The freeze date is the real deadline
Many ecommerce teams restrict site changes ahead of peak season. When that freeze starts, and how strict it is, varies a lot by company. But the effect is the same everywhere: whatever your tracking and consent setup looks like on the day the freeze begins is what runs through your highest-revenue weeks.
Every holiday budget shift, bid change and campaign call gets made on that data. So the deadline for tracking work isn't Black Friday. It's your freeze date, and for a lot of teams that's weeks away.
What the index shows for ecommerce
Across 8,386 ecommerce sites scored between January and October 2026:
- Gated: 0.2%
- Partial: 1.5%
- Exposed: 81.2%
- Unprotected: 17.1%
The typical ecommerce failure isn't absence. It's a promise with nothing behind it: a privacy or cookie preferences surface detected, with no consent platform detected behind it. Full breakdown: Ecommerce privacy index.
The wider picture
Across all 47,420 scored sites, 23,301 (49.1%) ran Google tags with no Consent Mode signal at all. And among the 1,473 sites where a consent platform was detected, 598 (40.6%) were still observed tracking anyway. Having the tool and having it work are different measurements.
The October checklist
Four checks, all doable before the freeze:
- The purchase event fires once per order. Place a test order and confirm one purchase in GA4 and one conversion in each ad platform, not two. Double counting is common and it inflates everything downstream. See Visual Tagging Makes It Easy To Count The Same Order Twice.
- GA4 and your ad platforms agree within a tolerance you've written down. Some gap is normal. Decide what's acceptable now, so a holiday discrepancy is a signal rather than an argument. See Why GA4 and Google Ads Never Match.
- The consent choice actually changes what fires. Private window, network tab open, refuse, browse two pages, and watch what still goes out.
- A named owner for the tag container during the freeze. Someone has to say yes or no to emergency tag changes, and everyone should know who.
If you're already frozen
Then measure and document instead of changing. Run the checks above, write down what you find, and keep the network logs. January then starts from a known baseline instead of a guess about what happened in December.
Run the scan before the freeze, not after
The free scan shows what your live site fires before and after a consent choice, in about a minute. If you want the full picture, a tracking audit covers conversions, attribution and consent in one pass. Managed privacy keeps it that way after launch.
Source: Rawsoft Website Privacy Index, 47,506 sites scanned and 47,420 scored, January to October 2026. The crawl covers restaurant, hospitality and independent ecommerce sites, so it is not a sample of the whole web.
Rawsoft provides technical implementation and analysis, not legal advice. Please confirm any regulatory interpretation with your counsel.
Part of the guide: Why GA4, Google Ads and Adobe Never Agree