Two bases, stated together
Of 47,420 sites scored between January and October 2026, 1,473 had a consent platform detected. Of those 1,473, 598 (40.6%) were observed tracking anyway.
Consent QA usually tests one thing: does the banner appear before anything fires? That's a timing test. It's the easier half of the problem.
Splitting the 598
- 297 showed some sign of firing early: tracking flagged before consent, or a tag that loaded before the banner resolved. These fail the test most teams already run.
- 301 showed no early firing at all. The banner appeared on time, the visitor answered, and tracking continued after a refusal anyway.
301 of 598 is 50.3%. Half of the failures pass the standard acceptance test. Counting every site that kept firing after a refusal, including some that also fired early, it's 416 of 598 (69.6%).
Why the split matters
The first group fails a test most teams already run, so it usually gets caught. The second group passes that test. Everyone involved sees a banner that shows up on time and records the choice. The failure only appears if somebody refuses and then watches what happens next.
Why the second group exists
A banner is an interface. What actually happens depends on whether the tags behind it read the answer. A consent platform emits a signal, and something downstream has to consume it: the tag manager's consent settings, Consent Mode, each vendor's own configuration.
Those are separate builds, usually owned by separate people. The banner gets launched and tested. The wiring behind it gets assumed. A site in the 301 usually has a perfectly competent banner and a container that never asks it anything. More on that seam: Nobody Owns The Wire Between Your Consent Banner And Your Ad Platform.
The two-minute test
- Open a private browser window and open developer tools on the Network tab.
- Load your site and click reject.
- Browse two pages.
- Look at what still goes out to analytics and ad domains.
This is the half of the test that catches the 301. Our acceptance-test write-up goes deeper: Your Consent Banner Passed Launch Day. That Was The Easy Test..
Definition of done
"The banner shows up" passes on day one and says nothing about day two. Done means a refusal changes what fires, on every page, after every release. The free scan checks both halves in about a minute.
Source: Rawsoft Website Privacy Index, 47,506 sites scanned and 47,420 scored, January to October 2026. The crawl covers restaurant, hospitality and independent ecommerce sites, so it is not a sample of the whole web.
Rawsoft provides technical implementation and analysis, not legal advice. Please confirm any regulatory interpretation with your counsel.
Part of the guide: Consent Mode v2: Setup, Testing and Common Failures