{"id":228099,"date":"2026-10-28T12:30:22","date_gmt":"2026-10-28T12:30:22","guid":{"rendered":"https:\/\/datatrue.com\/?page_id=228099"},"modified":"2026-10-28T12:30:41","modified_gmt":"2026-10-28T12:30:41","slug":"the-consent-gap-2026","status":"publish","type":"page","link":"https:\/\/datatrue.com\/en\/research\/the-consent-gap-2026\/","title":{"rendered":"The Consent Gap"},"content":{"rendered":"<p>[et_pb_section fb_built=&#8221;1&#8243; theme_builder_area=&#8221;post_content&#8221; _builder_version=&#8221;4.17.3&#8243; _module_preset=&#8221;default&#8221; custom_padding=&#8221;0px||0px||false|false&#8221; hover_enabled=&#8221;0&#8243; sticky_enabled=&#8221;0&#8243;][et_pb_row _builder_version=&#8221;4.17.3&#8243; _module_preset=&#8221;default&#8221; theme_builder_area=&#8221;post_content&#8221; custom_padding=&#8221;0px||0px||false|false&#8221; width=&#8221;100%&#8221; hover_enabled=&#8221;0&#8243; sticky_enabled=&#8221;0&#8243;][et_pb_column _builder_version=&#8221;4.17.3&#8243; _module_preset=&#8221;default&#8221; type=&#8221;4_4&#8243; theme_builder_area=&#8221;post_content&#8221;][et_pb_code _builder_version=&#8221;4.17.3&#8243; _module_preset=&#8221;default&#8221; theme_builder_area=&#8221;post_content&#8221; hover_enabled=&#8221;0&#8243; sticky_enabled=&#8221;0&#8243;]<!-- [et_pb_line_break_holder] --><!-- DataTrue report page | \/en\/research\/the-consent-gap-2026\/ (parent: Research) | paste into one Divi Code module, full width, section and row padding 0.<!-- [et_pb_line_break_holder] -->     EMBARGOED: keep as a draft until Wednesday Oct 28. Publish by hand at about 8:50am ET, not with the scheduler.<!-- [et_pb_line_break_holder] -->     Before publishing, upload to WordPress media (Tuesday is fine; nothing links to them until the page is live):<!-- [et_pb_line_break_holder] -->       DataTrue-US-Website-Tracking-Benchmark-2026.pdf   (from AFA\/benchmark-2026\/report\/)<!-- [et_pb_line_break_holder] -->       DataTrue-Consent-Gap-Highlights.pdf               (from AFA\/benchmark-2026\/launch\/, the version WITHOUT &#8220;EMBARGOED&#8221;)<!-- [et_pb_line_break_holder] -->     If WordPress gives a different URL than \/wp-content\/uploads\/2026\/10\/<file>, find and replace it here.<!-- [et_pb_line_break_holder] -->     Yoast title: The Consent Gap: US Website Tracking Benchmark 2026 | DataTrue<!-- [et_pb_line_break_holder] -->     Meta description: DataTrue tested 242 leading US websites. 43% failed core privacy tests, and on 20 of 24 sites, clicking reject didn&#8217;t stop ad tracking. Read the report.<!-- [et_pb_line_break_holder] -->     Social image (Yoast > Social, Facebook and X): consent-gap-2026-og.png (1200 x 630)<!-- [et_pb_line_break_holder] -->     Content is the final report text (same as the PDF). Styles are scoped to .dtr. Charts are drawn by the script at the bottom. &#8211;><!-- [et_pb_line_break_holder] --><link rel=\"stylesheet\" href=\"https:\/\/fonts.googleapis.com\/css2?family=Lato:wght@400;700;900&#038;family=Work+Sans:wght@400;500;600&#038;family=IBM+Plex+Mono:wght@500;600&#038;display=swap\"><!-- [et_pb_line_break_holder] --><\/p>\n<style><!-- [et_pb_line_break_holder] -->.dtr{--ink:#242923; --ink-soft:#55605A; --ink-faint:#7D877F;<!-- [et_pb_line_break_holder] -->  --mint:#0EA173; --mint-fill:#10B981; --mint-tint:#F3FAF7;<!-- [et_pb_line_break_holder] -->  --teal:#4C7E93; --teal-tint:#EAF2F4;<!-- [et_pb_line_break_holder] -->  --bg:#FFFFFF; --bg-alt:#F6F8F7; --border:#DCE7E2; --rule:#E8EEEB;<!-- [et_pb_line_break_holder] -->  --cover:#1E2420; --cover-fg:#F0F4F2; --cover-soft:#A9B5AE;<!-- [et_pb_line_break_holder] -->  <!-- [et_pb_line_break_holder] -->  --k-crit:#B4232A; --k-warn:#E29A2B; --k-mid:#A3ABBA; --k-good:#1E9B57; --k-good2:#9FD8B5; --k-cat2:#9CB8EE;<!-- [et_pb_line_break_holder] -->  --k-bar:#33498C; --k-track:#EDF0F5; --k-on:#FFFFFF; --k-on-warn:#2A2310;<!-- [et_pb_line_break_holder] -->  --heat0:#F3F5F9; --heat1:#F8D9D4; --heat2:#EFA79F; --heat3:#D9675F; --heat4:#B4232A;<!-- [et_pb_line_break_holder] -->  --f-display:\"Lato\",system-ui,-apple-system,\"Segoe UI\",Arial,sans-serif;<!-- [et_pb_line_break_holder] -->  --f-body:\"Work Sans\",system-ui,-apple-system,\"Segoe UI\",Arial,sans-serif;<!-- [et_pb_line_break_holder] -->  --f-mono:\"IBM Plex Mono\",ui-monospace,\"SFMono-Regular\",Menlo,Consolas,monospace;}<!-- [et_pb_line_break_holder] -->.dtr,.dtr *{box-sizing:border-box}<!-- [et_pb_line_break_holder] -->@media (prefers-reduced-motion: reduce){.dtr,.dtr *{transition:none!important;animation:none!important}}<!-- [et_pb_line_break_holder] -->.dtr{background:var(--bg);color:var(--ink);font-family:var(--f-body);font-size:17px;line-height:1.65;-webkit-font-smoothing:antialiased}<!-- [et_pb_line_break_holder] -->.dtr .wrap{max-width:1104px;margin:0 auto;padding-inline:32px}<!-- [et_pb_line_break_holder] -->.dtr .col{max-width:680px}<!-- [et_pb_line_break_holder] -->.dtr h1,.dtr h2,.dtr h3,.dtr h4{font-family:var(--f-display);text-wrap:balance;margin:0;color:var(--ink)}<!-- [et_pb_line_break_holder] -->.dtr p{margin:0}<!-- [et_pb_line_break_holder] -->.dtr a{color:var(--mint);text-underline-offset:3px}<!-- [et_pb_line_break_holder] -->.dtr a:focus-visible,.dtr button:focus-visible{outline:2px solid var(--mint);outline-offset:3px;border-radius:3px}<!-- [et_pb_line_break_holder] -->.dtr .mono{font-family:var(--f-mono);text-transform:uppercase;letter-spacing:.08em;font-size:12px;font-weight:600}<!-- [et_pb_line_break_holder] -->.dtr .num{font-variant-numeric:tabular-nums}<!-- [et_pb_line_break_holder] -->.dtr .cover{background:var(--cover);color:var(--cover-fg)}<!-- [et_pb_line_break_holder] -->.dtr .cover .wrap{padding-block:44px 64px;display:grid;grid-template-columns:minmax(0,1.15fr) minmax(0,1fr);gap:56px;align-items:end}<!-- [et_pb_line_break_holder] -->.dtr .cover .logo{height:30px;width:auto;display:block;margin-bottom:72px}<!-- [et_pb_line_break_holder] -->.dtr .cover .kicker{color:var(--mint-fill);margin-bottom:18px}<!-- [et_pb_line_break_holder] -->.dtr .cover h1{color:var(--cover-fg);font-size:clamp(44px,7vw,80px);font-weight:900;line-height:1.02;letter-spacing:-.025em}<!-- [et_pb_line_break_holder] -->.dtr .cover .sub{color:var(--cover-soft);font-size:19px;line-height:1.55;margin-top:22px;max-width:34ch}<!-- [et_pb_line_break_holder] -->.dtr .cover .meta{display:flex;flex-wrap:wrap;gap:8px 22px;margin-top:36px;color:var(--cover-soft)}<!-- [et_pb_line_break_holder] -->.dtr .cover .meta span{font-size:11px}<!-- [et_pb_line_break_holder] -->.dtr .cover-stat{border-top:1px solid #3A443E;padding-top:22px}<!-- [et_pb_line_break_holder] -->.dtr .cover-stat .big{font-family:var(--f-display);font-weight:900;font-size:clamp(84px,12vw,140px);line-height:.9;letter-spacing:-.04em;color:var(--cover-fg)}<!-- [et_pb_line_break_holder] -->.dtr .cover-stat .big small{font-size:.45em;letter-spacing:-.02em}<!-- [et_pb_line_break_holder] -->.dtr .cover-stat p{color:var(--cover-fg);font-size:18px;line-height:1.5;margin-top:16px;max-width:30ch}<!-- [et_pb_line_break_holder] -->.dtr .cover-stat .foot{color:var(--cover-soft);font-size:13px;margin-top:12px}<!-- [et_pb_line_break_holder] -->.dtr section{padding-block:88px}<!-- [et_pb_line_break_holder] -->.dtr section + section{border-top:1px solid var(--rule)}<!-- [et_pb_line_break_holder] -->.dtr section.alt{background:var(--bg-alt)}<!-- [et_pb_line_break_holder] -->.dtr .eyebrow{color:var(--mint);display:flex;gap:10px;align-items:center;margin-bottom:16px}<!-- [et_pb_line_break_holder] -->.dtr .eyebrow b{color:var(--ink-faint);font-weight:600}<!-- [et_pb_line_break_holder] -->.dtr h2{font-size:clamp(30px,4.2vw,44px);font-weight:900;line-height:1.1;letter-spacing:-.015em}<!-- [et_pb_line_break_holder] -->.dtr .lede{font-size:21px;line-height:1.5;color:var(--ink);margin-top:20px;font-family:var(--f-body)}<!-- [et_pb_line_break_holder] -->.dtr .prose{display:grid;gap:18px;margin-top:28px;color:var(--ink-soft)}<!-- [et_pb_line_break_holder] -->.dtr .prose strong{color:var(--ink);font-weight:600}<!-- [et_pb_line_break_holder] -->.dtr h3{font-size:22px;font-weight:900;line-height:1.25}<!-- [et_pb_line_break_holder] -->.dtr .findings{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,300px),1fr));gap:0;margin-top:48px;border-top:1px solid var(--border)}<!-- [et_pb_line_break_holder] -->.dtr .finding{padding:26px 28px 30px 0;border-bottom:1px solid var(--border);display:grid;gap:10px;align-content:start}<!-- [et_pb_line_break_holder] -->.dtr .finding .n{font-family:var(--f-display);font-weight:900;font-size:56px;line-height:1;letter-spacing:-.03em;color:var(--ink)}<!-- [et_pb_line_break_holder] -->.dtr .finding .n.crit{color:var(--k-crit)}<!-- [et_pb_line_break_holder] -->.dtr .finding p{color:var(--ink-soft);font-size:16px;line-height:1.55}<!-- [et_pb_line_break_holder] -->.dtr .finding p strong{color:var(--ink);font-weight:600}<!-- [et_pb_line_break_holder] -->.dtr .passline{margin-top:36px;display:flex;gap:18px;align-items:center;flex-wrap:wrap;padding:20px 24px;background:var(--mint-tint);border-radius:12px}<!-- [et_pb_line_break_holder] -->.dtr .passline .n{font-family:var(--f-display);font-weight:900;font-size:34px;color:var(--mint)}<!-- [et_pb_line_break_holder] -->.dtr .passline p{color:var(--ink);font-size:16px;flex:1;min-width:220px}<!-- [et_pb_line_break_holder] -->.dtr .exhibit{margin-top:48px;padding-top:20px;border-top:1px solid var(--ink)}<!-- [et_pb_line_break_holder] -->.dtr .exhibit .ex-label{color:var(--ink-faint)}<!-- [et_pb_line_break_holder] -->.dtr .exhibit h4{font-size:19px;font-weight:900;margin-top:6px;line-height:1.3}<!-- [et_pb_line_break_holder] -->.dtr .exhibit .ex-sub{color:var(--ink-soft);font-size:14.5px;margin-top:4px}<!-- [et_pb_line_break_holder] -->.dtr .exhibit .chart{margin-top:24px}<!-- [et_pb_line_break_holder] -->.dtr .exhibit .src{color:var(--ink-faint);font-size:12.5px;line-height:1.5;margin-top:18px;max-width:80ch}<!-- [et_pb_line_break_holder] -->.dtr .legend{display:flex;flex-wrap:wrap;gap:8px 20px;font-size:13px;color:var(--ink-soft);margin-top:16px}<!-- [et_pb_line_break_holder] -->.dtr .legend span{display:inline-flex;align-items:center;gap:8px}<!-- [et_pb_line_break_holder] -->.dtr .legend i{width:12px;height:12px;border-radius:2px;display:inline-block}<!-- [et_pb_line_break_holder] -->.dtr .srow{display:grid;grid-template-columns:150px minmax(0,1fr) 52px;gap:16px;align-items:center;margin-top:12px}<!-- [et_pb_line_break_holder] -->.dtr .srow .lab{font-size:14.5px;color:var(--ink);font-weight:500;line-height:1.3}<!-- [et_pb_line_break_holder] -->.dtr .srow .lab small{display:block;color:var(--ink-faint);font-weight:400;font-size:12px}<!-- [et_pb_line_break_holder] -->.dtr .srow .tot{font-size:12.5px;color:var(--ink-faint);text-align:right}<!-- [et_pb_line_break_holder] -->.dtr .sbar{display:flex;height:34px;border-radius:3px;overflow:hidden;background:var(--k-track)}<!-- [et_pb_line_break_holder] -->.dtr .sbar div{display:flex;align-items:center;justify-content:center;font-size:12.5px;font-weight:600;color:var(--k-on);min-width:0;overflow:hidden;white-space:nowrap}<!-- [et_pb_line_break_holder] -->.dtr .sbar div.dk{color:var(--k-on-warn)}<!-- [et_pb_line_break_holder] -->.dtr .srow.total .lab{font-weight:700}<!-- [et_pb_line_break_holder] -->.dtr .srow.total{margin-top:20px;padding-top:16px;border-top:1px dashed var(--border)}<!-- [et_pb_line_break_holder] -->.dtr .brow{display:grid;grid-template-columns:150px minmax(0,1fr) 96px;gap:16px;align-items:center;margin-top:10px}<!-- [et_pb_line_break_holder] -->.dtr .brow .lab{font-size:14.5px;font-weight:500}<!-- [et_pb_line_break_holder] -->.dtr .brow .track{height:22px;background:var(--k-track);border-radius:3px;overflow:hidden}<!-- [et_pb_line_break_holder] -->.dtr .brow .track span{display:block;height:100%;background:var(--k-bar)}<!-- [et_pb_line_break_holder] -->.dtr .brow .track span.hl{background:var(--k-crit)}<!