Four numbers that are easy to blur
From the Website Privacy Index, 47,420 sites scored between January and October 2026:
- 1,473 had a consent platform detected. The other 45,947 (96.9%) had none.
- 238 of those reached the Gated tier.
- 1,235 landed in Partial: platform present, job not finished.
- 598 of the 1,473 (40.6%) were observed tracking anyway.
Those last two numbers measure different things, and this piece exists partly to keep them apart.
What each tier actually requires
The tiers describe the mechanism the scan observed, not the company and not a legal status. Written as test conditions:
- Gated: a consent platform detected, a working Consent Mode v2 signal, and no tracking seen before consent or after a refusal. All three, on the same page load.
- Partial: a consent platform detected, but with a gap. Either no Consent Mode v2 signal, or tracking seen anyway.
- Exposed: no consent platform detected, though a privacy or cookie preferences link was found.
- Unprotected: no consent platform and no privacy preferences link detected.
Across the whole sample that's Gated 0.5%, Partial 2.6%, Exposed 27.1% and Unprotected 69.8%.
Not Gated doesn't mean tracked anyway
Here's the misreading worth killing, and it's an easy one to make. It's tempting to read 1,235 Partial sites as 1,235 sites that tracked people before consent. That would overstate the problem by about two times.
A site lands in Partial one of two independent ways. It can block perfectly and simply never send the Consent Mode v2 signal. Or it can send the signal and still let tracking through. Only the second kind tracked anyway.
The number that answers "did the banner stop anything" is the separate one: two in five sites that had a banner tracked anyway (598 of 1,473). It's smaller, and it's the one you can check on the report.
Why Partial is riskier for the buyer than Unprotected
An Unprotected site knows it hasn't done anything. Nobody on that team believes the problem is solved.
A Partial site has a receipt. Someone bought a platform, someone launched a banner, and the project was marked done. That's what makes the tier dangerous: it's the only one whose occupants reasonably believe they're finished.
How a platform ends up not blocking
The index measures page behavior, not causes. But the common reasons a platform fails to block are well known, and they share one shape: a platform only blocks what it's wired to block.
- Tags that load outside the tag manager, so the platform never sees them. More on that: The Trackers That Never Pass Through Your Tag Manager
- Vendor scripts injected by a page template or plugin
- A pixel hardcoded into the page head years ago and forgotten
The two-minute test
- Open a private browser window, so there's no stored choice.
- Open developer tools and switch to the Network tab before loading the page.
- Load your site and don't touch the banner. Watch what goes out to analytics and ad domains.
- Now refuse, browse two pages, and watch again.
If requests are leaving before you answer, or after you say no, the platform isn't gating what you think it is. The free scan runs the same check for you.
What the test can't tell you
It tells you what fires. It doesn't tell you what your obligations are, which depend on where your visitors are and what you collect. That part is a question for counsel, and it's a much better conversation when you walk in with the network log.
More from the Website Privacy Index: Do cookie banners work? · Cookie banner adoption · Consent Mode v2 adoption
Rawsoft provides technical implementation and analysis, not legal advice. Please confirm any regulatory interpretation with your counsel.
Part of the guide: Consent Mode v2: Setup, Testing and Common Failures