The numbers that should worry a launch sign-off
Our Website Privacy Index scored 47,419 sites on what happens to a visitor before they agree to anything, across restaurant, hospitality and independent ecommerce sites scanned January to September 2026.
A consent platform was detected on 1,475 of them. Of that group, 239 reached the Gated tier and 1,236 landed in Partial. That is roughly five in six of the sites that bought and installed a consent tool.
Every one of those 1,236 passed launch day. The banner appeared, the buttons worked, somebody signed it off.
What the two tiers mean
The index assigns tiers from the mechanism the scan observed, not from the score and not from anything about the company behind the site.
- Gated. Consent platform detected, Consent Mode v2 observed, and no tracking seen before consent or after denial.
- Partial. Consent platform detected, but with gaps: no Consent Mode v2 signal, or tracking seen anyway.
Neither tier is a legal status. Gated does not mean compliant, and Partial does not mean a site broke a rule. They describe what a browser saw.
Why launch-day acceptance passes so easily
Think about the checks that actually get run before a consent tool goes live. Does the banner render on desktop and mobile. Do the buttons work. Is the choice stored so it does not reappear on every page. Does the design match the brand. Is the wording the one legal approved.
Every one of those tests the banner. None of them test what the tags behind it do with the answer. That half of the project is invisible from the front of the site, has no obvious owner, and in most launches nobody wrote a test for it at all.
This is not carelessness. It is a gap in the acceptance criteria, and it is entirely normal, which is roughly what 1,236 sites in one crawl would suggest.
The acceptance test that does work
Three checks, a browser, about ten minutes. Give them to whoever signs the launch off.
- Fresh private window. Open the network tab before the page loads. Touch nothing. Note every analytics, ad or pixel request that goes out while you have made no choice at all. The index recorded 196 sites firing tracking before the visitor touched the banner, so this failure is real and it is invisible from the front end.
- Click reject. Reload. Browse two or three more pages. Look again. Most of the sites that tracked anyway passed the first check and failed this one: the banner collected an answer and the tags behind it carried on regardless.
- Open one Google request and read the full query string. Check whether consent parameters are present at all. If there is nothing, Consent Mode is not transmitting, whatever the consent tool's dashboard reports. The Consent Mode v2 page has what the index found on that.
Both of the first two are needed, because they catch two different failures. A banner that fires too late and a banner whose answer is ignored produce the same tier and nothing else in common. The banner results page separates them.
When to run it again
This is the part most teams miss. The test is not a launch gate, it is a release check.
Any new tag, any new pixel, a template change, a marketing request handled directly in the tag manager, a vendor script added to the theme: all of them can reopen the gap, and none of them will announce it. A site can be Gated in March and Partial in April without anyone touching the consent platform.
Put the three checks in the release checklist, next to whatever else gets verified after a publish. We made the same argument about tag manager publishes in the default workspace piece.
The principle
A banner collects an answer. The tag setup decides whether the answer is honoured. Only the second one can be tested from a browser, and it is the only one that changes what happens to a visitor.
Our free privacy scan runs the same method on any domain in about a minute, with no account. Run it on your own site, or book a data and tracking audit if you want the whole tag layer reviewed rather than the front page.
Not legal advice. Rawsoft determines what a system technically does: which tags fire, when, under what consent state, and what data is transmitted. We do not determine which laws apply to your organization, how a regulator would read them, or whether your organization is in compliance. Those are determinations for your counsel. Everything above describes behavior an automated scan observed on public pages at the time of the scan, and nothing in it is a legal conclusion about any site.