-- [et_pb_line_break_holder] -->.dtr .brow .v{font-family:var(--f-display);font-weight:900;font-size:18px;text-align:right}<!-- [et_pb_line_break_holder] -->.dtr .brow .v small{display:block;font-family:var(--f-body);font-weight:400;font-size:11.5px;color:var(--ink-faint)}<!-- [et_pb_line_break_holder] -->.dtr .waffle-wrap{display:grid;grid-template-columns:minmax(0,1.5fr) minmax(0,1fr);gap:40px;align-items:center}<!-- [et_pb_line_break_holder] -->.dtr .waffle{display:grid;grid-template-columns:repeat(22,1fr);gap:4px}<!-- [et_pb_line_break_holder] -->.dtr .waffle i{aspect-ratio:1;border-radius:2px;display:block}<!-- [et_pb_line_break_holder] -->.dtr .wlegend{display:grid;gap:18px}<!-- [et_pb_line_break_holder] -->.dtr .wlegend div{display:grid;grid-template-columns:14px 1fr auto;gap:12px;align-items:start}<!-- [et_pb_line_break_holder] -->.dtr .wlegend i{width:14px;height:14px;border-radius:2px;margin-top:5px}<!-- [et_pb_line_break_holder] -->.dtr .wlegend b{display:block;font-size:15.5px;color:var(--ink)}<!-- [et_pb_line_break_holder] -->.dtr .wlegend span{font-size:13.5px;color:var(--ink-soft);line-height:1.45}<!-- [et_pb_line_break_holder] -->.dtr .wlegend em{font-style:normal;font-family:var(--f-display);font-weight:900;font-size:22px;color:var(--ink)}<!-- [et_pb_line_break_holder] -->.dtr .wlegend em small{display:block;text-align:right;font-family:var(--f-body);font-weight:400;font-size:12px;color:var(--ink-faint)}<!-- [et_pb_line_break_holder] -->.dtr .units{display:grid;grid-template-columns:repeat(12,minmax(0,1fr));gap:8px;max-width:560px}<!-- [et_pb_line_break_holder] -->.dtr .units i{aspect-ratio:1;border-radius:50%;display:block}<!-- [et_pb_line_break_holder] -->.dtr .defs{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:24px;margin-top:40px}<!-- [et_pb_line_break_holder] -->.dtr .def{border-top:4px solid;padding-top:14px}<!-- [et_pb_line_break_holder] -->.dtr .def h3{font-size:17px}<!-- [et_pb_line_break_holder] -->.dtr .def p{color:var(--ink-soft);font-size:15px;margin-top:6px;line-height:1.55}<!-- [et_pb_line_break_holder] -->.dtr .callout{margin-top:44px;padding:26px 30px;border-left:4px solid var(--teal);background:var(--teal-tint);border-radius:0 12px 12px 0}<!-- [et_pb_line_break_holder] -->.dtr .callout.mint{border-color:var(--mint);background:var(--mint-tint)}<!-- [et_pb_line_break_holder] -->.dtr .callout .mono{color:var(--teal);margin-bottom:10px}<!-- [et_pb_line_break_holder] -->.dtr .callout.mint .mono{color:var(--mint)}<!-- [et_pb_line_break_holder] -->.dtr .callout p{color:var(--ink);font-size:16px;line-height:1.6}<!-- [et_pb_line_break_holder] -->.dtr .callout p + p{margin-top:10px}<!-- [et_pb_line_break_holder] -->.dtr .callout small{display:block;color:var(--ink-faint);font-size:12.5px;margin-top:12px}<!-- [et_pb_line_break_holder] -->.dtr .quote{margin-top:48px;font-family:var(--f-display);font-weight:900;font-size:clamp(24px,3vw,32px);line-height:1.25;letter-spacing:-.01em;max-width:26ch;color:var(--ink)}<!-- [et_pb_line_break_holder] -->.dtr .quote::before{content:\"\";display:block;width:48px;height:4px;background:var(--mint);margin-bottom:18px}<!-- [et_pb_line_break_holder] -->.dtr .stakes{display:grid;gap:0;margin-top:28px}<!-- [et_pb_line_break_holder] -->.dtr .stake{display:grid;grid-template-columns:minmax(0,280px) minmax(0,1fr);gap:32px;padding:32px 0;border-bottom:1px solid var(--border)}<!-- [et_pb_line_break_holder] -->.dtr .stake-h a{color:var(--mint);text-decoration:none}<!-- [et_pb_line_break_holder] -->.dtr .stake-h h3{font-size:22px;margin-top:8px}<!-- [et_pb_line_break_holder] -->.dtr .stake-h p{color:var(--ink-soft);font-size:15px;margin-top:8px;line-height:1.55}<!-- [et_pb_line_break_holder] -->.dtr .cases{display:grid;grid-template-columns:repeat(auto-fill,minmax(min(100%,250px),1fr));gap:16px}<!-- [et_pb_line_break_holder] -->.dtr .case{background:var(--bg-alt);border:1px solid var(--border);border-radius:12px;padding:18px 20px;display:flex;flex-direction:column;gap:8px}<!-- [et_pb_line_break_holder] -->.dtr .case-top{display:flex;justify-content:space-between;align-items:baseline;gap:10px;flex-wrap:wrap}<!-- [et_pb_line_break_holder] -->.dtr .case-top b{font-family:var(--f-display);font-weight:900;font-size:28px;letter-spacing:-.02em;color:var(--ink)}<!-- [et_pb_line_break_holder] -->.dtr .case-top span{font-size:10.5px;color:var(--ink-faint)}<!-- [et_pb_line_break_holder] -->.dtr .case .who{font-size:12.5px;color:var(--teal);font-weight:600}<!-- [et_pb_line_break_holder] -->.dtr .case p{font-size:14px;line-height:1.55;color:var(--ink-soft)}<!-- [et_pb_line_break_holder] -->.dtr .case a,.dtr .record a{font-size:13px;margin-top:auto}<!-- [et_pb_line_break_holder] -->.dtr .record .links{display:flex;gap:16px}<!-- [et_pb_line_break_holder] -->.dtr .record{margin-top:32px;padding:18px 22px;border:1px solid var(--border);border-radius:12px;background:var(--bg);max-width:680px;display:grid;gap:8px}<!-- [et_pb_line_break_holder] -->.dtr .record .mono{color:var(--teal);font-size:11px}<!-- [et_pb_line_break_holder] -->.dtr .record p{font-size:14.5px;color:var(--ink-soft);line-height:1.55}<!-- [et_pb_line_break_holder] -->@media (max-width:900px){.dtr .stake{grid-template-columns:1fr;gap:18px}}<!-- [et_pb_line_break_holder] -->.dtr .strip{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:20px 24px;margin-top:44px;border-top:1px solid var(--border);border-bottom:1px solid var(--border);padding-block:22px 24px}<!-- [et_pb_line_break_holder] -->.dtr .strip b{display:block;font-family:var(--f-display);font-weight:900;font-size:40px;line-height:1.05;letter-spacing:-.02em}<!-- [et_pb_line_break_holder] -->.dtr .strip span{display:block;color:var(--ink-soft);font-size:14px;line-height:1.45;margin-top:6px}<!-- [et_pb_line_break_holder] -->.dtr .tscroll{overflow-x:auto}<!-- [et_pb_line_break_holder] -->.dtr table.heat{border-collapse:separate;border-spacing:3px;width:100%;min-width:640px;font-size:14px}<!-- [et_pb_line_break_holder] -->.dtr table.heat th{font-family:var(--f-mono);font-weight:600;font-size:11px;text-transform:uppercase;letter-spacing:.06em;color:var(--ink-faint);text-align:center;padding:6px 8px;vertical-align:bottom;line-height:1.35}<!-- [et_pb_line_break_holder] -->.dtr table.heat th:first-child{text-align:left}<!-- [et_pb_line_break_holder] -->.dtr table.heat td{text-align:center;padding:12px 8px;border-radius:3px;font-variant-numeric:tabular-nums;font-weight:600}<!-- [et_pb_line_break_holder] -->.dtr table.heat td:first-child{text-align:left;font-weight:600;background:none;padding-left:0}<!-- [et_pb_line_break_holder] -->.dtr table.heat tr.all td{font-weight:800}<!-- [et_pb_line_break_holder] -->.dtr table.heat tr.all td:first-child{border-top:none}<!-- [et_pb_line_break_holder] -->.dtr .spot{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,1.2fr);gap:48px;margin-top:56px;padding:40px;border:1px solid var(--border);border-radius:14px;background:var(--bg)}<!-- [et_pb_line_break_holder] -->.dtr .spot .tag{color:var(--k-crit)}<!-- [et_pb_line_break_holder] -->.dtr .spot h3{font-size:26px;margin-top:10px}<!-- [et_pb_line_break_holder] -->.dtr .spot p{color:var(--ink-soft);margin-top:12px;font-size:16px}<!-- [et_pb_line_break_holder] -->.dtr .spot .grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:22px 28px;align-content:center}<!-- [et_pb_line_break_holder] -->.dtr .spot .grid b{display:block;font-family:var(--f-display);font-weight:900;font-size:38px;line-height:1;color:var(--ink)}<!-- [et_pb_line_break_holder] -->.dtr .spot .grid b.crit{color:var(--k-crit)}<!-- [et_pb_line_break_holder] -->.dtr .spot .grid span{display:block;font-size:14px;color:var(--ink-soft);margin-top:6px;line-height:1.45}<!-- [et_pb_line_break_holder] -->.dtr .practices{display:grid;gap:0;margin-top:44px;border-top:1px solid var(--border)}<!-- [et_pb_line_break_holder] -->.dtr .practice{display:grid;grid-template-columns:64px minmax(0,1fr);gap:20px;padding:26px 0;border-bottom:1px solid var(--border)}<!-- [et_pb_line_break_holder] -->.dtr .practice .i{font-family:var(--f-display);font-weight:900;font-size:30px;color:var(--mint);line-height:1}<!-- [et_pb_line_break_holder] -->.dtr .practice h3{font-size:20px}<!-- [et_pb_line_break_holder] -->.dtr .practice p{color:var(--ink-soft);margin-top:6px;font-size:16px}<!-- [et_pb_line_break_holder] -->.dtr .method{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:36px 48px;margin-top:40px}<!-- [et_pb_line_break_holder] -->.dtr .method .mcol{display:grid;gap:36px;align-content:start}<!-- [et_pb_line_break_holder] -->.dtr .method h3{font-size:17px}<!-- [et_pb_line_break_holder] -->.dtr .method p,.dtr .method li{color:var(--ink-soft);font-size:15px;line-height:1.6}<!-- [et_pb_line_break_holder] -->.dtr .method p{margin-top:8px}<!-- [et_pb_line_break_holder] -->.dtr .method ul{margin:8px 0 0;padding-left:18px;display:grid;gap:6px}<!-- [et_pb_line_break_holder] -->.dtr .method ul.totals{list-style:none;padding:0;margin-top:10px;gap:0}<!-- [et_pb_line_break_holder] -->.dtr .method ul.totals li{display:grid;grid-template-columns:72px 1fr;gap:12px;align-items:baseline;padding:8px 0;border-bottom:1px solid var(--border)}<!-- [et_pb_line_break_holder] -->.dtr .method ul.totals b{font-family:var(--f-display);font-weight:900;font-size:22px;color:var(--ink)}<!-- [et_pb_line_break_holder] -->.dtr table.tests{width:100%;border-collapse:collapse;margin-top:12px;font-size:14.5px}<!-- [et_pb_line_break_holder] -->.dtr table.tests td{padding:12px 12px 12px 0;border-bottom:1px solid var(--border);vertical-align:top;color:var(--ink-soft)}<!-- [et_pb_line_break_holder] -->.dtr table.tests td:first-child{font-weight:600;color:var(--ink);width:34%}<!-- [et_pb_line_break_holder] -->.dtr .toc{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,220px),1fr));gap:2px 32px;margin-top:40px}<!-- [et_pb_line_break_holder] -->.dtr .toc a{display:grid;grid-template-columns:32px 1fr;gap:8px;padding:12px 0;border-bottom:1px solid var(--border);text-decoration:none;color:var(--ink);font-weight:500;font-size:15.5px}<!-- [et_pb_line_break_holder] -->.dtr .toc a span{font-family:var(--f-mono);font-size:12px;color:var(--mint);padding-top:3px}<!-- [et_pb_line_break_holder] -->.dtr .toc a:hover{color:var(--mint)}<!-- [et_pb_line_break_holder] -->.dtr .gloss{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,340px),1fr));gap:20px 32px;margin-top:20px}<!-- [et_pb_line_break_holder] -->.dtr .gloss b{display:block;font-size:15px;color:var(--ink)}<!-- [et_pb_line_break_holder] -->.dtr .gloss span{display:block;font-size:14px;color:var(--ink-soft);line-height:1.5;margin-top:2px}<!-- [et_pb_line_break_holder] -->.dtr .about{display:grid;grid-template-columns:minmax(0,220px) minmax(0,1fr);gap:48px;align-items:start;border-top:2px solid var(--ink);padding-top:32px}<!-- [et_pb_line_break_holder] -->.dtr .about p{max-width:none}<!-- [et_pb_line_break_holder] -->.dtr .about .logo{width:100%;max-width:200px;height:auto}<!-- [et_pb_line_break_holder] -->.dtr .about p{color:var(--ink-soft);font-size:16px}<!-- [et_pb_line_break_holder] -->.dtr .about p + p{margin-top:14px}<!-- [et_pb_line_break_holder] -->.dtr .dtr-foot{background:var(--cover);color:var(--cover-soft);font-size:13px;line-height:1.6}<!-- [et_pb_line_break_holder] -->.dtr .dtr-foot .wrap{padding-block:40px;display:flex;flex-wrap:wrap;gap:16px 40px;justify-content:space-between}<!-- [et_pb_line_break_holder] -->.dtr .dtr-foot p{max-width:70ch}<!-- [et_pb_line_break_holder] -->.dtr .logo-light{display:none}<!-- [et_pb_line_break_holder] -->@media (max-width:900px){.dtr .cover .wrap{grid-template-columns:1fr;gap:40px}<!-- [et_pb_line_break_holder] -->.dtr .cover .logo{margin-bottom:44px}<!-- [et_pb_line_break_holder] -->.dtr .waffle-wrap,.dtr .spot,.dtr .about{grid-template-columns:1fr;gap:32px}<!-- [et_pb_line_break_holder] -->.dtr .defs{grid-template-columns:1fr}<!-- [et_pb_line_break_holder] -->.dtr .method{grid-template-columns:1fr}<!-- [et_pb_line_break_holder] -->.dtr .strip{grid-template-columns:repeat(2,minmax(0,1fr))}}<!