The Consent Banner Nobody Owns

1,109 of 47,419

That is how many sites in our Website Privacy Index were running a consent platform we could put a name to.

The full picture, so nothing is cherry-picked

• 47,505 public websites scanned, 47,419 carrying a privacy result. Window: January to September 2026.
• 45,944 of 47,419 (96.9%) had no consent platform detected.
• 1,475 had one detected.
• 1,109 of those carried a vendor the scanner could identify: OneTrust 589, CookieYes 206, Cookiebot 149, Termly 96, iubenda 40, Usercentrics 22, Quantcast 7.

Those vendor counts are detections in one sample of three verticals. They are not market share and should not be repeated as such.

The gap between detected and nameable

1,475 minus 1,109 is roughly 366 sites where something was clearly there and the scanner could not say what.

A scan cannot tell you why a platform is unidentifiable. There are at least three explanations and we have no way to separate them:

1. It is a vendor our fingerprinting does not cover. There are many more consent products than the seven above.
2. It is a self-hosted or heavily customised build of something recognisable, where the markers we look for were changed or removed.
3. It is what it looks like: a banner somebody wrote in-house once, to satisfy a request.

We are going to talk about the third category. Not because we measured it, and not as a count. As a category, because it has a failure profile worth understanding and almost nothing written about consent acknowledges it exists.

It never updates

When a platform changes its consent API, or a regulator's guidance moves, or a browser changes how something is stored, a vendor ships an update. You may not read the release note, but the change arrives.

A component in your own repository receives nothing. There is no upstream, no release note, no deprecation warning, and crucially no broken build to tell you the world moved. It keeps working exactly as written, which is the problem rather than the reassurance it sounds like.

It is invisible to tooling

Scanners and checklists recognise known platforms. A custom build reads as absent.

That error runs in both directions, and naming both is what makes this an observation rather than a sales line. The site looks worse than it is on a scan, because a real consent layer is recorded as nothing detected. And it looks better than it is in reality, because nobody is checking whether the hand-built thing still does what it did. We wrote about the first half of that error, in our own data, in detected is not the same as present.

It has no owner

A subscription carries a renewal date, an invoice, a vendor contact and a line in somebody's budget. Four separate mechanisms that cause a human being to think about it at least once a year.

A component in your own repository carries none of those. It has a commit from three years ago and an author who may have left. Nothing in the calendar will ever surface it.

The generalisation worth stealing

Anything you build yourself to satisfy an external requirement inherits the maintenance of that requirement permanently, and almost nobody staffs for that half.

The build was a sprint. The maintenance is forever, it is unscheduled, and it is triggered by events outside your organization that nothing in your organization is watching for.

To be plain: a hand-built banner can be perfectly lawful, and building in-house is not a mistake. The claim here is about maintenance and ownership, not legality.

Three checks

1. Find it in your own page source and try to name the product. If you cannot, that is not a failure of the check. It is the finding.
2. Ask when it last changed, and against what. A date with no reason attached means it has never been updated in response to anything external. The provenance argument is in your vendor changed 200 things on your site.
3. Ask who would be told if the rules moved. Not who would fix it. Who would hear about it at all.

And remember that no consent platform detected is not the same as no banner. The two get conflated constantly, including by people reading our own index, and the distinction between notice and consent is the subject of a cookie banner is not a consent tool.

Who owns it this quarter

Not who wrote it. Who owns it now, this quarter, by name. If that question has no answer, the banner is doing whatever it was doing in the year it was written, and it will keep doing that until somebody looks.

Rawsoft provides technical implementation and analysis, not legal advice. Please confirm any regulatory interpretation with your counsel.