Open Orbt
MarketsPublicationsAboutPricing
Open OrbtBook a demo
Expensive to get wrongUnited StatesBeauty & personal care

The cookie is set before the banner is answered

40 of 43 beauty storefronts selling into the United States write at least one cookie that outlives the visit on the first request, before any consent banner can have been answered, and 27 of them do it while running a consent platform. The median storefront sets 7 cookies on that first byte and the longest-lived runs 365 days at the median.

The banner and the behaviour are two different products of the same company, and only one of them is what a regulator or a journalist will measure, so a brand that believes it is compliant because it bought a consent platform is carrying a risk it has not looked at.

Exceptions and limits

  • MechanismMostly one platform, not forty decisions

    27 of the 41 storefronts whose cookie names could be read carry the same four Shopify analytics and marketing cookies on the first byte, out of 25 distinct names across the whole shelf. The behaviour is a platform default that arrives switched on, not 27 separate decisions to track before asking.

    Why the claim above is true. It does not limit it. Confidence 85 of 100, n = 41.

    Wrong if A repeat run finds fewer than 40% of these storefronts carrying at least three of the four named Shopify analytics and marketing cookies, or finds the same behaviour spread evenly across unrelated platforms.

    Set-Cookie names on one unauthenticated homepage GET, matched against the four Shopify analytics and marketing cookies rather than inferred from a count. Names only: this identifies who set a cookie and never what the cookie does, so a functional cart token and an analytics identifier are distinguished here by their published purpose and not by anything measured. It also means the parent claim's cookie count mixes the two, which is stated in the parent's own note and repeated here because the number is the part people quote. Retailers are excluded from both origin groups: OLIVE YOUNG Global, Peach & Lily, Soko Glam, Stylevana. Their catalogues are other companies' product copy, so counting them by the storefront's own origin would put Korean listings inside the US-origin group. Run commerce-20260805140548.

    Cite as omr:us:beauty-storefronts-set-tracking-cookies-before-asking#it-is-one-platform-s-default

86

86 of a possible 90Tier B, systematic first-party observation. Nothing at this tier is allowed past 90, however good it looks.

Verified September 9, 2026Rechecked every 120 days, next by January 7, 2027.

Norm

Held since August 5, 2026What is expected behaviour here. The earliest date we are willing to say this held. It may well have been true before that; we do not backdate a record past the evidence we have read. Supported, version 1.

This entry is wrong if

A repeat run finds fewer than a third of these storefronts setting a cookie that outlives the visit before any consent interaction.

Written before the record was published, not after. If you can show this, send it to hello@tryorbt.com and the correction goes on the record with the entry.

Evidence

  1. Tier Bobserved-webn = 43

    orbt: Market Register commerce collector, run commerce-20260805140548

    Set-Cookie headers on a single unauthenticated homepage GET, parsed per header rather than from the joined string, because an Expires date contains a comma and splitting on it would read nine cookies as one. A cookie counts as outliving the visit only when it carries a positive Max-Age or a future Expires. This is a floor and not a count: it is one page, not a session, so nothing set at add-to-cart is here; it is not a browser, so nothing written by JavaScript after load is here; and the request comes from the United States, so a storefront that suppresses tracking for European visitors and not for anyone else is measured at its permissive setting. Consent platform is a vendor fingerprint in the page source, so a shop running its own banner reads as running none. Retailers are excluded from both origin groups: OLIVE YOUNG Global, Peach & Lily, Soko Glam, Stylevana. Their catalogues are other companies’ product copy, so counting them by the storefront’s own origin would put Korean listings inside the US-origin group. Run commerce-20260805140548.

    Read 2026-08-05 · CC BY · page hash 9a6ccfd5ea85

History

  1. v1created

    Derived from collector run commerce-20260805055659.

  2. v1createdon a caveat

    Derived from collector run commerce-20260805055659.

Append-only. Nothing in this list is edited or removed once written, including the entries that record our own mistakes. Every change to every record is on the corrections page, and the same log is in entries.json under revisions.

  • privacy
  • cookies
  • consent
  • compliance
  • conduct
  • beauty

Cite this entry

“The cookie is set before the banner is answered”, The Orbt Market Index 0.1.0, entry omr:us:beauty-storefronts-set-tracking-cookies-before-asking, retrieved September 9, 2026, https://tryorbt.com/markets/entry/us--beauty-storefronts-set-tracking-cookies-before-asking. Dataset: https://doi.org/10.5281/zenodo.22679129

For a deck, a brief or a chat.

Free to quote, cite and act on. Not to resell or redistribute — the sources ask that of us, and each one’s terms are named. Machine-readable: entries.json carries this record under the id omr:us:beauty-storefronts-set-tracking-cookies-before-asking, with the same evidence and falsifier.

Read next

Also true of the United States

What else we hold on this market, heaviest first.

Everything we hold on United StatesEvery record for this corridor