-- [et_pb_line_break_holder] -->@media (max-width:600px){.dtr{font-size:16px}<!-- [et_pb_line_break_holder] -->.dtr .wrap{padding-inline:18px}<!-- [et_pb_line_break_holder] -->.dtr section{padding-block:60px}<!-- [et_pb_line_break_holder] -->.dtr .lede{font-size:18.5px}<!-- [et_pb_line_break_holder] -->.dtr .srow,.dtr .brow{grid-template-columns:minmax(0,1fr) auto;gap:6px 12px}<!-- [et_pb_line_break_holder] -->.dtr .srow .lab,.dtr .brow .lab{grid-column:1 \/ -1}<!-- [et_pb_line_break_holder] -->.dtr .srow .sbar,.dtr .brow .track{grid-column:1}<!-- [et_pb_line_break_holder] -->.dtr .waffle{gap:3px}<!-- [et_pb_line_break_holder] -->.dtr .spot{padding:24px}<!-- [et_pb_line_break_holder] -->.dtr .spot .grid b{font-size:32px}<!-- [et_pb_line_break_holder] -->.dtr .callout{padding:20px 20px}<!-- [et_pb_line_break_holder] -->.dtr .practice{grid-template-columns:40px minmax(0,1fr);gap:12px}<!-- [et_pb_line_break_holder] -->.dtr .finding{padding-right:0}<!-- [et_pb_line_break_holder] -->.dtr .units{gap:6px}}<!-- [et_pb_line_break_holder] -->.dtr{margin:0;overflow-x:clip}<!-- [et_pb_line_break_holder] -->.dtr p,.dtr h1,.dtr h2,.dtr h3,.dtr h4,.dtr li{padding-bottom:0}<!-- [et_pb_line_break_holder] -->.dtr .crumb{display:flex;flex-wrap:wrap;gap:8px;align-items:center;color:var(--cover-soft);font-size:11px;margin-bottom:56px}<!-- [et_pb_line_break_holder] -->.dtr .crumb a{color:var(--mint-fill);text-decoration:none}<!-- [et_pb_line_break_holder] -->.dtr .actions{display:flex;flex-wrap:wrap;gap:12px;margin-top:32px}<!-- [et_pb_line_break_holder] -->.dtr .btn{display:inline-flex;align-items:center;gap:8px;background:var(--mint-fill);color:#fff;font-family:var(--f-display);font-weight:700;font-size:15px;border-radius:8px;padding:13px 20px;text-decoration:none;line-height:1.3}<!-- [et_pb_line_break_holder] -->.dtr .btn:hover{background:#0C9A6E}<!-- [et_pb_line_break_holder] -->.dtr .btn.ghost{background:transparent;color:var(--cover-fg);border:1px solid #4A564F}<!-- [et_pb_line_break_holder] -->.dtr .btn.ghost:hover{border-color:var(--mint-fill)}<!-- [et_pb_line_break_holder] -->.dtr .btn svg{width:15px;height:15px;flex-shrink:0}<!-- [et_pb_line_break_holder] -->.dtr section[id]{scroll-margin-top:90px}<!-- [et_pb_line_break_holder] -->.dtr #signal .quote{display:none}<!-- [et_pb_line_break_holder] -->.dtr .about-cta{margin-top:14px;font-weight:600}<!-- [et_pb_line_break_holder] -->.dtr .about-cta a{color:var(--mint);text-decoration:none}<!-- [et_pb_line_break_holder] -->@media (max-width:600px){.dtr .btn{width:100%;justify-content:center}.dtr .crumb{margin-bottom:32px}}<!-- [et_pb_line_break_holder] --><\/style>\n<p><!-- [et_pb_line_break_holder] --><\/p>\n<div class=\"dtr\"><!-- [et_pb_line_break_holder] --><\/p>\n<header class=\"cover\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div><!-- [et_pb_line_break_holder] -->      <\/p>\n<nav class=\"crumb mono\" aria-label=\"Breadcrumb\"><a href=\"\/en\/\">Home<\/a><span>\u203a<\/span><a href=\"https:\/\/datatrue.com\/en\/research\/\">Research<\/a><span>\u203a<\/span><span aria-current=\"page\">The Consent Gap<\/span><\/nav>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"kicker mono\">US Website Tracking Benchmark 2026<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h1>The Consent Gap<\/h1>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"sub\">How 242 of the most visited US websites handle a visitor&#8217;s choice to say no, and what tracking runs before anyone chooses.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"meta mono\"><span>October 2026<\/span><span>Retail \u00b7 Healthcare \u00b7 Banking \u00b7 Higher education \u00b7 Media<\/span><\/div>\n<div class=\"actions\"><a class=\"btn\" href=\"\/wp-content\/uploads\/2026\/10\/DataTrue-US-Website-Tracking-Benchmark-2026.pdf\" download>Download the full report (PDF) <svg viewBox=\"0 0 16 16\" fill=\"none\" aria-hidden=\"true\"><path d=\"M8 2.5v8M4.5 7 8 10.5 11.5 7M3 13.5h10\" stroke=\"currentColor\" stroke-width=\"1.6\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><\/a><a class=\"btn ghost\" href=\"\/wp-content\/uploads\/2026\/10\/DataTrue-Consent-Gap-Highlights.pdf\" download>2-page summary <svg viewBox=\"0 0 16 16\" fill=\"none\" aria-hidden=\"true\"><path d=\"M8 2.5v8M4.5 7 8 10.5 11.5 7M3 13.5h10\" stroke=\"currentColor\" stroke-width=\"1.6\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><\/a><\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"cover-stat\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"big num\">43<small>%<\/small><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <pee>of the leading US websites we tested failed our core privacy tests outright. They load ad tracking before any choice, give no obvious way to opt out, and keep tracking when the browser says no.<\/pee><!-- [et_pb_line_break_holder] -->      <pee class=\"foot num\">104 of 242 sites \u00b7 1,795 page loads \u00b7 244,395 network requests analyzed<\/pee><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/header>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<div class=\"dtr-main\"><!-- [et_pb_line_break_holder] --><\/p>\n<section id=\"summary\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"eyebrow mono\">Executive summary<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h2>Most leading websites make saying no hard, and many ignore it when visitors do<\/h2>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"lede\">California law gives people two ways to stop a website from selling or sharing their data: a clear opt-out on the site, or a signal their browser sends automatically. We tested both on 242 leading US websites in October 2026.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"prose\"><!-- [et_pb_line_break_holder] -->        <pee>We loaded every site three times: with no choice made, with the browser&#8217;s Global Privacy Control (GPC) signal switched on, and after clicking the site&#8217;s own reject button where there was one. We recorded every tag, cookie and network request, and verified the opt-out results by hand.<\/pee><!-- [et_pb_line_break_holder] -->        <pee>The result is a clear gap between what visitors are offered and what the sites actually do.<\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"findings\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"finding\">\n<div class=\"n crit num\">43%<\/div>\n<pee><strong>104 of 242 sites failed the core tests outright.<\/strong> They load ad tracking before any choice, give no obvious way to opt out, and keep tracking with GPC on. 64 of them offer no way to opt out at all.<\/pee><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"finding\">\n<div class=\"n crit num\">80%<\/div>\n<pee><strong>of sites with ad tracking have no obvious opt-out.<\/strong> Only 48 of all 242 sites put a clear reject button on the banner a visitor sees on arrival.<\/pee><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"finding\">\n<div class=\"n crit num\">76%<\/div>\n<pee><strong>of sites with ad tracking ignore the browser&#8217;s opt-out signal<\/strong>, fully or in part. They kept sending data to ad companies with GPC switched on.<\/pee><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"finding\">\n<div class=\"n crit num\">20 of 24<\/div>\n<pee><strong>sites with a visible reject button kept tracking after it was clicked.<\/strong> They still contacted ad companies, and 16 still set advertising cookies.<\/pee><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"finding\">\n<div class=\"n crit num\">32%<\/div>\n<pee><strong>of sites start session replay on arrival<\/strong>, recording clicks and scrolls before the visitor has made any choice.<\/pee><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"finding\">\n<div class=\"n num\">247<\/div>\n<pee><strong>ad, social and data companies<\/strong> are contacted by these sites before a visitor clicks anything. The median site with ad tracking contacts 7.<\/pee><\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"passline\">\n<div class=\"n num\">3 of 173<\/div>\n<pee>Only three sites that load ad tracking passed every test we ran: a clear reject that works, GPC honored, and no session replay before consent. The standard is achievable.<\/pee><\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<figure class=\"exhibit\" style=\"margin-inline:0\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"ex-label mono\">Exhibit 1<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h4>Where the 242 sites land<\/h4>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"ex-sub\">Each square is one website, grouped by its overall result.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"chart waffle-wrap\"><!-- [et_pb_line_break_holder] -->        <\/p>\n<div class=\"waffle\" id=\"waffle\" role=\"img\" aria-label=\"242 sites: 104 failed the core tests, 71 failed some tests, 64 had nothing to catch, 3 passed every test\"><\/div>\n<p><!-- [et_pb_line_break_holder] -->        <\/p>\n<div class=\"wlegend\"><!-- [et_pb_line_break_holder] -->          <\/p>\n<div><i style=\"background:var(--k-crit)\"><\/i><pee><b>Failed the core tests<\/b><span>Ad tracking, no obvious opt-out, GPC not fully honored<\/span><\/pee><em class=\"num\">104<small>43%<\/small><\/em><\/div>\n<p><!-- [et_pb_line_break_holder] -->          <\/p>\n<div><i style=\"background:var(--k-warn)\"><\/i><pee><b>Failed some tests<\/b><span>Passed at least one core test and failed another, or session replay only<\/span><\/pee><em class=\"num\">71<small>29%<\/small><\/em><\/div>\n<p><!-- [et_pb_line_break_holder] -->          <\/p>\n<div><i style=\"background:var(--k-mid)\"><\/i><pee><b>No ad tracking or replay<\/b><span>Nothing on the site that our tests could fail<\/span><\/pee><em class=\"num\">64<small>26%<\/small><\/em><\/div>\n<p><!-- [et_pb_line_break_holder] -->          <\/p>\n<div><i style=\"background:var(--k-good)\"><\/i><pee><b>Passed every test<\/b><span>Ad tracking, with a clear reject that works, GPC honored and no replay before consent<\/span><\/pee><em class=\"num\">3<small>1%<\/small><\/em><\/div>\n<p><!-- [et_pb_line_break_holder] -->        <\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] --><figcaption class=\"src\">Source: DataTrue US Website Tracking Benchmark 2026. n = 242 websites scanned 12 and 13 October 2026.<\/figcaption><!-- [et_pb_line_break_holder] -->    <\/figure>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\" style=\"margin-top:56px\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"eyebrow mono\">In this report<\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/p>\n<nav class=\"toc\" aria-label=\"Contents\"><!-- [et_pb_line_break_holder] -->      <a href=\"#stakes\"><span>00<\/span>Why these tests<\/a><!-- [et_pb_line_break_holder] -->      <a href=\"#choice\"><span>01<\/span>A clear choice is rare<\/a><!-- [et_pb_line_break_holder] -->      <a href=\"#signal\"><span>02<\/span>The signal most sites ignore<\/a><!-- [et_pb_line_break_holder] -->      <a href=\"#reject\"><span>03<\/span>When reject does not mean reject<\/a><!-- [et_pb_line_break_holder] -->      <a href=\"#replay\"><span>04<\/span>Recording before anyone agrees<\/a><!-- [et_pb_line_break_holder] -->      <a href=\"#industries\"><span>05<\/span>How the industries compare<\/a><!-- [et_pb_line_break_holder] -->      <a href=\"#behind\"><span>06<\/span>What runs behind the page<\/a><!-- [et_pb_line_break_holder] -->      <a href=\"#upkeep\"><span>07<\/span>Signs of neglect<\/a><!-- [et_pb_line_break_holder] -->      <a href=\"#practices\"><span>08<\/span>What good looks like<\/a><!-- [et_pb_line_break_holder] -->      <a href=\"#method\"><span>09<\/span>Methodology<\/a><!-- [et_pb_line_break_holder] -->    <\/nav>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"callout\" style=\"margin-top:48px\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"mono\">Terms used in this report<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"gloss\"><!