Only 17% of Product Hunt launches ask when they set tracking cookies

Over 30 days in July and August 2026 I scanned 458 products that launched on Product Hunt, loading every site the way a person sitting somewhere in the EU would. 242 of them had put a tracking cookie on my machine before I clicked anything. They stored it first and asked later (45), or never asked at all (197). Another 50 had a consent mechanism on the page and had stored nothing yet: they actually asked first.

So 292 products stored tracking cookies, and 50 of them asked first. That is only 17%.

Of the 242, 197 had no banner and no consent platform anywhere on the page. Nothing to answer, nothing to dismiss. That's a violation of Article 5(3) of the ePrivacy Directive which puts consent before storage 1.

This is post one of four built on this Product Hunt launch scan. This one is about the cookies. Post two is about what the privacy policies leave out, post three about the vendors those policies never mention, and post four about what separates the startups that get this right.

How I scanned Product Hunt for launches

I took the top of Product Hunt's daily leaderboard for 30 consecutive days, 12 July to 10 August 2026. That gave 510 launches, and I followed each one through Product Hunt's outbound redirect to the product's own website. 22 links did not answer. 22 pointed at GitHub or an app store rather than the founder's own site. After correcting for companies that launched twice, 458 distinct domains went into my analysis. Median upvotes were 136, with a range of 4 to 999.

Every site was loaded in a headless Chrome with a clean cookie jar, an en-GB locale and a Europe/Copenhagen timezone, so what I recorded is what a visitor in the EEA would get. I read the cookie jar after one page load and before any interaction, recorded every third-party host the page contacted, then found and read the site's legal pages and checked all of this for self-consistency.

Every check was deterministic. No language model made any judgement in the dataset, and every finding carries the evidence string that produced it. I counted a cookie as non-essential (recall these are the types sites have to ask consent for) when it matched a known analytics, advertising or session-replay vendor: _ga, _fbp, _ttp, _rdt_uuid, and their siblings. Session cookies, CSRF tokens and load-balancer cookies were ignored.

These are machine-checkable observations about public pages: what was stored, and what was on the page at the time. They are not legal verdicts about anyone, and I am not naming the products, because the pattern is the point and the identities add nothing to it.

Breakdown of how sites handled consent

I recorded two things for every product: whether it had stored a cookie needing consent by the time the page finished loading, and whether there was any way to consent at all, meaning a banner or a consent platform anywhere on the page. Wherever I say below that a product stored nothing, it means it stored nothing "non-essential" that would need consent.

The red block and the blue one are the 292 that stored tracking cookies.

197 sites has no consent mechanism, but stored non-essential cookies anyway. No banner, no consent platform, nothing to answer and nothing to dismiss. One of them wrote 10 such cookies on first load across six ad and analytics vendors, which is a whole marketing stack arriving as a default rather than one tag somebody forgot. Another wrote exactly two, both Google Analytics, which is the ordinary case and the one most readers are in. A third wrote 15 across eight vendors while publishing a privacy policy of 3,204 words. That last one is worth sitting with: the effort spent on the document did not travel to the tags, because the two are edited in different places by different people on different days.

45 sites had a consent mechanism, but stored their cookies before collecting an answer. Intent is not in question here. Somebody decided consent mattered, bought or built the thing, and shipped it. The tags were simply never wired behind it, and nothing on the page reports that. One of the 45 stored five cookies before any answer, two of them session replay, which records what the visitor does on the page. Consent under GDPR Article 4(11) needs a statement or a clear affirmative action, and recital 32 is explicit that inactivity is not one 2. A banner nobody has answered yet is inactivity.

50 sites had a consent mechanism, and stored cookies only after consent. Of the 95 sites carrying a consent mechanism, 50 correctly awaited the user's consent before storing their cookies.

In summary, only half of the pages displaying a cookie banner managed their storing of cookies based on my reply, and in total across all of the pages putting non-essential cookies on my computer only 17% asked before doing so.

What non-essential cookies did sites store?

Google Analytics and PostHog are the most used tracking cookies by far. This makes sense, they're startups who want to understand their users so they can grow their product in the right direction. And Posthog is seeing a wild rise in popularity which only makes sense with a landing page that cool.

Are these companies impacted by EU law at all? Most Product Hunt launches are American and sell to Americans, so the fair objection is that they owe nobody a consent banner. For the part of GDPR Article 3(2) most people have in mind, that is correct. Offering services to people in the Union means actually offering them, and somebody in Denmark finding your site organically does not mean you extended the offer. But there's another part which covers monitoring people's behaviour which reached far in terms of monitoring and profiling 2. An advertising pixel built to profile behaviour is one such case, and 56 of the 292 wrote one from Google Ads alone.

Sites marketing in EU ask for consent more frequently. 160 of the 458 sites scanned carried explicit evidence they were marketing in the EU (prices in euro, an EU language option, an EU country named on the page, or an explicit offer to sell worldwide). 116 of them are in the 292 sites that placed non-essential in my browser, and 30 of those asked first, which is 26%. That is still only around a quarter.

What to check on your own landing page

Open your own site in a private browsing window. Open DevTools, go to Application, then Storage, then Cookies, and reload the page. Read what is there before you click anything, including before you dismiss any banner you have.

Anything in that list that is not your session, your CSRF token or your load balancer is inside Article 5(3), and it is there without consent 1. For each one you have two options that both work. Move the tag behind the consent gate, so it fires on accept rather than on page load, which is a change in your tag manager or your script loading rather than a change to your product. Or replace it with an analytics tool that stores nothing, which is what 36 of the products in this scan did.

If you shipped a marketing site in the last year and you have European visitors, that is the check to do. Otherwise you are storing identifiers on people's devices under a rule that puts their agreement first, and your analytics dashboard is the last place that will ever tell you.

The next post is about what those documents say, and how many of them turn out to be US privacy notices missing the parts GDPR added.