We Scanned 9,916 European Websites. Tracking and Consent Tools Travel Together. - CipherCue

research<br>We Scanned 9,916 European Websites. Tracking and Consent Tools Travel Together.

23 June 2026 &middot; 10 min read<br>&middot; By Chris McCabe

77%<br>of the European sites we observed running Meta Pixel also exposed Google Analytics. The deeper pattern is how analytics, advertising, consent and infrastructure products repeatedly arrive as a bundle.

We fingerprinted the public web stacks of 9,916 European organisations. 6,839 of those returned at least one classified vendor component. What stood out was not the dominance of any single product. It was how predictable the rest of a site's stack becomes once you can see one piece of it.

Of the 239 sites in the sample running Meta's advertising pixel, 184 (77.0%) also exposed Google Analytics. 149 (62.3%) exposed Google Tag Manager. Meta Pixel sites were 2.67 times as likely as the sample baseline to expose Google Tag Manager. The pattern repeats: 246 sites used the Cookiebot consent banner, and 72.4% of those also exposed Google Analytics with 60.2% exposing Google Tag Manager. Two products from different categories, but an almost identical surrounding stack.

The sample is weighted toward Poland, Germany and the United Kingdom, which together account for 60.3% of the analysed entities. The figures below describe what was observed in this sample, not a representative estimate of the European web as a whole. Full per-country breakdown and methodology are at the bottom of the article.

Why lift matters

The most useful question for understanding stack design is conditional: given that a site uses one detected component, how much more likely is another component to appear than its baseline rate across the whole sample?

Three numbers help here:

Support : how often two products appear together. The raw count of co-occurrence.

Conditional rate : the percentage of sites using product X that also use product Y.

Lift : the conditional rate divided by the baseline prevalence of product Y. Under statistical independence, lift equals 1. A lift above 1 means the two products co-occur more often than independence would imply; a lift below 1 means less often.

The lift values matter because they correct for the fact that a very common product will frequently co-occur with anything. Google Analytics appears on 43.5% of sample sites; almost any subset of the sample will show it often.

RelationshipConditional rateTarget baselineLift

Meta Pixel → Google Tag Manager62.3%23.3%2.67×<br>Cookiebot → Google Tag Manager60.2%23.3%2.58×<br>OneTrust → Google Tag Manager48.4%23.3%2.08×<br>Meta Pixel → Google Analytics77.0%43.5%1.77×<br>Cookiebot → Google Analytics72.4%43.5%1.66×<br>Cloudflare → Google Analytics35.9%43.5%0.83×

The 77% headline figure is the most shareable, but the 2.67× relationship between Meta Pixel and Google Tag Manager is statistically more revealing. A Meta Pixel site is more than two and a half times more likely than a random sample site to expose Google Tag Manager. The same is true, almost identically, for sites running Cookiebot. The two products serve completely different purposes, advertising attribution and cookie consent, and yet they sit alongside the same surrounding stack.

The bottom row of the table is the useful counterpoint. Cloudflare + Google Analytics is the eighth most common pair in the sample (510 sites, 7.5%), which makes the relationship look strong on a raw-count chart. The lift of 0.83 says the opposite: Cloudflare sites were slightly less likely than the 43.5% baseline to expose Google Analytics. Cloudflare appears frequently in combination tables because Cloudflare itself is common (20.8% of the sample), not because it positively predicts Google. This is the entire reason lift matters as a measure.

Google sits at the centre of the most common combinations

Three Google products sit in the top ten individual detections: Google Analytics on 43.5% of sample sites, Google Tag Manager on 23.3%, and Google reCAPTCHA on 10.9%. The pull-through into co-occurring combinations dominates the entire pair table.

Two-component combinationSitesShare of sample

Google Analytics + WordPress1,20217.6%<br>Apache + Google Analytics87312.8%<br>Google Analytics + Google Tag Manager85712.5%<br>Google Analytics + Nginx84212.3%<br>Apache + WordPress75711.1%<br>Google Tag Manager + WordPress5978.7%<br>Nginx + WordPress5898.6%<br>Cloudflare + Google Analytics5107.5%<br>Google Analytics + Google reCAPTCHA4486.6%<br>Google reCAPTCHA + WordPress4206.1%

All ten of the most common two-component combinations in the sample include either Google Analytics or WordPress. The most common pair, Google Analytics + WordPress, appears on 1,202 sites: roughly one in six of the entities with any detected component. Google Analytics is the component most frequently present across the sample's largest technology combinations.

The default stack is still surprisingly traditional

Strip down to three-component...