-- [et_pb_line_break_holder] -->        <pee><b>Ad tracking<\/b><span>Sending visitor data to ad tech, social, audience-data or ID companies, the kind of transfer California regulators would likely treat as selling or sharing.<\/span><\/pee><!-- [et_pb_line_break_holder] -->        <pee><b>Global Privacy Control (GPC)<\/b><span>A browser setting that tells every site the visitor does not want their data sold or shared. Under California law, honoring it is an alternative to a homepage opt-out link.<\/span><\/pee><!-- [et_pb_line_break_holder] -->        <pee><b>Obvious opt-out<\/b><span>A button worded as a clear no, such as &#8220;Reject all&#8221;, &#8220;Decline&#8221; or &#8220;Accept only essential&#8221;, on a banner visible when the page loads.<\/span><\/pee><!-- [et_pb_line_break_holder] -->        <pee><b>Session replay<\/b><span>Tools that record a visitor&#8217;s clicks, scrolls and typing so a site can play the visit back later.<\/span><\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/section>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<section id=\"stakes\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"eyebrow mono\">Context <b>Why these tests<\/b><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h2>Each test reflects a behavior regulators and courts have already acted on<\/h2>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"lede\">Every test in this benchmark relates to conduct that has already led to fines, civil penalties or settlements in the United States.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"prose\"><pee>The cases below are drawn from public regulator orders, press releases and court records. They describe what each regulator or court said. Settlements are not admissions of wrongdoing.<\/pee><\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"stakes\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"stake\">\n<div class=\"stake-h\"><a class=\"mono\" href=\"#choice\">Cases related to chapter 01: Opting out<\/a><\/p>\n<h3>No obvious opt-out<\/h3>\n<pee>California regulators have fined companies for making the opt-out harder than saying yes.<\/pee><\/div>\n<div class=\"cases\">\n<article class=\"case\">\n<div class=\"case-top\"><b class=\"num\">$632,500<\/b><span class=\"mono\">Fine<\/span><\/div>\n<pee class=\"who\">CPPA (now CalPrivacy) \u00b7 March 2025<\/pee><pee>The CPPA ordered Honda to pay a $632,500 fine. The order describes a cookie tool where accepting all took one click and opting out took at least two. Honda did not admit liability.<\/pee><a href=\"https:\/\/privacy.ca.gov\/2025\/03\/honda-settles-with-cppa-over-privacy-violations\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/article>\n<article class=\"case\">\n<div class=\"case-top\"><b class=\"num\">$1.1M<\/b><span class=\"mono\">Fine<\/span><\/div>\n<pee class=\"who\">CalPrivacy \u00b7 March 2026<\/pee><pee>CalPrivacy ordered PlayOn Sports to pay a $1.1 million fine. The order says ticket holders had to click &#8220;Agree&#8221; to tracking before they could use their tickets, were pointed to industry opt-out tools instead of PlayOn&#8217;s own, and had their opt-out preference signals ignored.<\/pee><a href=\"https:\/\/privacy.ca.gov\/2026\/03\/youth-sports-media-company-to-pay-1-1-million-fine-change-practices-over-privacy-violations\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/article>\n<\/div>\n<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"stake\">\n<div class=\"stake-h\"><a class=\"mono\" href=\"#signal\">Cases related to chapter 02: Global Privacy Control<\/a><\/p>\n<h3>GPC not honored<\/h3>\n<pee>California regulators have penalized companies that did not honor opt-out preference signals such as GPC.<\/pee><\/div>\n<div class=\"cases\">\n<article class=\"case\">\n<div class=\"case-top\"><b class=\"num\">$1.2M<\/b><span class=\"mono\">Penalties, settlement<\/span><\/div>\n<pee class=\"who\">California Attorney General \u00b7 August 2022<\/pee><pee>In 2022 Sephora agreed to pay $1.2 million in penalties to settle California Attorney General allegations that third-party tracking on its website and app amounted to a sale of shopper data, which it did not disclose and did not stop when shoppers opted out through GPC.<\/pee><a href=\"https:\/\/oag.ca.gov\/news\/press-releases\/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/article>\n<article class=\"case\">\n<div class=\"case-top\"><b class=\"num\">$1.35M<\/b><span class=\"mono\">Fine<\/span><\/div>\n<pee class=\"who\">CPPA (now CalPrivacy) \u00b7 September 2025<\/pee><pee>The CPPA ordered Tractor Supply to pay a $1.35 million fine. The order says its opt-out webform did not stop the third-party tracking technologies used for advertising, and that the site did not honor opt-out preference signals such as GPC until July 2024.<\/pee><a href=\"https:\/\/cppa.ca.gov\/announcements\/2025\/20250930.html\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/article>\n<\/div>\n<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"stake\">\n<div class=\"stake-h\"><a class=\"mono\" href=\"#reject\">Cases related to chapter 03: After the click<\/a><\/p>\n<h3>Tracking after reject<\/h3>\n<pee>Regulators have acted where a banner or opt-out form did not actually stop the tags behind it.<\/pee><\/div>\n<div class=\"cases\">\n<article class=\"case\">\n<div class=\"case-top\"><b class=\"num\">$1.55M<\/b><span class=\"mono\">Civil penalties, settlement<\/span><\/div>\n<pee class=\"who\">California Attorney General \u00b7 July 2025<\/pee><pee>Healthline agreed to $1.55 million in civil penalties in a July 2025 settlement with the California Attorney General, which said its consent banner did not disable tracking cookies, sharing continued after opt-out, and article titles suggesting a diagnosis were shared with advertisers.<\/pee><a href=\"https:\/\/oag.ca.gov\/news\/press-releases\/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/article>\n<article class=\"case\">\n<div class=\"case-top\"><b class=\"num\">13 sites<\/b><span class=\"mono\">Review, no penalty<\/span><\/div>\n<pee class=\"who\">New York Attorney General \u00b7 July 2024<\/pee><pee>The New York Attorney General said a review of 13 high-traffic websites, mostly well-known e-commerce sites, found marketing tags that stayed active after visitors used the sites&#8217; privacy controls, often because tags were miscategorized or hardcoded. All of the companies fixed the issues.<\/pee><a href=\"https:\/\/ag.ny.gov\/resources\/organizations\/business-guidance\/website-privacy-controls\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/article>\n<\/div>\n<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"stake\">\n<div class=\"stake-h\"><a class=\"mono\" href=\"#replay\">Cases related to chapter 04: Session replay<\/a><\/p>\n<h3>Tracking before consent<\/h3>\n<pee>Trackers running without consent have been the basis of wiretap and privacy class actions.<\/pee><\/div>\n<div class=\"cases\">\n<article class=\"case\">\n<div class=\"case-top\"><b class=\"num\">$3.85M<\/b><span class=\"mono\">Class settlement<\/span><\/div>\n<pee class=\"who\">U.S. District Court, N.D. Cal. \u00b7 June 2026<\/pee><pee>A federal court granted final approval of a $3.85 million settlement of claims that the LA Times ran the TripleLift, GumGum and Audiencerate trackers without consent, in violation of CIPA&#8217;s pen-register provision. An objector has appealed to the Ninth Circuit.<\/pee><a href=\"https:\/\/latimescipasettlement.com\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/article>\n<\/div>\n<\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <pee class=\"src\" style=\"color:var(--ink-faint);font-size:12.5px;margin-top:24px;max-width:80ch\">Amounts are shown as each source describes them. A fine, civil penalties and a class settlement are different things, so we do not add them together. Cases checked against primary sources between September and October 2026.<\/pee><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/section>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<section id=\"choice\" class=\"alt\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"eyebrow mono\">01 <b>Opting out<\/b><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h2>A clear choice is rare<\/h2>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"lede\">Fewer than one in five sites with ad tracking puts a clear way to say no in front of visitors.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"prose\"><!-- [et_pb_line_break_holder] -->        <pee>We sorted every site into one of three groups, based on what a visitor sees when the homepage loads. Opt-out results were verified by hand in a US browser with no stored cookies.<\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"defs\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"def\" style=\"border-color:var(--k-good)\">\n<h3>Obvious option<\/h3>\n<pee>A &#8220;Reject all&#8221;, &#8220;Decline&#8221; or &#8220;Accept only essential&#8221; button on a banner that is visible on arrival.<\/pee><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"def\" style=\"border-color:var(--k-warn)\">\n<h3>Possible but not obvious<\/h3>\n<pee>A way out exists, but the visitor has to find it: a &#8220;Cookie settings&#8221; or &#8220;Your Privacy Choices&#8221; link, a settings panel, or banner wording that stops short of a plain no.<\/pee><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"def\" style=\"border-color:var(--k-crit)\">\n<h3>No option<\/h3>\n<pee>No reject on a banner, no settings route and no opt-out link found on the homepage.<\/pee><\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<figure class=\"exhibit\" style=\"margin-inline:0\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"ex-label mono\">Exhibit 2<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h4>Only 34 of 173 sites with ad tracking offer an obvious opt-out<\/h4>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"ex-sub\">Opt-out available to a visitor on arrival. Number of sites.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"chart\" id=\"ex2\"><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"legend\"><span><i style=\"background:var(--k-good)\"><\/i>Obvious option<\/span><span><i style=\"background:var(--k-warn)\"><\/i>Possible but not obvious<\/span><span><i style=\"background:var(--k-crit)\"><\/i>No option<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] --><figcaption class=\"src\">Source: DataTrue US Website Tracking Benchmark 2026. Opt-out results verified by hand.<\/figcaption><!-- [et_pb_line_break_holder] -->    <\/figure>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"prose\"><!-- [et_pb_line_break_holder] -->        <pee>Among the 173 sites that load ad tracking, <strong>72 offered no route out at all<\/strong> and 67 had one that a visitor would have to go looking for. Most banners that offered no way to say no told visitors that continuing to use the site meant they agreed.<\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"callout\"><!-- [et_pb_line_break_holder] -->        <\/p>\n<div class=\"mono\">Why the middle group matters<\/div>\n<p><!-- [et_pb_line_break_holder] -->        <pee>An opt-out that sits behind a settings link is a grey area that courts have not yet tested much. Wording that stops short of a plain no can also be read as unclear. The safest position for any business is a clear option on the first screen, and tracking that stops when a visitor uses it.<\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<aside class=\"record\">\n<div class=\"mono\">On the record \u00b7 CPPA (now CalPrivacy) \u00b7 March 2025<\/div>\n<pee>The CPPA ordered Honda to pay a $632,500 fine. The order describes a cookie tool where accepting all took one click and opting out took at least two.