Website Privacy Index 2026

Ecommerce Privacy Index

Independent ecommerce and direct-to-consumer sites. We scored 457 of them on what happens to a visitor before they agree to anything. The mean came out at 26.9 out of 100.

This index covers restaurant, hospitality and independent ecommerce sites. It is not a sample of the web as a whole, and the figures should not be read as one. Every figure describes what an automated scan could observe on a public page. A site recorded as having no consent platform detected may run one the scanner could not see, and an absence of findings is not a clean bill of health.

88.0% had no consent platform detected 402 of 457
26.9 mean privacy score out of 100 across 457 sites
20.8% showed a working Consent Mode v2 signal 95 of 457
5 reached the Gated tier 5 of 457

Ecommerce: where 457 sites land

10.9%Partial23.4%Exposed64.6%Unprotected
GatedPartialExposedUnprotected

Rawsoft Website Privacy Index · n = 457 · scanned January to February 2026

Show the data
TierSitesShare
Gated51.1%
Partial5010.9%
Exposed10723.4%
Unprotected29564.6%

The sites that did run a banner

Only 55 of the 457 ecommerce sites in this edition had a consent platform the scanner could detect. Of those, 4 still fired tracking before consent or after a refusal. That base is small, so treat it as an indication rather than a rate.

How ecommerce compares

020406080100Restaurants14.6Ecommerce26.9Mean privacy score (0-100)

Rawsoft Website Privacy Index · n = 1,609 · scanned January to February 2026

Show the data
VerticalMean scoreSites
Restaurants14.61,152
Ecommerce26.9457

Ecommerce sites that reached the Gated tier

Every site here had a consent platform detected, a working Consent Mode v2 signal, and no tracking observed before consent or after a refusal. Listing is positive only.

Read the full 2026 index →

How this was measured

Each site was loaded the way a first-time visitor loads it. The scan recorded whether a consent platform appeared, when it appeared, what fired before anyone interacted with it, what fired after a refusal, and whether a privacy preferences link was reachable.

Tiers describe the mechanism observed, not the company. They are assigned from what the scan saw rather than from the score, because the score awards points where a vendor simply isn't present, and that would flatter sites that run no tags at all.

  • Gated. Consent platform detected, Consent Mode v2 observed, no tracking seen before consent or after denial
  • Partial. Consent platform detected, but with gaps: no Consent Mode v2 signal, or tracking seen anyway
  • Exposed. No consent platform detected, though a privacy or cookie preferences link was found
  • Unprotected. No consent platform and no privacy preferences link detected

Records: 4,904 scanned, 4,815 carrying a privacy result. Crawl window: January to February 2026. Nothing here is a legal conclusion, and no site is described as compliant or non-compliant.

See how your own site scores

Same scan, same method, free.

Run a free privacy scan

Or book a data and tracking audit for a full review.