Open navigation menu
Benchmark notes
Website consent and tracking benchmark notes 2026
Observed frequencies from automated homepage-oriented scans of public websites. Findings are evidence-backed review signals, not legal conclusions.
Run a free website behavior scan
Check observable tracking, cookies, consent, accessibility, and privacy risk signals.
Observed benchmark signals
Percentages are based on recent benchmark batches of homepage-oriented public-site scans and should be treated as directional, not a legal or statistical conclusion.
Pre-consent tracking was seen on ~18% of scanned top sites, while third-party cookies before consent were seen on ~12% of scanned top sites.
RTB cookie sync was seen on ~9% of scanned top sites, providing a higher-signal advertising ecosystem review cue.
Fingerprinting-related signals were seen on ~16% of scanned top sites. Probable fingerprinting was seen on <1% of scanned top sites, reflecting a deliberately conservative higher-confidence threshold.
Session recording services were seen on ~9% of scanned top sites. Possible session replay on sensitive input surfaces was seen on <1% of scanned top sites. Although uncommon, this remains a high-priority review signal when evidence shows replay activity near sensitive fields.
Methodology caveats
These estimates are based on automated homepage-oriented scans of public websites. Results vary by site category, geography, scan coverage, blocking, consent surface, and scanner access.
Findings are review signals, not legal conclusions. Site owners should review the underlying evidence and compare the observed behavior with their intended vendor, consent, and disclosure configuration.
Sample JSON
Sample finding JSON from scans
Representative payloads from retained scan examples for the finding types discussed on this page.
Third-party tracking observed before recorded consent
pre_consent_tracking_detected
Illustrative public evidence sample
Third-party tracking observed before recorded consent
pre_consent_tracking_detected
Illustrative public evidence sample
{
"example_type": "positive",
"domain": "example.com",
"requested_url": "https://example.com/",
"final_url": "https://example.com/",
"created_at": "2026-05-18T18:20:10.442Z",
"scanned_at": "2026-05-18T18:20:18.912Z",
"finding_id": "pre_consent_tracking_detected",
"finding_label": "Third-party tracking observed before recorded consent",
"section": "Privacy & Tracking",
"evidenceConfidence": "strong",
"directVsInferred": "direct_observation",
"evidence": {
"counts": {
"firstRequestMs": 1137,
"firstThirdPartyRequestMs": 3405,
"firstCookieSeenMs": 3468,
"total_cookie_count": 3,
"total_vendor_count": 2,
"total_request_count": 12,
"total_tracker_count": 1,
"third_party_cookie_count": 0,
"third_party_request_count": 2,
"preConsentTrackingRequestCount": 1,
"preConsentTrackingSignalCount": 2
},
"evidence_snippets": [
"Example Tag Manager",
"Example Analytics",
"tagmanager.example",
"analytics.example",
"script_host:tagmanager.example",
"request:https://analytics.example/g/collect [query_redacted=true]",
"cookie:_ga [value_redacted=true]"
],
"vendors": [
"Example Tag Manager",
"Example Analytics"
],
"request_domains": [
"tagmanager.example",
"analytics.example"
],
"request_samples": [
{
"artifactRef": "req_001",
"role": "supporting_context_only",
"origin": "https://tagmanager.example",
"path": "/gtm.js",
"queryRedacted": true,
"timestampMs": 1137
},
{
"artifactRef": "req_002",
"role": "finding_supporting_artifact",
"origin": "https://analytics.example",
"path": "/g/collect",
"queryRedacted": true,
"timestampMs": 3405,
"essentiality": "non_essential",
"purposeCategory": "analytics_measurement"
}
],
"cookie_samples": [
{
"artifactRef": "storage_001",
"role": "finding_supporting_artifact",
"name": "_ga",
"valueRedacted": true,
"timestampMs": 3468,
"essentiality": "non_essential",
"purposeCategory": "analytics_identifier"
}
],
"consent_summary": {
"cmp_vendor": "Example CMP",
"preconsent_tracking_detected": true,
"banner_present": true,
"consent_state_observed": "no_choice_observed",
"consent_action_observed_before_first_signal": false,
"observed_prior_consent_state_for_purpose": false
},
"fingerprinting_or_device_signals": {
"fingerprinting_vendor_detected": false,
"device_signal_vendor_detected": null
},
"runtime_anchors": [
"req_002:https://analytics.example/g/collect [query_redacted=true]",
"storage_001:_ga [value_redacted=true]"
]
},
"coverage_flags": [],
"known_limitations": [
"Illustrative public sample with redacted query strings and cookie values.",
"Review consent state, vendor purpose, regional configuration, and exemptions before taking action."