<\/pee><a href=\"https:\/\/privacy.ca.gov\/2025\/03\/honda-settles-with-cppa-over-privacy-violations\/\" target=\"_blank\" rel=\"noopener\">Source<\/a> <a href=\"#stakes\">More cases<\/a><\/aside>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<figure class=\"exhibit\" style=\"margin-inline:0\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"ex-label mono\">Exhibit 3<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h4>Media hides the opt-out, higher education and healthcare often skip it<\/h4>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"ex-sub\">Opt-out available on arrival, by industry. All sites. Number of sites.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"chart\" id=\"ex3\"><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"legend\"><span><i style=\"background:var(--k-good)\"><\/i>Obvious option<\/span><span><i style=\"background:var(--k-warn)\"><\/i>Possible but not obvious<\/span><span><i style=\"background:var(--k-crit)\"><\/i>No option<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] --><figcaption class=\"src\">Many higher education and healthcare sites with no option load little or no ad tracking. Of the sites with ad tracking, 25 of 35 universities and 13 of 18 hospitals offered no option at all.<\/figcaption><!-- [et_pb_line_break_holder] -->    <\/figure>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"callout mint\"><!-- [et_pb_line_break_holder] -->        <\/p>\n<div class=\"mono\">What the law asks for<\/div>\n<p><!-- [et_pb_line_break_holder] -->        <pee>Under the California Consumer Privacy Act (CCPA), a business that sells or shares personal information must either post a clear and conspicuous &#8220;Do Not Sell or Share My Personal Information&#8221; link on its homepage, or honor opt-out preference signals such as GPC (<a href=\"https:\/\/leginfo.legislature.ca.gov\/faces\/codes_displaySection.xhtml?lawCode=CIV&amp;sectionNum=1798.135\" target=\"_blank\" rel=\"noopener\">Cal. Civ. Code 1798.135<\/a>).<\/pee><!-- [et_pb_line_break_holder] -->        <pee><strong>95 of the 173 sites with ad tracking had neither<\/strong>: no homepage link with that title or the shorter &#8220;Your Privacy Choices&#8221;, and no full support for GPC.<\/pee><!-- [et_pb_line_break_holder] -->        <small>Our obvious opt-out test is stricter than the statute&#8217;s link requirement. It asks whether a visitor can say no from the first screen. Nothing in this report is legal advice or a finding about any organization&#8217;s compliance.<\/small><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/section>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<section id=\"signal\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"eyebrow mono\">02 <b>Global Privacy Control<\/b><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h2>The signal most sites ignore<\/h2>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"lede\">Three in four sites with ad tracking kept sending data to ad companies when the browser said no.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"prose\"><!-- [et_pb_line_break_holder] -->        <pee>GPC lets a visitor opt out once, in the browser, instead of on every site. We loaded each site with GPC off and again with it on. With GPC on, <strong>129 of 169 sites with ad tracking<\/strong> still contacted at least one ad or data-sharing company. On 107 of them, half or more of the ad companies seen without GPC were still there.<\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<figure class=\"exhibit\" style=\"margin-inline:0\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"ex-label mono\">Exhibit 4<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h4>GPC tends to work completely or barely at all<\/h4>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"ex-sub\">What happened to each site&#8217;s ad companies when GPC was switched on. Sites with ad tracking where GPC was confirmed.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"chart\" id=\"ex4\"><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"legend\"><span><i style=\"background:var(--k-good)\"><\/i>Stopped all ad tracking<\/span><span><i style=\"background:var(--k-good2)\"><\/i>Cut more than half<\/span><span><i style=\"background:var(--k-warn)\"><\/i>Cut some<\/span><span><i style=\"background:var(--k-crit)\"><\/i>No change<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] --><figcaption class=\"src\">Source: DataTrue US Website Tracking Benchmark 2026. n = 169 sites with ad tracking and GPC confirmed. Each comparison is two separate page loads, and ad auctions vary between loads.<\/figcaption><!-- [et_pb_line_break_holder] -->    <\/figure>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"prose\"><!-- [et_pb_line_break_holder] -->        <pee>Only 40 sites stopped all ad tracking. 66 changed nothing. On the 63 sites in between, ad exchanges were the vendors most often dropped, while the largest ad platforms most often kept firing.<\/pee><!-- [et_pb_line_break_holder] -->        <pee>The same ad company stopped on one site and kept firing on the next. That points to how each site placed its tags. A likely cause is tags added outside the consent setup, where the consent tool cannot switch them off. A consent tool was installed on 51 of the 129 sites that did not fully honor GPC.<\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->        <\/p>\n<aside class=\"record\">\n<div class=\"mono\">On the record \u00b7 CPPA (now CalPrivacy) \u00b7 September 2025<\/div>\n<pee>The CPPA ordered Tractor Supply to pay a $1.35 million fine. The order says the site did not honor opt-out preference signals such as GPC until July 2024.<\/pee><a href=\"https:\/\/cppa.ca.gov\/announcements\/2025\/20250930.html\" target=\"_blank\" rel=\"noopener\">Source<\/a> <a href=\"#stakes\">More cases<\/a><\/aside>\n<p><!-- [et_pb_line_break_holder] -->    <pee class=\"quote\">Hospital sites changed least. 14 of the 18 that load ad tracking changed nothing at all with GPC on.<\/pee><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/section>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<section id=\"reject\" class=\"alt\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"eyebrow mono\">03 <b>After the click<\/b><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h2>When reject does not mean reject<\/h2>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"lede\">On 20 of the 24 sites where we could click a visible reject button, ad companies were still contacted afterwards.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"prose\"><!-- [et_pb_line_break_holder] -->        <pee>We scored this test only where a visitor sees a reject button on arrival and the site loads ad tracking. After the click, <strong>20 sites (83%) still contacted ad companies<\/strong> and 16 still set advertising cookies.<\/pee><!-- [et_pb_line_break_holder] -->        <pee>It happened in every industry: higher education 6 of 6, retail 7 of 8, banks 5 of 6, media 1 of 3 and healthcare 1 of 1.<\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<figure class=\"exhibit\" style=\"margin-inline:0\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"ex-label mono\">Exhibit 5<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h4>83% kept tracking after the visitor clicked reject<\/h4>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"ex-sub\">Sites with ad tracking and a reject button visible on arrival. Each circle is one site.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"chart\">\n<div class=\"units\" id=\"units\" role=\"img\" aria-label=\"20 of 24 sites still contacted ad companies after reject\"><\/div>\n<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"legend\"><span><i style=\"background:var(--k-crit);border-radius:50%\"><\/i>Still contacted ad companies (20)<\/span><span><i style=\"background:var(--k-good);border-radius:50%\"><\/i>Stopped (4)<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] --><figcaption class=\"src\">Source: DataTrue US Website Tracking Benchmark 2026. n = 24. Ten more sites with ad tracking and an obvious reject are not included because their reject was not clicked during the automated scan.<\/figcaption><!-- [et_pb_line_break_holder] -->    <\/figure>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"prose\"><!-- [et_pb_line_break_holder] -->        <pee>We saw the same pattern on 24 sites where the only way out was the consent tool&#8217;s settings panel. After switching everything off there, <strong>17 of the 24 still contacted ad companies<\/strong>.<\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<aside class=\"record\">\n<div class=\"mono\">On the record \u00b7 California Attorney General \u00b7 July 2025<\/div>\n<pee>Healthline agreed to $1.55 million in civil penalties in a July 2025 settlement with the California Attorney General, which said its consent banner did not disable tracking cookies and sharing continued after opt-out.<\/pee><a href=\"https:\/\/oag.ca.gov\/news\/press-releases\/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155\" target=\"_blank\" rel=\"noopener\">Source<\/a> <a href=\"#stakes\">More cases<\/a><\/aside>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"quote\">A reject button is a promise to the visitor. If the tags behind it are not tied to that choice, the button changes nothing.<\/pee><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/section>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<section id=\"replay\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"eyebrow mono\">04 <b>Session replay<\/b><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h2>Recording before anyone agrees<\/h2>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"lede\">One in three sites started session replay as soon as the page loaded.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"prose\"><!-- [et_pb_line_break_holder] -->        <pee>Session replay tools record clicks, scrolls and form interactions so teams can watch how people use a page. <strong>77 of 242 sites (32%)<\/strong> started one on arrival, before the visitor had made any choice, and 63 of those offered no obvious way to opt out.<\/pee><!-- [et_pb_line_break_holder] -->        <pee>Session replay has been the subject of wiretap lawsuits under California&#8217;s Invasion of Privacy Act (CIPA). Recording a visit before consent also carries a reputational cost if visitors learn about it.<\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<figure class=\"exhibit\" style=\"margin-inline:0\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"ex-label mono\">Exhibit 6<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h4>Retail, banks and universities record the most visits on arrival<\/h4>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"ex-sub\">Share of sites that start session replay before any choice.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"chart\" id=\"ex7\"><\/div>\n<p><!-- [et_pb_line_break_holder] --><figcaption class=\"src\">Source: DataTrue US Website Tracking Benchmark 2026. n = 242. Some sites run more than one replay tool.<\/figcaption><!-- [et_pb_line_break_holder] -->    <\/figure>\n<p><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/section>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<section id=\"industries\" class=\"alt\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"eyebrow mono\">05 <b>Industry view<\/b><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h2>How the industries compare<\/h2>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"lede\">Banks fail the core tests most often. Hospitals load the least ad tech, but barely respond to a visitor&#8217;s signal where they do.<\/pee><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<figure class=\"exhibit\" style=\"margin-inline:0\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"ex-label mono\">Exhibit 7<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h4>Industry scorecard<\/h4>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"ex-sub\">Darker cells mean a weaker result. Shares of sites, except the last column.