The State of Consent Compliance
A quarterly benchmark of what actually happens in a browser on the web’s most-visited sites: what fires before anyone interacts with a banner, what keeps firing after “reject all”, and whether Consent Mode signals match the choice that was made. Every number reproducible from the published method and data.
Get the first edition
One email when the index publishes. No sharing, no selling, unsubscribe in one click. See our privacy policy.
What gets measured
1,500 sites, three markets
The top 500 sites by traffic in the United Kingdom, Germany and France, ranked from public lists (Cloudflare Radar, cross-checked against Tranco), with the list version and rank recorded per domain.
Three pages, three consent states
Homepage, one deep page and one form or account page, each replayed with no interaction, after “reject all” and after “accept all” in a fresh browser profile, from a declared crawler on a published in-market address — no proxies, no disguises, and an opt-out that works.
Behaviour, not self-reporting
Requests, cookies and Consent Mode signals recorded per state. No surveys, no vendor questionnaires, no claims about what a CMP is capable of — only what the sites did.
The five scored metrics
Pre-consent marketing rate. Share of sites contacting an advertising endpoint or setting a marketing identifier before any interaction. Analytics is reported separately.
Decorative-reject rate. Share of sites where marketing still fires after “reject all” — split by whether it leaks on the click, on reload, or only on the next page.
Consent Mode v2 adoption and correctness. Who implements it, who defaults to granted, and who never propagates the rejection to Google’s tags.
Dark-pattern rate. First-layer reject present, equal prominence, pre-ticked purposes, banner re-shown after a choice, no withdrawal path, cookie walls — each reported on its own.
Site score, 0–100. A published, deterministic weighting of the above, with every component shown alongside the total. Nothing hidden.
And one nobody else publishes: the refusal rate. A share of every market’s biggest sites will not serve a page to an identified, declared auditor at all. Most benchmarks quietly drop those sites, which makes every other number look better than it is — the sites running the most aggressive bot management are exactly the large commercial sites a benchmark is most about. We report the share instead, broken down by which bot-management product did the refusing, and print the scored denominator next to every other figure.
Sites that opt out by naming our runner in robots.txt are counted separately, never called refusals, and never named. How the runner identifies itself.
The full definitions, detection rules, exclusions and scoring table are in the methodology, published before the first crawl so it cannot be tuned to the result.
How we will publish it
Open data
The per-domain scores and metric flags are released as CSV under CC BY 4.0, with the Consent Mode decoder and classifier lists. A benchmark that hides its data is not reproducible.
Observation, not accusation
The report says what a browser observed. It does not say any named site broke any law — whether a behaviour is unlawful depends on facts a crawl cannot see.
Right to correct
Any site named in prose gets its evidence pack at least 10 working days before publication. Anyone can request theirs and a re-crawl at any time. Correction process.
Want your own site checked before the index runs? The free scan loads one page in a clean browser and shows the first five findings.
Written by TagPatrol's AI content team and reviewed under human direction.