We scanned 47,505 public websites and scored 47,419 of them on what actually happens to a visitor before they agree to anything. The finding is not that consent is done badly. It's that on four sites in five, consent isn't asked for at all.
This index covers restaurant, hospitality and independent ecommerce sites. It is not a sample of the web as a whole, and the figures should not be read as one. Every figure describes what an automated scan could observe on a public page. A site recorded as having no consent platform detected may run one the scanner could not see, and an absence of findings is not a clean bill of health.
Sorting every site by what the scan could observe gives four groups. The largest by a wide margin is the one with nothing in place: no consent platform, and no privacy preferences link either.
Four in five sites had neither a consent platform nor a privacy preferences link the scanner could find.
Rawsoft Website Privacy Index · n = 47,419 · scanned January to September 2026
| Tier | Sites | Share |
|---|---|---|
| Gated | 239 | 0.5% |
| Partial | 1,236 | 2.6% |
| Exposed | 12,828 | 27.1% |
| Unprotected | 33,116 | 69.8% |
The mass sits at the bottom. 18,550 sites scored zero, and the mean was 13.5 out of 100.
Rawsoft Website Privacy Index · n = 47,419 · scanned January to September 2026
| Score band | Sites |
|---|---|
| 0-9 | 18,555 |
| 10-19 | 16,906 |
| 20-29 | 10,422 |
| 30-39 | 569 |
| 40-49 | 121 |
| 50-59 | 139 |
| 60-69 | 129 |
| 70-79 | 17 |
| 80-89 | 489 |
| 90-99 | 72 |
1,475 sites had a consent platform the scanner could see. That's 3.1% of the sample. Within that group, 620 sites still fired tracking before any interaction, or kept firing after a refusal.
Those are two different failures and they're worth separating. 196 sites tracked before the visitor touched the banner. The rest passed that test and then ignored the answer. A banner that appears on time and is then overruled by the tags behind it is, from the visitor's side, no banner at all.
Counted across the 1,475 sites where a consent platform was detected. A vendor could be identified on 1,109 of them; the remaining 366 ran something the scanner could not attribute, so this is a share of identifiable platforms rather than of the whole market.
Rawsoft Website Privacy Index · n = 1,109 · scanned January to September 2026
| Vendor | Sites detected |
|---|---|
| OneTrust | 589 |
| CookieYes | 206 |
| Cookiebot | 149 |
| Termly | 96 |
| iubenda | 40 |
| Usercentrics | 22 |
| Quantcast | 7 |
Ecommerce sites carry more tags and more scrutiny, and it shows. Restaurants sit at the other end. Both cuts are drawn from the same crawl and the same scan, so the gap between them is a real difference in practice rather than a difference in method.
Verticals with at least 300 scanned sites. Ecommerce runs consent tooling roughly twice as often as restaurants do.
Rawsoft Website Privacy Index · n = 40,257 · scanned January to September 2026
| Vertical | Sites | Gated | Partial | Exposed | Unprotected |
|---|---|---|---|---|---|
| Restaurants | 31,167 | 0.4% | 2.2% | 15.0% | 82.4% |
| Ecommerce | 8,386 | 0.2% | 1.6% | 81.2% | 17.1% |
| Hospitality | 704 | 5.1% | 18.3% | 26.6% | 50.0% |
Rawsoft Website Privacy Index · n = 40,257 · scanned January to September 2026
| Vertical | Mean score | Sites |
|---|---|---|
| Restaurants | 9.9 | 31,167 |
| Ecommerce | 24.0 | 8,386 |
| Hospitality | 18.6 | 704 |
We can measure how often sites running each consent platform still leaked, and the per-vendor numbers differ sharply. We're not publishing them. The largest vendor group in this crawl has 589 sites in it and the smallest has a handful, which is nowhere near enough to characterise a product used on millions of sites. Leak rates also track configuration far more than they track the tool.
We also excluded 50 sites that scored a perfect 100 because the scanner found nothing to fail them on. An empty result is not a clean site, and a leaderboard built on absence of evidence would be worthless to everyone reading it.
Each site was loaded the way a first-time visitor loads it. The scan recorded whether a consent platform appeared, when it appeared, what fired before anyone interacted with it, what fired after a refusal, and whether a privacy preferences link was reachable.
Tiers describe the mechanism observed, not the company. They are assigned from what the scan saw rather than from the score, because the score awards points where a vendor simply isn't present, and that would flatter sites that run no tags at all.
Records: 47,505 scanned, 47,419 carrying a privacy result. Crawl window: January to September 2026. Nothing here is a legal conclusion, and no site is described as compliant or non-compliant.
4.4% showed a working signal. 49.2% ran Google tags without one.
How many sites had any consent platform the scanner could detect.
What happened on the sites that did have one.
Which platforms showed up, and on how many sites.
31,167 sites, the deepest cut in the index.
8,386 sites, and the strongest scores in the crawl.
239 sites with a consent gate and a verified signal behind it.
The same scan that produced this index runs on any domain in about a minute, free, with no account.
Run a free privacy scanOr book a data and tracking audit for a full review.