On ten of 12 sites with a cookie banner, the chat widget loaded before the visitor chose
We opened the websites of 25 live chat vendors with a fresh browser and touched nothing. What their own widget loaded, stored and sent before any click, and whether it waited for the cookie banner. Eleven of 19 sent the full page address, query string included.
The muro team
muro.chat
- Published
- Reading time
- 12 min
On this page
A chat widget is a script from another company running on your page. Whatever it stores in the visitor's browser, and whatever it sends home, is your responsibility as the publisher: the French regulator has fined sites for what embedded tools did, not the companies that made the tools. So we asked a simple question. What does a chat widget do before the visitor has clicked anything?
To give every widget its best case, we tested each one on its maker's own website, where the people who built it chose the configuration. 25 vendors, a fresh browser each time, 3 passes on 10 October 2026.
10 of 12
sites with accept and refuse buttons loaded the widget before the visitor chose
11 of 19
widgets sent the full page address, query string included, to the vendor
17 of 17
widgets that loaded on arrival wrote something to the browser before any click
400 days
lifetime of the longest cookie a widget set (LiveChat, Olark and Zoho SalesIQ)
How we tested
- A fresh browser. Google Chrome in headless mode, a new empty profile for every visit, French time zone and an English locale, from a connection in France.
- A marker in the address. Each page was opened with a fake password-reset token and a fake email address in its query string, the kind of thing real sites carry in links from emails. We then searched every widget request, request body and WebSocket message for that marker.
- No clicks. We waited 15 seconds after the page loaded and recorded what the widget had loaded, stored and sent. Then, where there was a consent banner, we clicked "accept" and waited again.
- What counts as the widget. A request belongs to the widget if it goes to the vendor's widget servers, if a widget script started it, or if it comes from inside a widget frame. Everything else on the page, including the site's own analytics, is left out.
Most widgets do not wait for the cookie banner
Twelve of the sites where we saw the widget showed a consent banner with accept and refuse (or manage) buttons. On ten of them the widget loaded, connected and wrote to the browser while the banner was still unanswered.
"Requests" counts the widget requests made before any click (median of 3 passes). Zoho SalesIQ and Chatwoot made a couple of tiny loader requests at most and loaded the chat only after "accept".
Zoho SalesIQ and Chatwoot were the exceptions, and we checked them again: in a separate visit where we clicked "refuse", and in another where we scrolled and moved the mouse without answering the banner, their widget never loaded. That is what waiting for consent looks like.
Whether a widget needs consent at all is a legal question we covered separately: the EU rule and the French regulator's reading of it. In short, storage that is strictly necessary for a service the visitor asked for is exempt, and the CNIL considers a chat identifier exempt when it is written at the moment the visitor opens the chat.
“In order to ensure the technical continuity of the chatbot or to keep a history of the conversation across the different pages of the site on which it is present, a cookie is frequently placed and read on the user's terminal. Such an action is governed by Article 82 of the French Data Protection Act, on which the CNIL has published guidelines and recommendations. Two options are open to the chatbot operator: either the operator wishes to be able to place a cookie before the chatbot is activated. In that case it must obtain the user's prior consent, which must be free, specific, informed and unambiguous; or the cookie is placed only when the user activates the chatbot (for example, by clicking on the conversation window displayed beforehand, or by clicking on a button explicitly triggering the opening of the chatbot). It is then 'strictly necessary for the provision of an online communication service at the user's express request' and therefore does not require the user's consent to be obtained. This exemption can be relied on only if the tracker is used solely to provide the chatbot: any other purpose attached to it will require the user's consent.”
The page address, query string included
Eleven of the 19 widgets sent the full address of the page, marker included, to the vendor before the visitor did anything. The query string is the part after the "?": on real sites it holds password-reset tokens, email addresses from newsletter links, order numbers and campaign tags.
A transmission is not proof of storage: we can see what leaves the browser, not what the vendor keeps. Hosts written vs. or vi-jvs. vary from one visit to the next.
The other eight did not send the marker in anything we could inspect: Help Scout, Gorgias, HelpCrunch, Chatwoot, Lime Connect (Userlike), Chatra, Chaport and muro. We measured each site as its owner had configured it; a widget's settings can change what it sends.
What they store, and for how long
Eight widgets set a cookie before any click, and nine more wrote to localStorage without a cookie, which the same EU rule covers. The longest cookie lifetime we saw was 400 days.
Longest-lived cookie set by the widget
Days until expiry, as set by the widget on the vendor's own site. Before any click unless marked otherwise.
View as table
| Longest-lived cookie set by the widget | Note | |
|---|---|---|
| LiveChat | 400 d | |
| Olark | 400 d | |
| Zoho SalesIQ | 400 d | Set after the click on "accept". |
| Chatwoot | 365 d | Set after the click on "accept". |
| Lime Connect (Userlike) | 365 d | |
| Chatra | 365 d | |
| Chaport | 360 d | |
| Intercom | 270 d | |
| Crisp | 182 d | |
| tawk.to | 180 d |
Source: Cookies matching each vendor's naming pattern, crawl of 10 October 2026. Compiled by muro.
