Twice in one morning
Our scanner reported no consent management platform on two websites. Both were running one. The banner appeared, it worked, and a person with a browser could see it in about four seconds.
Two different domains, one morning, same result. We are not naming them, and neither is a client.
Why it happened
Both were client-side ordering applications. The page that arrives in the initial response is close to empty, and the application assembles itself afterwards. Tags, including the consent platform's own script, load after that.
A scan that reads the response and looks for known markers sees a page with no consent platform on it, because at that moment there is no consent platform on it. Nothing malfunctioned. The tool answered the question it was actually asked.
This is not an exotic edge case. A large share of modern ordering, booking and reservation flows are built this way.
The uncomfortable part
We publish a public index built on this method. Its headline number is that 45,944 of 47,419 scored sites (96.9%) had no consent platform detected, across a crawl running January to September 2026.
Read that word out loud. Detected.
Some share of that 96.9% is a detection gap rather than an absence. We know this because we have now reproduced it by hand. What we do not know is how big that share is, and we are not going to put a number on it, because inventing a plausible-sounding one would be the exact error this piece is about.
The index is not wrong. The claim it makes is narrower than the way people read it, and that is on us to say clearly rather than on a reader to work out.
The number that survives this critique
There is a second figure on the same page that does not depend on recognising anybody's vendor: of the 1,475 sites where a consent platform was detected, 620 (42.0%) tracked anyway. 196 of them fired tracking before the visitor touched the banner. The rest carried on after a refusal.
That measurement requires only denying consent and watching what still leaves the browser. It does not care what the consent platform is called, who makes it, or whether we have ever seen it before. Behavioural findings are robust in a way that recognition findings are not.
The general defect
This is much bigger than privacy tooling. "Not found" and "not there" are different claims, and almost every system stores them in the same field.
- An uptime check that cannot reach a host reports the same way whether the host is down or the check is misconfigured.
- A security scanner reports no findings when it found nothing and when it never ran.
- An inventory system shows zero units for a discontinued product and for one nobody has counted.
- A test suite passes because every test passed, or because every test was skipped.
In each case the output renders identically and reads as good news. We wrote the analytics version of this up in zero versus missing, and the monitoring version in nobody monitors the monitor.
Why the direction of the error matters
A false negative on a detection scan makes the world look worse than it is.
That is the flattering direction for anyone selling remediation, which is precisely why we would rather be loud about it than quiet. A vendor whose errors all run toward "you have a problem" has an incentive not to look too hard, and a reader is entitled to know which way our errors run.
Three checks to run against any scanner, ours included
- Open one site by hand and compare it against the tool's answer. One is enough to find this class of defect. We found ours on the second.
- Ask what moment of the page load the tool observes. Initial response, after scripts run, after user interaction. The answer determines everything the tool is capable of seeing.
- Treat "none detected" as a question and "fired anyway" as a finding. One is a statement about the tool. The other is a statement about the site.
Who checks the checker
If your scanning tool started returning false negatives tomorrow, who would notice? The output would still render, the reports would still arrive on schedule, and the numbers would look slightly better than before. That is the shape of this failure, and the only defence against it is opening a browser.
The three checks above are free and none of them need us. If you want the fourth step, which is somebody verifying scan results by hand rather than running more scans, that is what Managed Privacy is for.
Not legal advice. Rawsoft determines what a system technically does: which tags fire, when, under what consent state, and what data is transmitted. We do not determine which laws apply to your organization, how a regulator would read them, or whether your organization is in compliance. Those are determinations for your counsel. Everything above describes behavior an automated scan observed on public pages at the time of the scan, and nothing in it is a legal conclusion about any site.