Blog

A hosted platform told us its analytics cookie was strictly necessary and produced a processor agreement to back it up. Both statements were probably true. Neither one touches the test, and the brand whose customers loaded that page is the one holding the question.

Of 47,419 sites scored, 23,307 run Google tags and send no consent signal at all. Only 2,108 show a working Consent Mode v2 signal. The common failure is not a misconfigured signal, it is no signal, and nothing about it looks broken.

Of 47,419 sites scored, 1,475 had a consent platform detected and only 1,109 carried a vendor we could name. The hand-built banner is a real category, and it has a failure profile a purchased one does not.

Nine alarms arrived from one property inside the same minute, one per metric. That is one incident reported nine times, and the correlation, which is the most useful fact in the whole thing, gets discarded at exactly the moment it is cheapest to compute.

Google is upgrading standalone Google tags into full Tag Manager containers, and the new deployment snippet no longer carries the gtag config command. Initialization moves to a trigger. That is a change in order of operations, and order of operations is where consent defaults live.

Our own privacy scanner reported no consent platform on two sites that plainly had one. Both were client-side apps whose tags load after hydration. "None detected" is a claim a tool makes about its own eyesight, and it gets stored in the same field as a real absence.

A consent platform can only block what routes through it. Hardcoded template scripts, vendor SDKs that load other SDKs, and platform-injected pixels never do. Here is how to find the ones your tag manager cannot see.

Google is replacing the GA4 Configuration tag with the Google tag in Tag Manager. It is being read as a rename. It is a shared configuration surface, and it lands on a web where half the sites running Google tags send no consent signal at all.

Most privacy and tracking statistics circulate with no sample size and no collection window. Both omissions make a number impossible to check, reproduce or compare. Here is the four-second test, and what it costs to publish figures that can be found out.

Only 4.4% of scanned sites send a working Consent Mode v2 signal. The compliance reading of that is familiar. The advertising reading is not: without the signal there is no gap for Google to model, so the reporting looks clean whether or not anyone is being counted.

California's new CCPA regulations split into a documentary half nobody outside the company can verify and a technical half anyone can verify in about ten seconds. On 47,419 scored websites, 49.2% ran Google tags with no Consent Mode signal at all. The observable half is where the gap is.

We scored 47,419 websites for privacy practice and 18,550 came back at zero out of 100. Here is what a zero actually indicates, why the distribution piles at the bottom, and three checks you can run on your own site in ten minutes.

Only 0.5% of 47,419 scored websites gate their tags behind a consent decision. "Compliant" is a legal conclusion nobody selling software can hand you. "Gated" is an observable fact about a page. Here is the difference, and the four-minute check.

Every argument about cookie banner design assumes a banner exists. On 47,419 scored public websites, a consent platform was detected on 1,475 of them. The other 96.9% had none at all. Here is what that does to the question everyone is asking.

On 47,419 scored websites, 1,475 had a consent platform detected and 2,108 sent a working Consent Mode v2 signal. The number doing it correctly is larger than the number that bought a tool to do it. The platform was never the mechanism.

On 47,419 scored sites, 23,307 run Google tags with no Consent Mode signal and 2,108 send a working one. Roughly eleven to one. The reason is not difficulty. It is that the privacy team owns the decline and the media team owns the reporting, and the setting between them belongs to neither.

50 of 47,419 scored websites got a perfect privacy score. We published none of them. Why a clean scan result is the one worth questioning, and what to ask of any report that hands you one.

Ecommerce posted the best average privacy score in our index at 24.0, yet only 14 of 8,386 sites reached the Gated tier. Most had a preferences link and no consent platform detected. A link and a gate are not the same thing.

Of 1,475 sites with a consent platform detected, 239 reached the Gated tier. The other 1,236 did not. Here is why "the banner shows up" is the wrong acceptance test, and the three checks that replace it.

In an index of 47,419 scored sites, 96.8% scored under 30 and 1.2% scored 80 or over. Only 2.1% landed anywhere in between. Here is why the middle is empty, and what that means if you are halfway through a consent project.

Across 47,419 scored sites a consent platform was detected on 1,475, and a vendor could be named on 1,109 of them. Here is the full ranking, and why the name on the banner tells you almost nothing about whether consent works.

Our scan chart showed fewer domains for August 23 than we recorded on August 23. Nothing was deleted. A store keyed by identity rewrites its own past every time a row is updated, and most dashboards never notice.

