag sends data, and name the two v2 parameters:

```html title="head, before the Google tag"

  window.dataLayer = window.dataLayer || [];
  function gtag() { dataLayer.push(arguments); }
  gtag("consent", "default", {
    ad_storage: "denied",
    ad_user_data: "denied",
    ad_personalization: "denied",
    analytics_storage: "denied",
  });

```

If a consent platform's Tag Manager template sets the defaults already, don't add a second call in the page.

Open the site in a private window and type `dataLayer` in the developer console: the `consent`, `default` entry should come before any `config` or `event`. Accept the banner and check that a `consent`, `update` entry follows.

Look up your site in [PageSpeed Insights](https://pagespeed.web.dev/): if it has enough Chrome traffic, the top of the report shows the same CrUX data as this study. A change shows in full after four weeks, since CrUX covers a rolling 28 days.

## How we measured

The homepages come from our census of 24 September 2026 by `OutofplaceResearchBot` (see [what our crawler fetches and how to block it](https://www.outofplace.space/bot)), which reads robots.txt first and fetches only the homepage: 8,023 of the 9,208 .pl domains in the Tranco list answered with HTML, and 7,785 distinct sites remained after merging domains that redirect to the same address.

We read each homepage's HTML without running it and matched it against rules for 36 consent tools, built from every script host, plugin folder, store module and inline marker naming cookies or consent on at least two homepages. A rule matches what loads or draws a tool: a script from the vendor's host, a plugin's folder in an asset address, markup only that tool writes, or its setup call. When two rules describe one banner, one wins: a WordPress plugin connected to its vendor's servers counts as the hosted platform, and a shop that added a consent platform counts as that platform, not the built-in banner. A Shoper shop counts only when its banner is switched on. Consent Mode defaults count when the HTML contains a `consent`, `default` call.

The speed data is Google's. On 25 September 2026 we asked the [Chrome UX Report API](https://developer.chrome.com/docs/crux/api) for every homepage's address on phones, and tried the www or bare-domain twin when an address had no record. CrUX aggregates the page loads of Chrome users on Android and desktop who share usage statistics, across every page of a site, over 28 days. A site passes CLS at a 75th percentile of 0.1 or less, LCP at 2.5 s and INP at 200 ms. The comparison (each kind of tool, and each tool on at least 30 sites with CrUX data, against sites with no tool detected) was fixed before we read the field data; shops are identified by the classifier from our ecommerce study.

For the 10 most common tools we drew 4 detections each, in a fixed random order, and read the HTML behind every one. 39 of the 40 were right. The one miss was a Cookiebot tag whose type attribute has a typographic quote, so the browser never runs it. Two rules failed an earlier round of the same check and were narrowed: every Shoper shop ships the banner's template, switched on or not, and some sites use the id of a popular WordPress plugin for a banner of their own.

We saw the homepage only, as its HTML arrived, and ran none of it. A banner loaded through a tag manager and a banner the site built itself are invisible, so every share here is a floor, and shop platforms with a built-in banner we recognise come out ahead of those without one. We didn't check whether a banner offers a real choice, blocks cookies before consent or meets the law. A homepage longer than 1 MiB was cut there (331 of them). The field data covers every page of a site, not just the homepage, and only sites with enough Chrome traffic: 89% of the sites with a tool are in CrUX, against 75% of those without, so the sites without a tool are on average smaller.

## Further reading

- [Best practices for cookie notices](https://web.dev/articles/cookie-notice-best-practices): Google's guide to cookie banners that don't hurt LCP, CLS or INP, from the Chrome team.

- [Set up consent mode on websites](https://developers.google.com/tag-platform/security/guides/consent): Google's documentation for Consent Mode: the four parameters, the default and update commands and their order.

- [Cumulative Layout Shift (CLS)](https://web.dev/articles/cls): What CLS measures and the thresholds Google uses.

- [Third-party scripts on the Polish web: who loads what](https://www.outofplace.space/blog/third-party-scripts-polish-web): Our study of the same homepages: which third-party scripts Polish sites load, and how they go with INP.