The shape nobody expects
Most people read a score out of 100 the way they read a test result. They assume a fat middle and thin tails, so a low number feels like partial credit. Somewhere around 45 means you are about halfway there.
Sort every site in our Website Privacy Index by privacy score and you get the opposite shape. Of 47,419 scored sites, 45,883 scored under 30 and 561 scored 80 or over. That leaves 975 sites, 2.1% of the sample, spread across the entire 30 to 79 range. The mean is 13.5 out of 100.
The crawl covered 47,505 sites scanned, January to September 2026, across restaurant, hospitality and independent ecommerce. It is not a sample of the web as a whole.
The distribution, band by band
| Score band | Sites |
|---|---|
| 0 to 9 | 18,555 |
| 10 to 19 | 16,906 |
| 20 to 29 | 10,422 |
| 30 to 39 | 569 |
| 40 to 49 | 121 |
| 50 to 59 | 139 |
| 60 to 69 | 129 |
| 70 to 79 | 17 |
| 80 to 89 | 489 |
| 90 to 99 | 72 |
Rawsoft Website Privacy Index. n = 47,419 scored sites, scanned January to September 2026.
Read down that column and the cliff is obvious. The 20 to 29 band holds 10,422 sites. The very next band holds 569. Then it thins to 17 sites in the 70s before jumping back up to 489 in the 80s.
Why the middle is empty
This is not a statistical accident. It is a description of how consent gating gets built.
The points in the score come from states a browser can observe. Was a consent platform detected. Was a Consent Mode v2 signal present. Did anything track before a choice was made, or after a refusal. Each of those is close to binary per site. A tag either waits on a consent signal or it does not.
So a site that has wired one tag to wait and left twelve firing does not land in the middle. It lands near the bottom, because the observable outcome is still that tracking happened. Partial scores are rare because partial wiring, from the outside of the browser, does not look partial. It looks like nothing changed.
The corollary, which is the useful part
A rising privacy score is a step function, not a slope.
A consent project that is 80% complete does not look 80% done from a browser. It looks identical to a project that has not started, right up until the last tag is wired, at which point the score moves a long way at once.
That mismatch is where consent projects lose their sponsor. Six weeks in, the internal tracker says good progress and the external check says nothing has changed. Both are telling the truth. They are measuring different things, in the same way that a missing metric and a zero are different things, which we wrote about in zero versus missing.
About the cluster at the top
561 sites scored 80 or over, and that group deserves the same scepticism as the rest. The index page carries its own caveat and we will repeat it here: a high score reflects what an automated scan could observe, and an absence of findings is not a clean bill of health.
The score also awards points where a vendor is simply absent. A site running no tags at all can score well without anyone having made a single decision about consent. That is exactly why the index assigns its four tiers from the mechanism observed rather than from the score. We took this far enough to leave 50 perfect scores out of the published leaderboard entirely, for reasons covered in why we did not publish the 50 sites that scored 100.
What to do if you are mid-project
Stop tracking percentage-complete internally as your measure of progress, and start testing the observable outcome on a schedule. The test is free and takes a few minutes.
- Fresh private window, network tab open before the page loads, touch nothing. Note every analytics or ad request that goes out before you have chosen anything.
- Click reject, reload, browse two or three pages, look again. The answer to this one is what most of the score is actually made of.
- Repeat it after every tag manager publish. A single new tag with no consent condition on its trigger puts you back in the bottom band, and nothing in the publish flow will warn you.
That test returns the same answer a scanner would, because it is the same test.
The principle
The score is a description of a mechanism, not a progress bar. Read which end of the distribution a site sits at before reading the number, because between the two ends there is almost nothing to read.
Our free privacy scan runs the same method on any domain in about a minute, with no account. Run it on your own site, or book a data and tracking audit if you want the whole tag layer reviewed rather than the front page.
Not legal advice. Rawsoft determines what a system technically does: which tags fire, when, under what consent state, and what data is transmitted. We do not determine which laws apply to your organization, how a regulator would read them, or whether your organization is in compliance. Those are determinations for your counsel. Everything above describes behavior an automated scan observed on public pages at the time of the scan, and nothing in it is a legal conclusion about any site.