Of 18,524 sites we scored, 1,024 showed a cookie banner and 387 of those tracked the visitor anyway. The problem is not the sites with no consent tooling. It is the ones that bought it, deployed it, and are protected by none of it.

Across 18,524 scored sites, restaurants averaged 9.8 out of 100 on privacy and ecommerce averaged 22.8. The gap is not effort. It is how much of a restaurant funnel runs on domains the brand does not own.

Seven alarms on one dataset in the same minute is one infrastructure failure, not seven business problems. Why grouping by source beats raising thresholds, and the timestamp tell that tells you which you have.

Alerting fails silently by construction: the thing that would report the failure is the thing that failed. A calm week and a dead check look identical. Heartbeats fix what more alarms cannot.

A row stamped with today's date can be mostly months old. Partial updates rewrite the timestamp but not the fields, and the result passes every check including the freshness monitor.

Budget-limited campaigns now spend toward the target that was typed in rather than beating it. Cost per conversion rises while volume also rises, which is the diagnostic key. How to tell an enforcement-driven increase from a real performance problem, and the one number to pull today.

Ordering, loyalty, gift cards and catering usually run on four different vendors across four different domains. What that does to attribution, consent and accountability.

A zero means either nothing happened or nothing was measured, and the report renders both the same way. Why thresholds can't tell them apart and freshness monitoring can.

Tag manager versions, CMP panels, CMS revisions and vendor tickets each record a fragment. None answers what the site was doing on a date in March, which is the version that gets asked.

The flagship domain has a CMP and passes review. The regional site, launched by a different team on a different builder, has no Consent Mode at all and no way to reopen preferences. The 10-minute inventory that finds the gap, the three findings we see most, and the fix order that closes it.

A retired API doesn't break your dashboard. It freezes it, and frozen numbers don't generate tickets. The inventory-and-freshness playbook for any vendor end-of-life.

A new FTC complaint describes two ways sensitive data reached ad platforms. One was a deliberate upload. The other was a pixel doing its default job. How to audit the second one on your own site.

A consent cookie can't cross a domain boundary, so a hosted checkout starts from nothing. Why "not our domain" gets the responsibility test backwards, and the two-minute check.

GTM publishes the workspace, not the change. Why the three-workspace cap routes urgent fixes through your messiest container, and the pre-publish check that catches it.

Enforcement keeps landing on the opt-out: links that 404 or do nothing, GPC signals the site never reads, and banners where declining takes four times as many clicks as accepting.

The charts are portable. The filter logic isn't. Where it hides, the two traps that break a rebuild, and the extraction checklist that makes a migration reproduce the numbers instead of just the pictures.

The user-level opt-out is going away, so your consent setup is the only one left. Plus the August trap: audiences and match quality will jump, and it won't be your campaign work.

Google retired first click, linear, time decay, and position-based attribution, and accounts are being migrated automatically. Who gets hit, why credit redistributes into Smart Bidding, and the 15-minute check.

A banner is a UI. A consent tool is enforcement. The three banner types we find in audits, a two-minute Global Privacy Control test, and the state-by-state reason implied consent no longer holds.

Custom events opt you out of the platform's pre-trained conversion models - so they learn slowly and pay hotter CPMs, even though the event "fires fine." Why standard events win and a 10-minute Events Manager audit.

CAPI recovers conversion signal lost to ad blockers, ITP, and consent - but only if you deduplicate and forward standard events. What it fixes, what it doesn't, and how to verify it.

Google is auto-migrating the GA4 Configuration Tag to the Google Tag with Destinations. The dual-ID deployment model, a pre-upgrade audit, staging tests, and a rollback plan.

We audit 10-15 sites a week. In more than half of them, the banner is there, the UI looks great, and zero scripts are actually being gated.

Your campaigns look busy but the data feeding them is broken. Here are the five patterns we see in every audit that signal your tracking needs attention.

Your client asks every month and you spend hours trying to reconcile. The issue is almost always conversion action misconfiguration, not platform differences.

A national homebuilder spending $514K/month across 221 campaigns. 99.85% of their bidding signal was noise. Here's what we found and how we fixed it.

Client-side cookies are dying. But server-side tagging isn't free. We break down the real costs, benefits, and when it actually makes sense for your business.

Everything we check when auditing a GA4 implementation. From data layer architecture to conversion configuration to consent mode verification.