The Consent Gap
How 242 of the most visited US websites handle a visitor's choice to say no, and what tracking runs before anyone chooses.
of the leading US websites we tested failed our core privacy tests outright. They load ad tracking before any choice, give no obvious way to opt out, and keep tracking when the browser says no.
104 of 242 sites · 1,795 page loads · 244,395 network requests analyzed
Most leading websites make saying no hard, and many ignore it when visitors do
California law gives people two ways to stop a website from selling or sharing their data: a clear opt-out on the site, or a signal their browser sends automatically. We tested both on 242 leading US websites in October 2026.
We loaded every site three times: with no choice made, with the browser's Global Privacy Control (GPC) signal switched on, and after clicking the site's own reject button where there was one. We recorded every tag, cookie and network request, and verified the opt-out results by hand.
The result is a clear gap between what visitors are offered and what the sites actually do.
104 of 242 sites failed the core tests outright. They load ad tracking before any choice, give no obvious way to opt out, and keep tracking with GPC on. 64 of them offer no way to opt out at all.
of sites with ad tracking have no obvious opt-out. Only 48 of all 242 sites put a clear reject button on the banner a visitor sees on arrival.
of sites with ad tracking ignore the browser's opt-out signal, fully or in part. They kept sending data to ad companies with GPC switched on.
sites with a visible reject button kept tracking after it was clicked. They still contacted ad companies, and 16 still set advertising cookies.
of sites start session replay on arrival, recording clicks and scrolls before the visitor has made any choice.
ad, social and data companies are contacted by these sites before a visitor clicks anything. The median site with ad tracking contacts 7.
Only three sites that load ad tracking passed every test we ran: a clear reject that works, GPC honored, and no session replay before consent. The standard is achievable.
Where the 242 sites land
Each square is one website, grouped by its overall result.
Failed the core testsAd tracking, no obvious opt-out, GPC not fully honored
10443%Failed some testsPassed at least one core test and failed another, or session replay only
7129%No ad tracking or replayNothing on the site that our tests could fail
6426%Passed every testAd tracking, with a clear reject that works, GPC honored and no replay before consent
31%Ad trackingSending visitor data to ad tech, social, audience-data or ID companies, the kind of transfer California regulators would likely treat as selling or sharing.
Global Privacy Control (GPC)A browser setting that tells every site the visitor does not want their data sold or shared. Under California law, honoring it is an alternative to a homepage opt-out link.
Obvious opt-outA button worded as a clear no, such as "Reject all", "Decline" or "Accept only essential", on a banner visible when the page loads.
Session replayTools that record a visitor's clicks, scrolls and typing so a site can play the visit back later.
Each test reflects a behavior regulators and courts have already acted on
Every test in this benchmark relates to conduct that has already led to fines, civil penalties or settlements in the United States.
The cases below are drawn from public regulator orders, press releases and court records. They describe what each regulator or court said. Settlements are not admissions of wrongdoing.
No obvious opt-out
California regulators have fined companies for making the opt-out harder than saying yes.
CPPA (now CalPrivacy) · March 2025
The CPPA ordered Honda to pay a $632,500 fine. The order describes a cookie tool where accepting all took one click and opting out took at least two. Honda did not admit liability.
SourceCalPrivacy · March 2026
CalPrivacy ordered PlayOn Sports to pay a $1.1 million fine. The order says ticket holders had to click "Agree" to tracking before they could use their tickets, were pointed to industry opt-out tools instead of PlayOn's own, and had their opt-out preference signals ignored.
SourceGPC not honored
California regulators have penalized companies that did not honor opt-out preference signals such as GPC.
California Attorney General · August 2022
In 2022 Sephora agreed to pay $1.2 million in penalties to settle California Attorney General allegations that third-party tracking on its website and app amounted to a sale of shopper data, which it did not disclose and did not stop when shoppers opted out through GPC.
SourceCPPA (now CalPrivacy) · September 2025
The CPPA ordered Tractor Supply to pay a $1.35 million fine. The order says its opt-out webform did not stop the third-party tracking technologies used for advertising, and that the site did not honor opt-out preference signals such as GPC until July 2024.
SourceTracking after reject
Regulators have acted where a banner or opt-out form did not actually stop the tags behind it.
California Attorney General · July 2025
Healthline agreed to $1.55 million in civil penalties in a July 2025 settlement with the California Attorney General, which said its consent banner did not disable tracking cookies, sharing continued after opt-out, and article titles suggesting a diagnosis were shared with advertisers.
SourceNew York Attorney General · July 2024
The New York Attorney General said a review of 13 high-traffic websites, mostly well-known e-commerce sites, found marketing tags that stayed active after visitors used the sites' privacy controls, often because tags were miscategorized or hardcoded. All of the companies fixed the issues.
SourceTracking before consent
Trackers running without consent have been the basis of wiretap and privacy class actions.
U.S. District Court, N.D. Cal. · June 2026
A federal court granted final approval of a $3.85 million settlement of claims that the LA Times ran the TripleLift, GumGum and Audiencerate trackers without consent, in violation of CIPA's pen-register provision. An objector has appealed to the Ninth Circuit.