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"chart tscroll\" id=\"ex8\"><\/div>\n<p><!-- [et_pb_line_break_holder] --><figcaption class=\"src\">Source: DataTrue US Website Tracking Benchmark 2026. Core test failure and session replay are shares of all sites. No obvious opt-out is a share of sites with ad tracking. GPC is a share of sites with ad tracking where GPC was confirmed.<\/figcaption><!-- [et_pb_line_break_holder] -->    <\/figure>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<figure class=\"exhibit\" style=\"margin-inline:0\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"ex-label mono\">Exhibit 8<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h4>More than half of bank sites fail the core tests<\/h4>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"ex-sub\">Overall result by industry. Number of sites.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"chart\" id=\"ex9\"><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"legend\"><span><i style=\"background:var(--k-crit)\"><\/i>Failed the core tests<\/span><span><i style=\"background:var(--k-warn)\"><\/i>Failed some tests<\/span><span><i style=\"background:var(--k-mid)\"><\/i>No ad tracking or replay<\/span><span><i style=\"background:var(--k-good)\"><\/i>Passed every test<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] --><figcaption class=\"src\">Source: DataTrue US Website Tracking Benchmark 2026. n = 242.<\/figcaption><!-- [et_pb_line_break_holder] -->    <\/figure>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"spot\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div><!-- [et_pb_line_break_holder] -->        <\/p>\n<div class=\"tag mono\">Spotlight \u00b7 Healthcare<\/div>\n<p><!-- [et_pb_line_break_holder] -->        <\/p>\n<h3>Less ad tech, but little response to the visitor&#8217;s choice<\/h3>\n<p><!-- [et_pb_line_break_holder] -->        <pee>Hospital sites run far less ad tech than any other industry. Where they do run it, the visitor&#8217;s signal barely changes anything. Visits to a hospital site can reveal something about a person&#8217;s health, which makes this group worth a closer look.<\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"grid\"><!-- [et_pb_line_break_holder] -->        <\/p>\n<div><b class=\"num\">18 of 50<\/b><span>contact ad or social companies before any choice<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] -->        <\/p>\n<div><b class=\"crit num\">14 of 18<\/b><span>change nothing at all with GPC switched on<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] -->        <\/p>\n<div><b class=\"crit num\">7%<\/b><span>drop in ad domains with GPC on, the smallest of any industry<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] -->        <\/p>\n<div><b class=\"num\">9 of 50<\/b><span>start session replay on arrival<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/p>\n<aside class=\"record\">\n<div class=\"mono\">On the record \u00b7 U.S. District Court, N.D. Cal. \u00b7 July 2026<\/div>\n<pee>In July 2026 a federal court granted final approval of a settlement of about $47.5 million, resolving claims that third-party code on Kaiser Permanente&#8217;s logged-in websites and apps shared members&#8217; information, including health topics they searched. Kaiser denied wrongdoing. As of September 2026, a motion by some opt-out claimants to amend the approval order was pending, so the final figure could change.<\/pee><a href=\"https:\/\/kaiserprivacysettlement.com\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/aside>\n<p><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/section>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<section id=\"behind\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"eyebrow mono\">06 <b>Ad tech and tracking<\/b><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h2>What runs behind the page<\/h2>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"lede\">Before a visitor clicks anything, these 242 sites contact 247 different ad, social and data companies between them.<\/pee><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"strip\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div><b class=\"num\">247<\/b><span>ad, social and data companies contacted before any choice<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div><b class=\"num\">7<\/b><span>ad companies on the median site with ad tracking<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div><b class=\"num\">101<\/b><span>ad companies on the busiest single site<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div><b class=\"num\">1,138<\/b><span>third-party domains contacted before any choice, 273 of them for ad tracking<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<figure class=\"exhibit\" style=\"margin-inline:0\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"ex-label mono\">Exhibit 9<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h4>Media sites run nearly four times the ad tech of the next industry<\/h4>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"ex-sub\">Ad companies contacted by the median site with ad tracking, before any choice.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"chart\" id=\"ex10\"><\/div>\n<p><!-- [et_pb_line_break_holder] --><figcaption class=\"src\">Source: DataTrue US Website Tracking Benchmark 2026. n = 173 sites with ad tracking.<\/figcaption><!-- [et_pb_line_break_holder] -->    <\/figure>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<h3 style=\"margin-top:56px\">Ad companies that bring in more ad companies<\/h3>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"prose\"><!-- [et_pb_line_break_holder] -->        <pee>A site adds one ad tag, and that tag calls in other ad companies the site never loaded itself. This happened on <strong>79 of 173 sites with ad tracking (46%)<\/strong>. At least 27% of all contacts with ad companies came through another ad company, and one chain of requests ran 14 steps deep.<\/pee><!-- [et_pb_line_break_holder] -->        <pee>These second-hand vendors matter for consent. A site can only switch off what it knows is there.<\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<figure class=\"exhibit\" style=\"margin-inline:0\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"ex-label mono\">Exhibit 10<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h4>On three in four media sites, ad companies call in more ad companies<\/h4>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"ex-sub\">Share of sites with ad tracking where at least one ad company was brought in by another.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"chart\" id=\"ex11\"><\/div>\n<p><!-- [et_pb_line_break_holder] --><figcaption class=\"src\">Source: DataTrue US Website Tracking Benchmark 2026. A minimum: the request that called another was recorded for about 64% of ad requests.<\/figcaption><!-- [et_pb_line_break_holder] -->    <\/figure>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<figure class=\"exhibit\" style=\"margin-inline:0\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"ex-label mono\">Exhibit 11<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h4>Each industry runs its own analytics stack<\/h4>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"ex-sub\">Analytics platform detected, by industry. Number of sites.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"chart\" id=\"ex12\"><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"legend\"><span><i style=\"background:var(--k-bar)\"><\/i>Google Analytics 4 only<\/span><span><i style=\"background:var(--k-cat2)\"><\/i>Both<\/span><span><i style=\"background:var(--teal)\"><\/i>Adobe Analytics only<\/span><span><i style=\"background:var(--k-mid)\"><\/i>Neither detected<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] --><figcaption class=\"src\">Source: DataTrue US Website Tracking Benchmark 2026. n = 242. Google Tag Manager runs on 57% of sites, and 11% run two or more tag managers.<\/figcaption><!-- [et_pb_line_break_holder] -->    <\/figure>\n<p><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/section>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<section id=\"upkeep\" class=\"alt\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"eyebrow mono\">07 <b>Tag hygiene<\/b><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h2>Signs of neglect<\/h2>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"lede\">One in five sites shows signs that nobody is cleaning up the tag setup.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"prose\"><!-- [et_pb_line_break_holder] -->        <pee><strong>36 sites (15%) still load the retired Universal Analytics script.<\/strong> It sends nothing, so on its own it is harmless. It is a sign that old tags are not being removed, and old tags for vendors a company no longer works with can still be sending visitor data. 27 of these 36 sites load ad tracking, and 23 of them do not fully honor GPC.<\/pee><!-- [et_pb_line_break_holder] -->        <pee><strong>20 sites (8%) send the same page view twice or more<\/strong> to Google Analytics 4 or Meta, up to five copies on one page. Some setups do this on purpose. When it is a mistake, it inflates traffic and conversion figures that marketing budgets rely on.<\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"strip\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div><b class=\"num\">15%<\/b><span>still load a retired analytics script<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div><b class=\"num\">8%<\/b><span>possibly count the same page view twice<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div><b class=\"num\">38%<\/b><span>load 20 or more tags, up to 63 on one site<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div><b class=\"num\">39%<\/b><span>of GA4 sites send data to more than one GA4 property<\/span><\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] -->    <\/p>\n<figure class=\"exhibit\" style=\"margin-inline:0\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"ex-label mono\">Exhibit 12<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h4>Banks show the most signs of untidy tagging<\/h4>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"ex-sub\">Share of sites with a retired script still loading or possible double counting.<\/pee><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"chart\" id=\"ex13\"><\/div>\n<p><!-- [et_pb_line_break_holder] --><figcaption class=\"src\">Source: DataTrue US Website Tracking Benchmark 2026. n = 242. 52 sites in total (21%).<\/figcaption><!-- [et_pb_line_break_holder] -->    <\/figure>\n<p><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/section>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<section id=\"practices\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"eyebrow mono\">08 <b>Recommendations<\/b><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h2>What good looks like<\/h2>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"lede\">The three sites that passed every test show the standard is reachable. Five practices help close the gap.<\/pee><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"practices col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"practice\">\n<div class=\"i\">1<\/div>\n<div>\n<h3>Put a clear choice on the first screen<\/h3>\n<pee>Show &#8220;Reject all&#8221; beside &#8220;Accept all&#8221;, with the same size and weight. Do not rely on &#8220;by continuing you agree&#8221; wording or a link to a settings page.<\/pee><\/div>\n<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"practice\">\n<div class=\"i\">2<\/div>\n<div>\n<h3>Make GPC switch off every tag that sells or shares data<\/h3>\n<pee>Treat the signal as an opt-out for the whole page, including tags loaded outside the tag manager and vendors that other tags call in.