Today we published The Consent Gap, DataTrue's US Website Tracking Benchmark 2026. It asks a simple question: when a visitor tells a website not to sell or share their data, does the website listen?
What did we test?
We tested 242 of the most visited US websites across five industries: retail, healthcare, banking, higher education and media. Each site was loaded three ways in October 2026. First with no choice made, then with the browser's Global Privacy Control (GPC) signal switched on, and then after clicking the site's own reject button where there was one.
GPC is a browser setting that tells every site the visitor does not want their data sold or shared. Under California law, honoring it is an alternative to a homepage opt-out link. We recorded every tag, cookie and network request, and verified the opt-out results by hand.
What did we find?
- 43% of sites (104 of 242) failed our core privacy tests outright. They load ad tracking before any choice, give no obvious way to opt out, and keep tracking with GPC on.
- 80% of sites with ad tracking had no obvious opt-out. Only 48 of all 242 sites put a clear reject button on the banner a visitor sees on arrival.
- 76% of sites with ad tracking did not fully honor GPC. They kept sending data to ad companies with the signal switched on.
- On 20 of 24 sites with a visible reject button, ad companies were still contacted after it was clicked.
- 32% of sites started session replay on arrival, recording clicks and scrolls before the visitor had made any choice.
Does clicking reject stop the tracking?
Usually not. We scored this test only where a visitor sees a reject button on arrival and the site loads ad tracking. After the click, 20 of those 24 sites still contacted ad companies, and 16 still set advertising cookies.
A reject button is a promise to the visitor. If the tags behind it are not tied to that choice, the button changes nothing.
The Consent Gap, DataTrue
How do the industries compare?
Banking sites failed the core tests most often, at 56%. Hospital sites loaded the least ad tech, but where they did, the visitor's signal barely changed anything: 14 of the 18 hospital sites that load ad tracking changed nothing at all with GPC on. Media sites contacted the most ad companies by far, with a median of 37 per site.
What does good look like?
Three sites that load ad tracking passed every test we ran, so the standard is achievable. The report sets out five practices that close the gap:
- Put a clear choice on the first screen.
- Make GPC switch off every tag that sells or shares data.
- Test that reject actually stops the tracking.
- Hold session replay until the visitor agrees.
- Remove what you no longer use.
Read the full report
The Consent Gap includes the full methodology, an industry scorecard and 12 exhibits.
Read the report or download the PDF.
Findings describe what our tests observed on 12 and 13 October 2026. This post is for information only and is not legal advice.