SourceAmounts are shown as each source describes them. A fine, civil penalties and a class settlement are different things, so we do not add them together. Cases checked against primary sources between September and October 2026.
A clear choice is rare
Fewer than one in five sites with ad tracking puts a clear way to say no in front of visitors.
We sorted every site into one of three groups, based on what a visitor sees when the homepage loads. Opt-out results were verified by hand in a US browser with no stored cookies.
Obvious option
A "Reject all", "Decline" or "Accept only essential" button on a banner that is visible on arrival.
Possible but not obvious
A way out exists, but the visitor has to find it: a "Cookie settings" or "Your Privacy Choices" link, a settings panel, or banner wording that stops short of a plain no.
No option
No reject on a banner, no settings route and no opt-out link found on the homepage.
Only 34 of 173 sites with ad tracking offer an obvious opt-out
Opt-out available to a visitor on arrival. Number of sites.
Among the 173 sites that load ad tracking, 72 offered no route out at all and 67 had one that a visitor would have to go looking for. Most banners that offered no way to say no told visitors that continuing to use the site meant they agreed.
An opt-out that sits behind a settings link is a grey area that courts have not yet tested much. Wording that stops short of a plain no can also be read as unclear. The safest position for any business is a clear option on the first screen, and tracking that stops when a visitor uses it.
Media hides the opt-out, higher education and healthcare often skip it
Opt-out available on arrival, by industry. All sites. Number of sites.
Under the California Consumer Privacy Act (CCPA), a business that sells or shares personal information must either post a clear and conspicuous "Do Not Sell or Share My Personal Information" link on its homepage, or honor opt-out preference signals such as GPC (Cal. Civ. Code 1798.135).
95 of the 173 sites with ad tracking had neither: no homepage link with that title or the shorter "Your Privacy Choices", and no full support for GPC.
Our obvious opt-out test is stricter than the statute's link requirement. It asks whether a visitor can say no from the first screen. Nothing in this report is legal advice or a finding about any organization's compliance.The signal most sites ignore
Three in four sites with ad tracking kept sending data to ad companies when the browser said no.
GPC lets a visitor opt out once, in the browser, instead of on every site. We loaded each site with GPC off and again with it on. With GPC on, 129 of 169 sites with ad tracking still contacted at least one ad or data-sharing company. On 107 of them, half or more of the ad companies seen without GPC were still there.
GPC tends to work completely or barely at all
What happened to each site's ad companies when GPC was switched on. Sites with ad tracking where GPC was confirmed.
Only 40 sites stopped all ad tracking. 66 changed nothing. On the 63 sites in between, ad exchanges were the vendors most often dropped, while the largest ad platforms most often kept firing.
The same ad company stopped on one site and kept firing on the next. That points to how each site placed its tags. A likely cause is tags added outside the consent setup, where the consent tool cannot switch them off. A consent tool was installed on 51 of the 129 sites that did not fully honor GPC.
Hospital sites changed least. 14 of the 18 that load ad tracking changed nothing at all with GPC on.
When reject does not mean reject
On 20 of the 24 sites where we could click a visible reject button, ad companies were still contacted afterwards.
We scored this test only where a visitor sees a reject button on arrival and the site loads ad tracking. After the click, 20 sites (83%) still contacted ad companies and 16 still set advertising cookies.
It happened in every industry: higher education 6 of 6, retail 7 of 8, banks 5 of 6, media 1 of 3 and healthcare 1 of 1.
83% kept tracking after the visitor clicked reject
Sites with ad tracking and a reject button visible on arrival. Each circle is one site.
We saw the same pattern on 24 sites where the only way out was the consent tool's settings panel. After switching everything off there, 17 of the 24 still contacted ad companies.
A reject button is a promise to the visitor. If the tags behind it are not tied to that choice, the button changes nothing.
Recording before anyone agrees
One in three sites started session replay as soon as the page loaded.
Session replay tools record clicks, scrolls and form interactions so teams can watch how people use a page. 77 of 242 sites (32%) started one on arrival, before the visitor had made any choice, and 63 of those offered no obvious way to opt out.
Session replay has been the subject of wiretap lawsuits under California's Invasion of Privacy Act (CIPA). Recording a visit before consent also carries a reputational cost if visitors learn about it.
Retail, banks and universities record the most visits on arrival
Share of sites that start session replay before any choice.
How the industries compare
Banks fail the core tests most often. Hospitals load the least ad tech, but barely respond to a visitor's signal where they do.
Industry scorecard
Darker cells mean a weaker result. Shares of sites, except the last column.
More than half of bank sites fail the core tests
Overall result by industry. Number of sites.
Less ad tech, but little response to the visitor's choice
Hospital sites run far less ad tech than any other industry. Where they do run it, the visitor's signal barely changes anything. Visits to a hospital site can reveal something about a person's health, which makes this group worth a closer look.
What runs behind the page
Before a visitor clicks anything, these 242 sites contact 247 different ad, social and data companies between them.
Media sites run nearly four times the ad tech of the next industry
Ad companies contacted by the median site with ad tracking, before any choice.
