Two meanings of a clean result
A clean result can mean two very different things:
- Checked, and nothing was wrong.
- Couldn't check, so nothing was found.
On the page they look the same: a zero, a green tick, an empty list. Most automated tools only report the first kind of result, so the second gets folded into it.
Our own index says it first
The Website Privacy Index recorded no consent platform on 45,947 of 47,420 scored sites (96.9%). Right next to that number, the report prints its own limitation:
"A site recorded as having no consent platform detected may run one the scanner could not see, and an absence of findings is not a clean bill of health."
We've written about where that bites. Detected Is Not The Same As Present covers two sites our scanner got wrong, and the 50 perfect scores we didn't publish covers clean results that rest on nothing. This post is about the report, not the scan: what it should say when it couldn't look.
Why a scanner misses things
A page scan sees what loads in one browser, from one place, at one moment. The ways it can miss something are ordinary. These are mechanisms, not findings about any particular site:
- A script that loads late, after the scan has moved on.
- Behavior that only appears in some regions, behind a geo check.
- Pages behind a login the scanner doesn't have.
- Processing that happens on a server, where a page scan can't observe it at all.
None of these is a flaw in one product. They're limits of the method, and every tool that scans from the outside shares them.
The same zero, in tools you already own
- A tag audit with zero errors. Did it reach checkout, the logged-in area and the pages built after a search? If it crawled the public homepage and a few links, zero errors describes those pages only.
- An all-green compliance dashboard. Which pages, which regions and which consent states was it tested in? Green for a visitor in one country who never touched the banner says little about anyone else.
- Monitoring with no alerts. No alerts can mean nothing broke, or that the monitor stopped running. Nobody Monitors The Monitor covers the second case.
In each case, the useful question isn't "what did it find?" It's "what did it actually look at?"
What a report should do instead
A good report keeps three states apart and names each one:
- Checked and clean. The check ran on this page or system, and found nothing.
- Checked and found. The check ran and found a problem.
- Could not check. The check couldn't run, with the reason: blocked, behind a login, timed out, out of scope.
Then it puts a coverage line at the top: how many pages or systems it checked out of how many it was meant to, with the missing ones listed. The third state is the one most reports leave out, and it's the one that changes what a clean result means.
The same thinking applies to consent. A Consent Mode check that finds nothing on a site with no Google tags hasn't passed it, it simply had nothing to look at. Consent Mode Only Talks to Google walks through that case, and why we don't publish leak rates by vendor applies it to our own data.
A test for the last clean report you were handed
- Find your most recent clean result: an audit, a scan, a dashboard.
- Look for the place where it says what it couldn't reach.
- If it doesn't say, that's the finding. Ask the tool, or the person who ran it, for the coverage.
A statement about the scanner, too
An absence of findings tells you about the site and about the scanner. Read it as both. If you want to see what a scan of your own site can and can't see, the free privacy scan is a start, and a review covers the parts a scan can't reach.
Book a privacy and tracking review.
Source: Rawsoft Website Privacy Index, 47,506 sites scanned and 47,420 scored, January to October 2026. The crawl covers restaurant, hospitality and independent ecommerce sites, so it is not a sample of the whole web.