<\/pee><\/div>\n<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"practice\">\n<div class=\"i\">3<\/div>\n<div>\n<h3>Test that reject actually stops the tracking<\/h3>\n<pee>Check what the page sends after a visitor says no, in every consent state, after every release and on a regular schedule. Tags change without anyone touching the banner.<\/pee><\/div>\n<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"practice\">\n<div class=\"i\">4<\/div>\n<div>\n<h3>Hold session replay until the visitor agrees<\/h3>\n<pee>Start recording only after consent, and mask form fields that could capture personal information.<\/pee><\/div>\n<\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"practice\">\n<div class=\"i\">5<\/div>\n<div>\n<h3>Remove what you no longer use<\/h3>\n<pee>Retired scripts, duplicate properties and forgotten pixels add data flows nobody is watching. A regular tag audit keeps the list short.<\/pee><\/div>\n<\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><pee style=\"color:var(--ink-faint);font-size:13.5px;margin-top:20px\">Teams should confirm with their own counsel how these practices apply to their sites and data.<\/pee><\/div>\n<p><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/section>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<section id=\"method\" class=\"alt\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"col\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"eyebrow mono\">09 <b>Methodology<\/b><\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<h2>How we ran the benchmark<\/h2>\n<p><!-- [et_pb_line_break_holder] -->      <pee class=\"lede\">242 websites, three scans each, opt-out results verified by hand.<\/pee><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"method\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"mcol\"><!-- [et_pb_line_break_holder] -->        <\/p>\n<div><!-- [et_pb_line_break_holder] -->        <\/p>\n<h3>Sample<\/h3>\n<p><!-- [et_pb_line_break_holder] -->          <pee>Up to 50 sites per industry, in rank order from public lists: retail (NRF, 2026), healthcare (Becker&#8217;s, patient-facing sites), banking (Federal Reserve large banks, 30 June 2026), higher education (U.S. News, 2027) and media (Press Gazette, JustWatch, Semrush). Media has 42 sites. DataTrue customers were excluded, and no site is named. 84 of the 326 sites we tried (26%) blocked automated scanning and were replaced by the next site on the list.<\/pee><!-- [et_pb_line_break_holder] -->        <\/div>\n<p><!-- [et_pb_line_break_holder] -->        <\/p>\n<div><!-- [et_pb_line_break_holder] -->        <\/p>\n<h3>The four tests<\/h3>\n<p><!-- [et_pb_line_break_holder] -->          <\/p>\n<table class=\"tests\"><!-- [et_pb_line_break_holder] -->            <\/p>\n<tr>\n<td>GPC honored<\/td>\n<td>No ad tracking with GPC on. &#8220;Partly&#8221;: under half the ad companies seen without it.<\/td>\n<\/tr>\n<p><!-- [et_pb_line_break_holder] -->            <\/p>\n<tr>\n<td>Reject honored<\/td>\n<td>No ad tracking after clicking an obvious reject.<\/td>\n<\/tr>\n<p><!-- [et_pb_line_break_holder] -->            <\/p>\n<tr>\n<td>No replay before consent<\/td>\n<td>No session replay tool on arrival.<\/td>\n<\/tr>\n<p><!-- [et_pb_line_break_holder] -->            <\/p>\n<tr>\n<td>Obvious opt-out<\/td>\n<td>A clear reject, decline or essential-only button on a banner visible on arrival.<\/td>\n<\/tr>\n<p><!-- [et_pb_line_break_holder] -->          <\/table>\n<p><!-- [et_pb_line_break_holder] -->          <pee>The core tests are GPC honored and an obvious opt-out, applied to sites with ad tracking.<\/pee><!-- [et_pb_line_break_holder] -->        <\/div>\n<p><!-- [et_pb_line_break_holder] -->        <\/p>\n<div><!-- [et_pb_line_break_holder] -->        <\/p>\n<h3>Manual verification<\/h3>\n<p><!-- [et_pb_line_break_holder] -->          <pee>Every site scored as lacking an obvious opt-out was verified by hand in a US browser with no stored cookies. A sample of the domains classified as ad tracking was also reviewed.<\/pee><!-- [et_pb_line_break_holder] -->        <\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div class=\"mcol\"><!-- [et_pb_line_break_holder] -->        <\/p>\n<div><!-- [et_pb_line_break_holder] -->        <\/p>\n<h3>Scans<\/h3>\n<p><!-- [et_pb_line_break_holder] -->          <pee>Each site was scanned on 12 and 13 October 2026 (homepage and up to two linked pages) in three conditions: no choice made, GPC on, and after the site&#8217;s own opt-out. That produced 1,795 page loads, 244,395 network requests, 46,305 tag requests and 30,554 cookies. Across all scans we catalogued:<\/pee><!-- [et_pb_line_break_holder] -->          <\/p>\n<ul class=\"totals\"><!-- [et_pb_line_break_holder] -->            <\/p>\n<li><b class=\"num\">215<\/b> unique tags, 102 of them ad tracking tags<\/li>\n<p><!-- [et_pb_line_break_holder] -->            <\/p>\n<li><b class=\"num\">1,250<\/b> distinct third-party domains<\/li>\n<p><!-- [et_pb_line_break_holder] -->            <\/p>\n<li><b class=\"num\">273<\/b> ad tracking domains<\/li>\n<p><!-- [et_pb_line_break_holder] -->            <\/p>\n<li><b class=\"num\">247<\/b> ad, social and data companies behind those domains<\/li>\n<p><!-- [et_pb_line_break_holder] -->          <\/ul>\n<p><!-- [et_pb_line_break_holder] -->          <pee>Many ad domains are called in by other tags, so domains are the fuller measure of ad tracking.<\/pee><!-- [et_pb_line_break_holder] -->        <\/div>\n<p><!-- [et_pb_line_break_holder] -->        <\/p>\n<div><!-- [et_pb_line_break_holder] -->        <\/p>\n<h3>What counts as ad tracking<\/h3>\n<p><!-- [et_pb_line_break_holder] -->          <pee>Domains California regulators, litigants or past enforcement would treat as a sale or sharing: ad tech, cross-context advertising, ID graphs, audience data, and social and affiliate pixels. About 280 domains qualify. Analytics, consent tools, content delivery, chat, search, forms and monitoring do not. Google consent-mode &#8220;ads denied&#8221; signals count as honored.<\/pee><!-- [et_pb_line_break_holder] -->        <\/div>\n<p><!-- [et_pb_line_break_holder] -->        <\/p>\n<div><!-- [et_pb_line_break_holder] -->        <\/p>\n<h3>Limits<\/h3>\n<p><!-- [et_pb_line_break_holder] -->          <\/p>\n<ul><!-- [et_pb_line_break_holder] -->            <\/p>\n<li>One scan per condition. Ad auctions vary between loads, so totals and medians are more reliable than single sites.<\/li>\n<p><!-- [et_pb_line_break_holder] -->            <\/p>\n<li>Request chains and double counting are minimums.<\/li>\n<p><!-- [et_pb_line_break_holder] -->            <\/p>\n<li>Results describe what we observed on the scan dates. They are not legal advice or a compliance finding.<\/li>\n<p><!-- [et_pb_line_break_holder] -->          <\/ul>\n<p><!-- [et_pb_line_break_holder] -->        <\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/section>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<section id=\"about\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <\/p>\n<div class=\"about\"><!-- [et_pb_line_break_holder] -->      <\/p>\n<div><!-- [et_pb_line_break_holder] -->        <\/div>\n<p><!-- [et_pb_line_break_holder] -->      <\/p>\n<div><!-- [et_pb_line_break_holder] -->        <\/p>\n<div class=\"eyebrow mono\">About this research<\/div>\n<p><!-- [et_pb_line_break_holder] -->        <pee>DataTrue is a tag testing and monitoring platform for websites and mobile apps. It continuously tests live sites in real browser sessions, across the whole site and through key journeys like checkout and signup, in every consent state. DataTrue confirms that the tags a business depends on are firing correctly, from analytics to advertising and conversion tags, with no gaps and no double counting. It also catches tags that should not run, such as tracking that continues after a visitor opts out or personal data sent to the wrong place.<\/pee><!-- [et_pb_line_break_holder] -->        <pee>The scans in this benchmark used the same tests our customers run on their own sites. About a quarter of the sites we tried blocked our automated browser, which is common with bot protection. Customers add DataTrue to their allowlist so their own sites are tested every time. DataTrue gives marketing, analytics, privacy and legal teams evidence of what their site actually does, so they can decide what to change. Learn more at <a href=\"https:\/\/datatrue.com\/?utm_source=consent-gap-report&amp;utm_medium=pdf&amp;utm_campaign=us-tracking-benchmark-2026\" target=\"_blank\" rel=\"noopener\">datatrue.com<\/a>.<\/pee><!-- [et_pb_line_break_holder] -->        <pee class=\"about-cta\"><a href=\"https:\/\/datatrue.com\/en\/contact-us\/\">Talk to us about testing your own site<\/a> \u00b7 <a href=\"https:\/\/datatrue.com\/en\/newsroom\/\">Media resources<\/a><\/pee><!-- [et_pb_line_break_holder] -->      <\/div>\n<p><!-- [et_pb_line_break_holder] -->    <\/div>\n<p><!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/section>\n<p><!-- [et_pb_line_break_holder] --><\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/p>\n<div class=\"dtr-foot\"><!-- [et_pb_line_break_holder] -->  <\/p>\n<div class=\"wrap\"><!-- [et_pb_line_break_holder] -->    <pee>\u00a9 2026 DataTrue. US Website Tracking Benchmark 2026: The Consent Gap. Findings describe what our tests observed on 12 and 13 October 2026. This report is for information only and is not legal advice.<\/pee><!-- [et_pb_line_break_holder] -->    <!-- [et_pb_line_break_holder] -->  <\/div>\n<p><!-- [et_pb_line_break_holder] --><\/div>\n<p><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><!-- [et_pb_line_break_holder] --><\/div>\n<p><!-- [et_pb_line_break_holder] --><script><!-- [et_pb_line_break_holder] -->(function(){<!-- [et_pb_line_break_holder] -->  const C={crit:'var(--k-crit)',warn:'var(--k-warn)',mid:'var(--k-mid)',good:'var(--k-good)',good2:'var(--k-good2)',cat2:'var(--k-cat2)',bar:'var(--k-bar)',teal:'var(--teal)'};<!-- [et_pb_line_break_holder] -->  const dark=new Set(['warn','good2','cat2']);<!-- [et_pb_line_break_holder] -->  function stacked(el,rows,keys,names){<!-- [et_pb_line_break_holder] -->    const h=rows.map(r=>{<!-- [et_pb_line_break_holder] -->      const tot=r.v.reduce((a,b)=>a+b,0);<!-- [et_pb_line_break_holder] -->      const segs=r.v.map((v,i)=>{<!-- [et_pb_line_break_holder] -->        if(!v) return '';<!-- [et_pb_line_break_holder] -->        const pct=v\/tot*100;<!-- [et_pb_line_break_holder] -->        return `<\/p>\n<div class=\"${dark.has(keys[i])?'dk':''}\" style=\"flex:${v};background:${C[keys[i]]}\" title=\"${names[i]}: ${v} of ${tot} (${Math.round(pct)}%)\">${pct>=6?v:''}<\/div>\n<p>`;<!-- [et_pb_line_break_holder] -->      }).join('');<!-- [et_pb_line_break_holder] -->      return `<\/p>\n<div class=\"srow${r.total?' total':''}\">\n<div class=\"lab\">${r.n}${r.s?`<small>${r.s}<\/small>`:''}<\/div>\n<div class=\"sbar\" role=\"img\" aria-label=\"${r.n}: ${r.v.map((v,i)=>names[i]+' '+v).join(', ')}\">${segs}<\/div>\n<div class=\"tot num\">${tot}<\/div>\n<\/div>\n<p>`;<!-- [et_pb_line_break_holder] -->    }).join('');<!-- [et_pb_line_break_holder] -->    document.getElementById(el).innerHTML=h;<!-- [et_pb_line_break_holder] -->  }<!-- [et_pb_line_break_holder] -->  function bars(el,rows,max,fmt){<!-- [et_pb_line_break_holder] -->    document.getElementById(el).innerHTML=rows.map(r=>`<\/p>\n<div class=\"brow\">\n<div class=\"lab\">${r.n}<\/div>\n<div class=\"track\"><span class=\"${r.hl?'hl':''}\" style=\"width:${(r.v\/max*100).toFixed(1)}%\"><\/span><\/div>\n<div class=\"v num\">${fmt(r)}${r.s?`<small>${r.s}<\/small>`:''}<\/div>\n<\/div>\n<p>`).join('');<!-- [et_pb_line_break_holder] -->  }<!-- [et_pb_line_break_holder] -->  \/\/ Exhibit 1 waffle<!-- [et_pb_line_break_holder] -->  const W=document.getElementById('waffle');let wh='';<!