A reframe, for the people who can actually act on it
Consent Mode gets discussed as a compliance chore. It arrives as a request from legal or from a privacy vendor, it goes on a list, and it competes for attention with things that have revenue attached.
It is also a measurement input, and framed that way it belongs to whoever owns paid media spend. That is the framing in this piece, because that is the person with both the budget authority and the reason to care.
The measurement
Our Website Privacy Index scanned 47,505 public websites and scored 47,419 of them, January to September 2026, across restaurant, hospitality and independent ecommerce sites. Of those:
- 2,108 (4.4%) showed a working Consent Mode v2 signal.
- 23,307 (49.2%) ran Google tags with no Consent Mode signal at all.
What the signal actually does
With Consent Mode configured, a visitor who declines does not simply vanish. The Google tag still sends a cookieless ping: no identifiers, nothing that follows the person around, but an indication that something happened.
That ping is what makes modelling possible. The platform can see that there is a gap between the conversions it can attribute and the activity it can observe, and it can estimate across that gap.
What absence does, which is the hinge
With no signal at all, there is no ping and therefore no gap. The platform is not filling in missing conversions. It does not know any are missing.
This is the part that gets misread constantly. People assume that a site without Consent Mode is in a degraded state that Google is compensating for. It is not. It is in a state where the declined traffic never existed as far as the reporting is concerned, and nothing anywhere indicates that a population was dropped.
Why the failure is invisible
Set the two states side by side. A site with a correct signal reports some observed conversions and some modelled ones. A site with no signal reports only observed conversions.
Both dashboards render. Nothing errors. No alert fires, no row turns red, no import fails. A correct implementation and a completely absent one produce reporting that looks equally healthy, and the only difference is a number that is quietly smaller in one of them.
It belongs to the same family as the failures we wrote about in conversion tracking that broke without telling anyone and the GA4 and Google Ads mismatch: the output looks fine, so nobody looks.
How it presents to a media buyer
Mechanically, you would expect a specific symptom pattern. Attribution drifts toward whichever channels are least affected. Modelled conversions do not appear where a buyer expects them. A channel that is working looks like it is losing effectiveness, and the optimisation response to that is to cut it.
We are describing the mechanism, not a measurement. We have not quantified the advertising impact and we are not going to put a percentage or a dollar figure on it here. Anyone who does should be asked what their sample was.
Two checks
- Read the full query string on one Google request, rather than confirming the tag fired. A tag firing with a consent state and a tag firing with none look identical in most debugging tools, because the tool is telling you the tag ran, not what it carried.
- Ask whether Consent Mode was configured, not whether the consent platform supports it. Every platform on the market supports it. Support is a product capability. Configuration is a decision somebody had to make inside your own tag container, and the second one is what shows up in the request.
Who would notice
If the consent signal on your site stopped transmitting tomorrow, after a template change, a tag manager publish, or a migration nobody flagged as a consent event, who would notice, and would anything tell them?
For most of the sites in this index there is no signal to stop. For the rest, the answer is usually nobody, and no, because the symptom of this failure is a smaller number rather than a broken one.
The observable half is the half that can be watched continuously rather than audited once, which is what Managed Privacy does. If you would rather start with one look at the whole tag layer, book a data and tracking audit.
Not legal advice. Rawsoft determines what a system technically does: which tags fire, when, under what consent state, and what data is transmitted. We do not determine which laws apply to your organization, how a regulator would read them, or whether your organization is in compliance. Those are determinations for your counsel. Everything above describes behavior an automated scan observed on public pages at the time of the scan, and nothing in it is a legal conclusion about any site.