Only cookies and keys that match each widget's own naming pattern are counted (for example intercom-, crisp-client, twk_, __lc_, Chatra., muro_). The site's other trackers are not in this table.
Widgets that bring other companies with them
Three widgets pulled in services from outside the vendor's own infrastructure: HubSpot loaded Google reCAPTCHA, Olark loaded OpenAI and Re:amaze loaded Google Analytics. Each one is another company the visitor's browser contacts as soon as the widget loads.
Where we could not see the widget
On five sites the vendor's own chat widget did not load in our visits: Zendesk, Drift (Salesloft), Brevo, Front and Pure Chat. Some of these companies run a different chat tool on their marketing site; in an exploratory pass, front.com loaded a widget from Qualified and salesloft.com one from 1mind. Freshworks (Freshchat) answered our browser with an error on all three passes.
What to do on your own site
- Open your site in a private window and look before you click. Your browser's developer tools show what the widget loads and stores while your banner is still on screen.
- Load the widget after consent, or only when the visitor clicks the chat button. Consent tools can usually hold a script until "accept"; a click-to-load button avoids storing anything before the visitor asks.
- Keep secrets out of URLs. Tokens and email addresses in query strings end up wherever the full address is sent. Ask your vendor whether it can send the path only.
- Ask for the cookie and storage list. Names, lifetimes and purposes belong in your cookie policy, and the vendor should give them to you.
For transparency about our own product: muro is in this test, measured on go-to-agency.com, the site of the agency that builds it. In its default mode it is one of the ten that load before the banner is answered: 4 requests, 11 kB, 2 localStorage keys and no cookie, and it sent the page path without the query string. Its lazy mode, which we did not measure here, shows the button only and reads, writes and sends nothing until the visitor opens the chat.
Method and limits
- Vendor sites, vendor settings. Each widget was measured on its maker's website with the maker's configuration. On your site the same widget can behave differently depending on its settings.
- One place, one day. All visits came from France on 10 October 2026, 3 passes per site, figures are medians. Results were identical across passes except for JivoChat, whose site loaded on one pass of three.
- Completeness. Widgets that live in an iframe from the vendor's domain run in a separate browser process by default; we disabled site isolation so their requests were captured, and compared our capture with an independent count from the browser automation library. They matched within one request on every site.
- What "sent" means. We found the marker in a request URL, a request body or a WebSocket message going to the vendor. We cannot see what happens to it on the server.
- Banners. We classified each banner from screenshots of every pass. "Accept" was clicked automatically; the follow-up refusal and interaction tests covered the two widgets that waited.
- Not a legal assessment. Whether a given behaviour needs consent depends on its purpose and on national law. This benchmark records what happens, not whether it is lawful.
The full request log, one row per request attributed to a widget across all passes, is available as a second CSV file. The same crawl gave us the weight of each widget: the median chat widget weighs over half a megabyte.
Sources
- 1CNIL, Chatbots: les conseils de la CNIL pour respecter les droits des personnes (accessed 2026-10-10)
- 2EDPB, Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive, version 2.0 (accessed 2026-10-10)
- 3Directive 2002/58/EC (ePrivacy Directive), Article 5(3) (accessed 2026-10-10)
- 4Intercom: page measured (accessed 2026-10-10)
- 5Zendesk: page measured (accessed 2026-10-10)
- 6Crisp: page measured (accessed 2026-10-10)
- 7Tidio: page measured (accessed 2026-10-10)
- 8LiveChat: page measured (accessed 2026-10-10)
- 9tawk.to: page measured (accessed 2026-10-10)
- 10HubSpot: page measured (accessed 2026-10-10)
- 11Freshworks (Freshchat): page measured (accessed 2026-10-10)
- 12Drift (Salesloft): page measured (accessed 2026-10-10)
- 13Olark: page measured (accessed 2026-10-10)
- 14Help Scout: page measured (accessed 2026-10-10)
- 15Gorgias: page measured (accessed 2026-10-10)
- 16Zoho SalesIQ: page measured (accessed 2026-10-10)
- 17Smartsupp: page measured (accessed 2026-10-10)
- 18HelpCrunch: page measured (accessed 2026-10-10)
- 19JivoChat: page measured (accessed 2026-10-10)
- 20Chatwoot: page measured (accessed 2026-10-10)
- 21Lime Connect (Userlike): page measured (accessed 2026-10-10)
- 22Brevo: page measured (accessed 2026-10-10)
- 23Chatra: page measured (accessed 2026-10-10)
- 24Front: page measured (accessed 2026-10-10)
- 25Re:amaze: page measured (accessed 2026-10-10)
- 26Pure Chat: page measured (accessed 2026-10-10)
- 27Chaport: page measured (accessed 2026-10-10)
- 28muro: page measured (accessed 2026-10-10)
