On October 12 and 13, DataTrue tested 242 of the most visited websites in the United States. Only three passed every test it ran. The HIPAA Journal covered the study on October 28, and the figure everyone quoted was the headline one: 104 of 242 sites, 43 percent, failed the core privacy tests.
That is not the number that matters. DataTrue did not check whether a site had a cookie banner. It checked whether anything changed when a visitor said no. Most businesses have spent three years answering the first question.
If your cookie banner doesn't block tracking, you do not have a privacy problem. You have an engineering problem wearing a legal costume.
TL;DR
- DataTrue tested 242 leading US websites on October 12 and 13, 2026. Three passed every test.
- Of the 173 sites running ad tracking, 139 gave no obvious way to opt out, and 76 percent of those tested with Global Privacy Control switched on still contacted at least one ad company.
- Of the 24 sites where DataTrue clicked a clear reject button, 20 still contacted ad companies afterward.
- Healthcare had the lowest failure rate of any sector, 28 percent, and the weakest response to an opt-out signal: a 7 percent drop in ad domains.
The Test Measured Behavior, Not Buttons
According to DataTrue's report, The Consent Gap 2026, each site was loaded three ways: with no choice made, with Global Privacy Control switched on, and after using the site's own opt-out. The tests asked whether the site sent visitor data to ad tech firms, social platforms or audience data companies, whether there was a clear opt-out such as "reject all," whether that opt-out and the GPC signal were honored, and whether session replay started recording clicks and scrolls before any choice was made.
None of those tests ask whether a banner exists. They ask what the site does.
A consent banner is a JavaScript widget that writes a preference into a cookie. Reading that preference and gating every tag against it, before the tag fires, is a separate build. Agencies sell the widget, because it is visible and shippable in an afternoon.
Almost everyone bought the widget. Almost nobody shipped the system. It is the same pattern as companies that bought seats and never shipped systems with AI.
The 20 of 24 Number Is the Whole Story
Of the 173 tested sites running ad tracking, only 34 gave visitors an obvious opt-out at all. DataTrue clicked a clear reject button on 24 of them. On 20 of those 24, ad companies were still contacted after the click, and 16 still set advertising cookies.
Run the arithmetic. Out of 173 sites with ad tracking, DataTrue could confirm a reject button that behaved the way a visitor would expect on four. That is our math on DataTrue's counts, not a figure DataTrue published, but it is what the numbers force.
Read the 20 of 24 carefully, because it changes the legal weight. Those calls were measured after the visitor clicked reject. This is not a tag that fired a beat too early. It is a site that heard "no" and kept going.
Healthcare Had the Cleanest Sites and the Weakest Response to "No"
Healthcare posted the best failure rate in the study, 28 percent against 40 percent for both media and retail, with the fewest ad companies per site. Then DataTrue turned on the opt-out signal, and healthcare shed just 7 percent of its ad domains, the smallest drop of any sector.
Of the 50 healthcare sites, 18 contacted ad or social companies before visitors were given a choice. Of those 18, fourteen changed nothing at all when Global Privacy Control was enabled, and only two stopped all ad tracking.
Two out of 18, in the sector with the strictest regulatory exposure in the country. That is not a vertical that does not care. It is one that bought compliance as a product and never tested it as a system.
Why a Reject Button That Doesn't Work Is Worse Than No Button
A site with no banner is out of step with a growing list of state laws. A site with a prominent "Reject All" button that does not stop tracking has done something different. It made a promise and then broke it.
That distinction is doing real work in court. An April 2026 Loeb & Loeb alert quotes a 2026 federal order describing a site that "set an expectation that user data would not be collected, but then collected it anyway." Loeb notes courts remain divided and defenses still succeed in some courts. We are a marketing agency, not a law firm, and none of this is legal advice. But the pattern is clear enough to plan around: the clearer your promise, the more expensive it is to break. Wiring tags to consent is a build task, which is why it belongs with whoever handles your web design and development, not with whoever picked the banner.
Regulators Are Not Fining the Absence of Banners
DataTrue's September 2026 enforcement research counts more than $9.3 million across eight California actions on opt-outs and tracking between 2022 and 2026. Tractor Supply paid $1.35 million of it. Per the California Privacy Protection Agency's order, its opt-out webform did not stop the third-party tracking it used for advertising, and its site did not honor opt-out preference signals such as GPC until July 2024. Not a missing banner. A request arriving and nothing happening, which is what DataTrue measured on 76 percent of the ad-tracking sites it tested with GPC this month.
What To Do This Week
- Record what fires before anyone clicks. Open your homepage in a fresh incognito window with the Network tab open, and do not touch the banner. Write down every third-party domain contacted in the first five seconds, watching for connect.facebook.net, doubleclick.net and hotjar.com. Anything firing before a click is your pre-consent exposure, in writing.
- Click reject and compare. Reload, click "Reject All," hard refresh, and capture the list again. If the two lists are identical, your banner is decoration and you now have proof. Send both lists to whoever maintains the site today, not next quarter.
- Audit your tag manager. Open your Google Tag Manager container and list every tag with no consent condition configured. On a typical small business site that means the Meta pixel, a session replay tool, a chat widget and a reviews widget. Four people installed them over four years, and it is the work nobody assigns an owner to.
FAQ
Do I even need a cookie banner if I'm a small business in Florida?
At least nine states require businesses to honor browser opt-out signals directly, per DataTrue's tally: California, Colorado, Connecticut, Delaware, Minnesota, Montana, New Hampshire, New Jersey and Oregon. Florida is not one, but if you sell into those states, their thresholds and rules can apply to you. The nearer Florida question is Chapter 934, the state's all-party consent wiretapping statute, which plaintiffs have applied to tracking scripts that run before consent. Florida courts have not settled whether that theory holds.
How do I know if my cookie banner is actually blocking anything?
Load your site in a private window with the Network tab open, click "Reject All," then hard refresh and watch which third-party domains still get contacted. If the same ad and analytics domains appear after rejecting as before, your banner is writing a cookie that nothing reads.
Is it safer to just remove the reject button?
No. That trades a broken promise for a compliance gap, and in states that mandate an opt-out it is the worse trade. Wire your tags to the button instead, which is one-time tag manager work rather than an ongoing cost.
Every category of marketing technology splits into the version you can see and the version that works. Seats and systems. Banners and tag governance. The visible half sells first, because it is the half you can show someone in a screenshot.
The 242 biggest websites in America bought the visible half. Three finished the job. Your site is probably in the other group, and the test above will tell you this afternoon. That is a better spot than the Fortune 500, because you can fix it in a week.
Book a 30-minute website and tracking audit. No pitch, just a straight read on what your site is sending and whether your banner is doing anything about it. Get a free website and tracking audit.