-- [et_pb_line_break_holder] -->  [['crit',104],['warn',71],['mid',64],['good',3]].forEach(([k,n])=>{for(let i=0;i<n;i++)wh+=`<i style=\"background:${C[k]}\"><\/i>`});<!-- [et_pb_line_break_holder] -->  W.innerHTML=wh;<!-- [et_pb_line_break_holder] -->  const T3=['Obvious option','Possible but not obvious','No option'];<!-- [et_pb_line_break_holder] -->  stacked('ex2',[{n:'Sites with ad tracking',v:[34,67,72]},{n:'All sites',v:[48,86,108]}],['good','warn','crit'],T3);<!-- [et_pb_line_break_holder] -->  stacked('ex3',[<!-- [et_pb_line_break_holder] -->    {n:'Retail',v:[13,26,11]},{n:'Healthcare',v:[11,7,32]},{n:'Banking',v:[10,18,22]},<!-- [et_pb_line_break_holder] -->    {n:'Higher education',v:[9,5,36]},{n:'Media',v:[5,30,7]},{n:'All sites',v:[48,86,108],total:1}],['good','warn','crit'],T3);<!-- [et_pb_line_break_holder] -->  stacked('ex4',[<!-- [et_pb_line_break_holder] -->    {n:'Retail',v:[14,10,9,7]},{n:'Media',v:[10,2,10,9]},{n:'Banking',v:[10,7,9,19]},<!-- [et_pb_line_break_holder] -->    {n:'Higher education',v:[4,2,12,17]},{n:'Healthcare',v:[2,0,2,14]},{n:'All',v:[40,21,42,66],total:1}],<!-- [et_pb_line_break_holder] -->    ['good','good2','warn','crit'],['Stopped all ad tracking','Cut more than half','Cut some','No change']);<!-- [et_pb_line_break_holder] -->  \/\/ Exhibit 6 units<!-- [et_pb_line_break_holder] -->  let uh='';for(let i=0;i<24;i++)uh+=`<i style=\"background:${i<20?C.crit:C.good}\"><\/i>`;<!-- [et_pb_line_break_holder] -->  document.getElementById('units').innerHTML=uh;<!-- [et_pb_line_break_holder] -->  bars('ex7',[{n:'Retail',v:44,s:'22 of 50',hl:1},{n:'Banking',v:42,s:'21 of 50',hl:1},{n:'Higher education',v:40,s:'20 of 50',hl:1},{n:'Healthcare',v:18,s:'9 of 50'},{n:'Media',v:12,s:'5 of 42'},{n:'All sites',v:32,s:'77 of 242'}],50,r=>r.v+'%');<!-- [et_pb_line_break_holder] -->  \/\/ Exhibit 8 heat table<!-- [et_pb_line_break_holder] -->  const cols=['Fail the core tests','No obvious opt-out','GPC not fully honored','Session replay on arrival','Median ad companies per site'];<!-- [et_pb_line_break_holder] -->  const data=[['Retail',40,76,65,44,10],['Healthcare',28,83,89,18,1.5],['Banking',56,80,78,42,7],['Higher education',50,80,89,40,3],['Media',40,84,68,12,37],['All sites',43,80,76,32,7]];<!-- [et_pb_line_break_holder] -->  const lvl=v=>v>=85?4:v>=70?3:v>=50?2:v>=30?1:0;<!-- [et_pb_line_break_holder] -->  const lvlN=v=>v>=30?4:v>=10?2:v>=5?1:0;<!-- [et_pb_line_break_holder] -->  document.getElementById('ex8').innerHTML='<\/p>\n<table class=\"heat\">\n<thead>\n<tr>\n<th>Industry<\/th>\n<p>'+cols.map(c=>`<\/p>\n<th>${c}<\/th>\n<p>`).join('')+'<\/tr>\n<\/thead>\n<tbody>'+data.map((r,ri)=>`<\/p>\n<tr class=\"${ri===data.length-1?'all':''}\">\n<td>${r[0]}<\/td>\n<p>`+r.slice(1).map((v,i)=>{const L=i===4?lvlN(v):lvl(v);return `<\/p>\n<td style=\"background:var(--heat${L});color:${L>=3?'#FFFFFF':'var(--ink)'}\">${i===4?v:v+'%'}<\/td>\n<p>`}).join('')+'<\/tr>\n<p>').join('')+'<\/tbody>\n<\/table>\n<p>';<!-- [et_pb_line_break_holder] -->  stacked('ex9',[<!-- [et_pb_line_break_holder] -->    {n:'Banking',v:[28,17,4,1]},{n:'Higher education',v:[25,12,13,0]},{n:'Retail',v:[20,21,8,1]},<!-- [et_pb_line_break_holder] -->    {n:'Media',v:[17,14,10,1]},{n:'Healthcare',v:[14,7,29,0]},{n:'All sites',v:[104,71,64,3],total:1}],<!-- [et_pb_line_break_holder] -->    ['crit','warn','mid','good'],['Failed the core tests','Failed some tests','No ad tracking or replay','Passed every test']);<!-- [et_pb_line_break_holder] -->  bars('ex10',[{n:'Media',v:37,s:'max 101',hl:1},{n:'Retail',v:10,s:'max 44'},{n:'Banking',v:7,s:'max 46'},{n:'Higher education',v:3,s:'max 25'},{n:'Healthcare',v:1.5,s:'max 7'}],40,r=>r.v);<!-- [et_pb_line_break_holder] -->  bars('ex11',[{n:'Media',v:75,s:'24 of 32',hl:1},{n:'Banking',v:48,s:'22 of 46'},{n:'Retail',v:48,s:'20 of 42'},{n:'Higher education',v:31,s:'11 of 35'},{n:'Healthcare',v:11,s:'2 of 18'},{n:'All',v:46,s:'79 of 173'}],100,r=>r.v+'%');<!-- [et_pb_line_break_holder] -->  stacked('ex12',[<!-- [et_pb_line_break_holder] -->    {n:'Retail',v:[19,10,15,6]},{n:'Healthcare',v:[13,4,10,23]},{n:'Banking',v:[19,12,14,5]},<!-- [et_pb_line_break_holder] -->    {n:'Higher education',v:[46,0,0,4]},{n:'Media',v:[19,4,8,11]},{n:'All sites',v:[116,30,47,49],total:1}],<!-- [et_pb_line_break_holder] -->    ['bar','cat2','teal','mid'],['Google Analytics 4 only','Both','Adobe Analytics only','Neither detected']);<!-- [et_pb_line_break_holder] -->  bars('ex13',[{n:'Banking',v:32,s:'16 of 50',hl:1},{n:'Higher education',v:26,s:'13 of 50'},{n:'Media',v:26,s:'11 of 42'},{n:'Retail',v:16,s:'8 of 50'},{n:'Healthcare',v:8,s:'4 of 50'},{n:'All sites',v:21,s:'52 of 242'}],40,r=>r.v+'%');<!-- [et_pb_line_break_holder] -->})();<!-- [et_pb_line_break_holder] --><\/script><!-- [et_pb_line_break_holder] -->[\/et_pb_code][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":14,"featured_media":0,"parent":227529,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"class_list":["post-228099","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>The Consent Gap: US Website Tracking Benchmark 2026 | DataTrue<\/title>\n<meta name=\"description\" content=\"DataTrue tested 242 leading US websites. 43% failed core privacy tests, and on 20 of 24 sites, clicking reject didn&#039;t stop ad tracking. Read the report.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/datatrue.com\/en\/research\/the-consent-gap-2026\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Consent Gap: US Website Tracking Benchmark 2026 | DataTrue\" \/>\n<meta property=\"og:description\" content=\"DataTrue tested 242 leading US websites. 43% failed core privacy tests, and on 20 of 24 sites, clicking reject didn&#039;t stop ad tracking. Read the report.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/datatrue.com\/en\/research\/the-consent-gap-2026\/\" \/>\n<meta property=\"og:site_name\" content=\"DataTrue\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/datatruedigital\/\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-28T12:30:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/datatrue.com\/wp-content\/uploads\/2026\/10\/consent-gap-2026-og.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@data_true\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"20 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/research\\\/the-consent-gap-2026\\\/\",\"url\":\"https:\\\/\\\/datatrue.com\\\/en\\\/research\\\/the-consent-gap-2026\\\/\",\"name\":\"The Consent Gap: US Website Tracking Benchmark 2026 | DataTrue\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/#website\"},\"datePublished\":\"2026-10-28T12:30:22+00:00\",\"dateModified\":\"2026-10-28T12:30:41+00:00\",\"description\":\"DataTrue tested 242 leading US websites. 43% failed core privacy tests, and on 20 of 24 sites, clicking reject didn't stop ad tracking. Read the report.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/research\\\/the-consent-gap-2026\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/datatrue.com\\\/en\\\/research\\\/the-consent-gap-2026\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/research\\\/the-consent-gap-2026\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/datatrue.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Research\",\"item\":\"https:\\\/\\\/datatrue.com\\\/en\\\/research\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"The Consent Gap\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/datatrue.com\\\/en\\\/\",\"name\":\"DataTrue\",\"description\":\"Web Analytics Quality Assurance\",\"publisher\":{\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/datatrue.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/#organization\",\"name\":\"DataTrue\",\"url\":\"https:\\\/\\\/datatrue.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/datatrue.com\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/New-DT-Logo.png\",\"contentUrl\":\"https:\\\/\\\/datatrue.com\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/New-DT-Logo.png\",\"width\":1328,\"height\":208,\"caption\":\"DataTrue\"},\"image\":{\"@id\":\"https:\\\/\\\/datatrue.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/datatruedigital\\\/\",\"https:\\\/\\\/x.com\\\/data_true\",\"https:\\\/\\\/www.youtube.com\\\/c\\\/Datatrue\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Consent Gap: US Website Tracking Benchmark 2026 | DataTrue","description":"DataTrue tested 242 leading US websites. 43% failed core privacy tests, and on 20 of 24 sites, clicking reject didn't stop ad tracking. Read the report.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/datatrue.com\/en\/research\/the-consent-gap-2026\/","og_locale":"en_US","og_type":"article","og_title":"The Consent Gap: US Website Tracking Benchmark 2026 | DataTrue","og_description":"DataTrue tested 242 leading US websites. 43% failed core privacy tests, and on 20 of 24 sites, clicking reject didn't stop ad tracking. Read the report.","og_url":"https:\/\/datatrue.com\/en\/research\/the-consent-gap-2026\/","og_site_name":"DataTrue","article_publisher":"https:\/\/www.facebook.com\/datatruedigital\/","article_modified_time":"2026-10-28T12:30:41+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/datatrue.com\/wp-content\/uploads\/2026\/10\/consent-gap-2026-og.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_site":"@data_true","twitter_misc":{"Est. reading time":"20 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/datatrue.com\/en\/research\/the-consent-gap-2026\/","url":"https:\/\/datatrue.com\/en\/research\/the-consent-gap-2026\/","name":"The Consent Gap: US Website Tracking Benchmark 2026 | DataTrue","isPartOf":{"@id":"https:\/\/datatrue.com\/en\/#website"},"datePublished":"2026-10-28T12:30:22+00:00","dateModified":"2026-10-28T12:30:41+00:00","description":"DataTrue tested 242 leading US websites. 43% failed core privacy tests, and on 20 of 24 sites, clicking reject didn't stop ad tracking. Read the report.","breadcrumb":{"@id":"https:\/\/datatrue.com\/en\/research\/the-consent-gap-2026\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/datatrue.com\/en\/research\/the-consent-gap-2026\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/datatrue.com\/en\/research\/the-consent-gap-2026\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/datatrue.com\/en\/"},{"@type":"ListItem","position":2,"name":"Research","item":"https:\/\/datatrue.com\/en\/research\/"},{"@type":"ListItem","position":3,"name":"The Consent Gap"}]},{"@type":"WebSite","@id":"https:\/\/datatrue.com\/en\/#website","url":"https:\/\/datatrue.com\/en\/","name":"DataTrue","description":"Web Analytics Quality Assurance","publisher":{"@id":"https:\/\/datatrue.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/datatrue.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/datatrue.com\/en\/#organization","name":"DataTrue","url":"https:\/\/datatrue.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/datatrue.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/datatrue.com\/wp-content\/uploads\/2022\/04\/New-DT-Logo.png","contentUrl":"https:\/\/datatrue.com\/wp-content\/uploads\/2022\/04\/New-DT-Logo.png","width":1328,"height":208,"caption":"DataTrue"},"image":{"@id":"https:\/\/datatrue.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/datatruedigital\/","https:\/\/x.com\/data_true","https:\/\/www.youtube.com\/c\/Datatrue"]}]}},"_links":{"self":[{"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/pages\/228099","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/comments?post=228099"}],"version-history":[{"count":16,"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/pages\/228099\/revisions"}],"predecessor-version":[{"id":228124,"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/pages\/228099\/revisions\/228124"}],"up":[{"embeddable":true,"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/pages\/227529"}],"wp:attachment":[{"href":"https:\/\/datatrue.com\/en\/wp-json\/wp\/v2\/media?parent=228099"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}