Two numbers
Across the 47,419 sites scored in our Website Privacy Index, scanned January to September 2026:
- 23,307 were running Google tags with no Consent Mode signal at all.
- 2,108 showed a working Consent Mode v2 signal.
The surprising part
Most people, told that consent signals are a widespread problem, assume the problem is misconfiguration. Wrong defaults, signals sent at the wrong time, values that do not match what the banner recorded.
The modal state is not a broken signal. It is an absent one. Nothing was configured incorrectly because nothing was configured.
What Consent Mode is at the wire level
It is not a tag you watch fire in a debugger. It is a set of parameters that ride inside requests that were already going out.
The Google tag sends its request either way. With Consent Mode configured, that request carries the current consent state. Without it, the request goes out looking almost exactly the same, minus a few parameters nobody opens the request to check.
That is why it has no visible surface. There is no tag to watch, no error to catch, and no row in any report that says this request had no consent state attached.
A denied state still sending something is correct
This is the point most readers get wrong, and getting it wrong sends people hunting for the wrong bug.
Under Consent Mode, a visitor who denies consent still generates a cookieless ping. No identifiers, nothing persistent, nothing that follows the person. It is an indication that something happened, and it is working as designed.
So seeing a request go out after a refusal does not by itself mean the site is ignoring the refusal. You have to read what is in the request. A cookieless ping and a fully identified hit look similar in a network tab list and are completely different things once opened.
Why it passes every review
Installing a consent platform and wiring its output into the consent API are two separate pieces of work.
The first has a visible result that can be demonstrated to anybody: here is the banner, here are the buttons, here is the choice being stored. The second has no visible result at all.
Whoever signs the work off sees the first one. There is nothing for them to look at in the second, and no natural moment in the process where somebody says let us open a request and read it.
Decision and transmission
Every compliance control has two halves: the decision and the transmission. Teams test the half with a user interface.
This generalises well past consent. A preference centre that records a choice nothing downstream reads. An opt-out form that writes to a table nobody queries. A do-not-call flag set in one system and never propagated. In each case the interface works, the decision is captured, and the instruction never leaves the building.
Four checks
- Open a private window and decline everything. Fresh profile, no existing state.
- Read the full query string on one Google request. Not whether the request happened. What it carried. You are looking for whether consent parameters are present at all.
- Ask whether Consent Mode was configured, not whether your consent platform supports it. Every platform supports it. Support is a product feature. Configuration is a decision somebody made inside your container.
- Check the ordering. A consent default has to be in place before the first tag looks for it. If the default arrives after, the tag has already made an assumption.
Who would notice
If the signal stopped transmitting tomorrow after a deploy, who would know? Nothing would break, no report would empty out, and the banner would carry on collecting answers exactly as before. That is the shape of a failure a one-off audit cannot catch, because the audit was right on the day it ran. The upstream distinction between notice and consent is in a cookie banner is not a consent tool, and the gating half in the piece on banner blocking.
A consent gate can stop holding on any publish, which is the argument for watching it continuously rather than auditing it once. That is what Managed Privacy does. For a single review of the whole tag layer, book a data and tracking audit.
Rawsoft provides technical implementation and analysis, not legal advice. Please confirm any regulatory interpretation with your counsel.