Checked once, and never again
Most sites have their consent setup checked once, at launch. After that, the result gets quoted as if it still holds: the banner works, the tags wait, we passed. Nobody writes down the date.
Our index has the same shape
It's only fair to start with our own data. The Website Privacy Index scanned 47,506 sites and scored 47,420 between January and November 2026. Each site appears once, with the result of its most recent scan. It's a picture of each site on one day, not a record of how it changed.
That's the right shape for a benchmark. It's the wrong shape for knowing whether your own site still works today, and most internal checks share it.
What changes a site without raising an error
These are ordinary events. They're illustrative, not something the index measures:
- A campaign pixel added for a launch.
- An agency tag left behind after a test ended.
- A vendor script that updates itself and starts loading something new.
- A template change that moves a tag outside the tag manager.
Each one can change what the site sends before a visitor answers. None of them produces an error, a failed build or a red dashboard.
Why none of them trigger a recheck
There's usually no owner for the check, no alert when the result would change, and the original pass still reads as a pass. So the result ages quietly. A site can be tested correctly in March and be wrong by June without anyone being careless.
We wrote about the data version of this problem in State Is Not History: a value that's overwritten in place stops telling you when it was true.
A result is a timestamp plus a state
"Our consent setup passed" is half a sentence. The whole one is "our consent setup passed on this date, on these pages." Quoting the first without the second is the mistake, and it's an easy one, because the date feels like a detail.
The same goes for a clean scan. A Clean Scan And A Blind Scanner Look Identical covers what a result can't see; this is about what it can't see later.
The question to answer today
Two dates, side by side:
- When was the last time someone ran a refusal test on your site?
- When was the last time a tag was added or changed?
If the second date is later than the first, your last result doesn't describe your site any more. The acceptance test is the one to rerun.
Check it on a schedule, not once
A one-off audit tells you where you stood on one day. Checking on a schedule, after every release, is what keeps the answer current. That's what our Managed Privacy service does, and the free privacy scan shows where your site stands today.
Source: Rawsoft Website Privacy Index, 47,506 sites scanned and 47,420 scored, January to November 2026. The crawl covers restaurant, hospitality and independent ecommerce sites, so it is not a sample of the whole web.
More from the Website Privacy Index: Cookie banner adoption · Restaurant privacy index · Ecommerce privacy index
Rawsoft provides technical implementation and analysis, not legal advice. Please confirm any regulatory interpretation with your counsel.