Website Privacy Index 2026

Do cookie banners actually work?

353 sites in this crawl had a consent platform. On 22.1% of them, tracking fired before the visitor interacted with it or carried on after a refusal.

This index covers restaurant, hospitality and independent ecommerce sites. It is not a sample of the web as a whole, and the figures should not be read as one. Every figure describes what an automated scan could observe on a public page. A site recorded as having no consent platform detected may run one the scanner could not see, and an absence of findings is not a clean bill of health.

What happened on sites that had a consent platform

Two different failures. The first is a banner that fires too late. The second is a banner whose answer the tags behind it ignore.

Tracked before any interaction37Tracked before consent or after refusal78No tracking observed either way275

Rawsoft Website Privacy Index · n = 353 · scanned January to February 2026

Show the data
OutcomeSites
Tracked before any interaction37
Tracked before consent or after refusal78
No tracking observed either way275

Installing the banner is the easy part

A consent platform only governs what it's wired to govern. Drop one onto a site whose tags fire directly from the page, or from a tag manager with no consent conditions on the triggers, and the banner becomes decoration. It appears, it records a choice, and the tracking underneath carries on regardless.

That's what most of these results are. Not a broken product, a product that was installed and never connected to anything.

How this was measured

Each site was loaded the way a first-time visitor loads it. The scan recorded whether a consent platform appeared, when it appeared, what fired before anyone interacted with it, what fired after a refusal, and whether a privacy preferences link was reachable.

Tiers describe the mechanism observed, not the company. They are assigned from what the scan saw rather than from the score, because the score awards points where a vendor simply isn't present, and that would flatter sites that run no tags at all.

  • Gated. Consent platform detected, Consent Mode v2 observed, no tracking seen before consent or after denial
  • Partial. Consent platform detected, but with gaps: no Consent Mode v2 signal, or tracking seen anyway
  • Exposed. No consent platform detected, though a privacy or cookie preferences link was found
  • Unprotected. No consent platform and no privacy preferences link detected

Records: 4,904 scanned, 4,815 carrying a privacy result. Crawl window: January to February 2026. Nothing here is a legal conclusion, and no site is described as compliant or non-compliant.

Check your own site in about a minute

Free scan, no account, same method as the index.

Run a free privacy scan

Or book a data and tracking audit for a full review.