Ad companies that bring in more ad companies
A site adds one ad tag, and that tag calls in other ad companies the site never loaded itself. This happened on 79 of 173 sites with ad tracking (46%). At least 27% of all contacts with ad companies came through another ad company, and one chain of requests ran 14 steps deep.
These second-hand vendors matter for consent. A site can only switch off what it knows is there.
On three in four media sites, ad companies call in more ad companies
Share of sites with ad tracking where at least one ad company was brought in by another.
Each industry runs its own analytics stack
Analytics platform detected, by industry. Number of sites.
Signs of neglect
One in five sites shows signs that nobody is cleaning up the tag setup.
36 sites (15%) still load the retired Universal Analytics script. It sends nothing, so on its own it is harmless. It is a sign that old tags are not being removed, and old tags for vendors a company no longer works with can still be sending visitor data. 27 of these 36 sites load ad tracking, and 23 of them do not fully honor GPC.
20 sites (8%) send the same page view twice or more to Google Analytics 4 or Meta, up to five copies on one page. Some setups do this on purpose. When it is a mistake, it inflates traffic and conversion figures that marketing budgets rely on.
Banks show the most signs of untidy tagging
Share of sites with a retired script still loading or possible double counting.
What good looks like
The three sites that passed every test show the standard is reachable. Five practices help close the gap.
Put a clear choice on the first screen
Show "Reject all" beside "Accept all", with the same size and weight. Do not rely on "by continuing you agree" wording or a link to a settings page.
Make GPC switch off every tag that sells or shares data
Treat the signal as an opt-out for the whole page, including tags loaded outside the tag manager and vendors that other tags call in.
Test that reject actually stops the tracking
Check what the page sends after a visitor says no, in every consent state, after every release and on a regular schedule. Tags change without anyone touching the banner.
Hold session replay until the visitor agrees
Start recording only after consent, and mask form fields that could capture personal information.
Remove what you no longer use
Retired scripts, duplicate properties and forgotten pixels add data flows nobody is watching. A regular tag audit keeps the list short.
Teams should confirm with their own counsel how these practices apply to their sites and data.
How we ran the benchmark
242 websites, three scans each, opt-out results verified by hand.
Sample
Up to 50 sites per industry, in rank order from public lists: retail (NRF, 2026), healthcare (Becker's, patient-facing sites), banking (Federal Reserve large banks, 30 June 2026), higher education (U.S. News, 2027) and media (Press Gazette, JustWatch, Semrush). Media has 42 sites. DataTrue customers were excluded, and no site is named. 84 of the 326 sites we tried (26%) blocked automated scanning and were replaced by the next site on the list.
The four tests
| GPC honored | No ad tracking with GPC on. "Partly": under half the ad companies seen without it. |
| Reject honored | No ad tracking after clicking an obvious reject. |
| No replay before consent | No session replay tool on arrival. |
| Obvious opt-out | A clear reject, decline or essential-only button on a banner visible on arrival. |
The core tests are GPC honored and an obvious opt-out, applied to sites with ad tracking.
Manual verification
Every site scored as lacking an obvious opt-out was verified by hand in a US browser with no stored cookies. A sample of the domains classified as ad tracking was also reviewed.
Scans
Each site was scanned on 12 and 13 October 2026 (homepage and up to two linked pages) in three conditions: no choice made, GPC on, and after the site's own opt-out. That produced 1,795 page loads, 244,395 network requests, 46,305 tag requests and 30,554 cookies. Across all scans we catalogued:
- 215 unique tags, 102 of them ad tracking tags
- 1,250 distinct third-party domains
- 273 ad tracking domains
- 247 ad, social and data companies behind those domains
Many ad domains are called in by other tags, so domains are the fuller measure of ad tracking.
What counts as ad tracking
Domains California regulators, litigants or past enforcement would treat as a sale or sharing: ad tech, cross-context advertising, ID graphs, audience data, and social and affiliate pixels. About 280 domains qualify. Analytics, consent tools, content delivery, chat, search, forms and monitoring do not. Google consent-mode "ads denied" signals count as honored.
Limits
- One scan per condition. Ad auctions vary between loads, so totals and medians are more reliable than single sites.
- Request chains and double counting are minimums.
- Results describe what we observed on the scan dates. They are not legal advice or a compliance finding.
DataTrue is a tag testing and monitoring platform for websites and mobile apps. It continuously tests live sites in real browser sessions, across the whole site and through key journeys like checkout and signup, in every consent state. DataTrue confirms that the tags a business depends on are firing correctly, from analytics to advertising and conversion tags, with no gaps and no double counting. It also catches tags that should not run, such as tracking that continues after a visitor opts out or personal data sent to the wrong place.
The scans in this benchmark used the same tests our customers run on their own sites. About a quarter of the sites we tried blocked our automated browser, which is common with bot protection. Customers add DataTrue to their allowlist so their own sites are tested every time. DataTrue gives marketing, analytics, privacy and legal teams evidence of what their site actually does, so they can decide what to change. Learn more at datatrue.com.
© 2026 DataTrue. US Website Tracking Benchmark 2026: The Consent Gap. Findings describe what our tests observed on 12 and 13 October 2026. This report is for information only and is not legal advice.