],
"selection_reason": "Illustrative public sample with consent timeline, classified non-essential runtime anchors, and usable coverage.",
"evidenceVersion": "2.0",
"scanContext": {
"domain": "example.com",
"requestedUrl": "https://example.com/",
"finalUrl": "https://example.com/",
"publicWebObservation": true,
"legalConclusion": false
},
"artifacts": {
"runtimeAnchors": [
"req_002:https://analytics.example/g/collect [query_redacted=true]",
"storage_001:_ga [value_redacted=true]"
],
"requestSamples": [
{
"artifactRef": "req_001",
"role": "supporting_context_only",
"origin": "https://tagmanager.example",
"path": "/gtm.js",
"queryRedacted": true,
"timestampMs": 1137
},
{
"artifactRef": "req_002",
"role": "finding_supporting_artifact",
"origin": "https://analytics.example",
"path": "/g/collect",
"queryRedacted": true,
"timestampMs": 3405,
"essentiality": "non_essential",
"purposeCategory": "analytics_measurement"
}
],
"cookieOrStorageSamples": [
{
"artifactRef": "storage_001",
"role": "finding_supporting_artifact",
"name": "_ga",
"valueRedacted": true,
"timestampMs": 3468,
"essentiality": "non_essential",
"purposeCategory": "analytics_identifier"
}
],
"policyAnchors": [],
"rawValuesRetained": false
},
"classification": {
"section": "Privacy & Tracking",
"criticality": "review",
"evidenceConfidence": "strong",
"directVsInferred": "direct_observation",
"legalStatusDetermined": false
},
"coverage": {
"coverageFlags": [],
"coverageReliableForTopRanking": true,
"notDetectedMeans": "not_observed_in_scan_scope",
"manualReviewNeeded": true
},
"topFindingCalibration": {
"minimumToSurface": [
"Classified non-essential request/storage before observed consent."
],
"highConfidenceRequires": [
"Usable coverage.",
"Purpose classification.",
"Runtime anchor."
],
"criticalOrTopRankingRequires": [
"Advertising/replay/identifier-sync or sensitive-surface context."
],
"demoteOrSuppressWhen": [
"Tag manager only.",
"Strict necessity.",
"Blocked scan.",
"Unreliable timing."
]
},
"automationLimits": [
"Automated public-web observations do not determine legal status, compliance status, proof that a law was breached, proof of data capture, or tracking lawfulness.",
"Manual review is needed to confirm purpose, necessity, jurisdiction, configuration, exemptions, and remediation quality."
],
"redaction": {
"rawIdentifiersRetained": false,
"storageValueContentsRetained": false,
"completeQueryStringsRetained": false,
"requestBodiesRetained": false,
"renderedPageImagesRetained": false,
"sourceMarkupRetained": false,
"userEnteredValuesRetained": false
},
"selectionReason": "Illustrative public sample with consent timeline, classified non-essential runtime anchors, and usable coverage.",
"consentTimeline": {
"firstRequestMs": 1137,
"firstThirdPartyRequestMs": 3405,
"firstCookieSeenMs": 3468,
"consentActionObservedBeforeFirstSignal": false,
"consentStateBasis": "observed_scan_scope",
"manualReviewNeeded": true
},
"networkEvidence": {
"artifactRefs": [
{
"artifactRef": "req_001",
"role": "supporting_context_only",
"origin": "https://tagmanager.example",
"path": "/gtm.js",
"queryRedacted": true,
"timestampMs": 1137
},
{
"artifactRef": "req_002",
"role": "finding_supporting_artifact",
"origin": "https://analytics.example",
"path": "/g/collect",
"queryRedacted": true,
"timestampMs": 3405,
"essentiality": "non_essential",
"purposeCategory": "analytics_measurement"
}
],
"cookieOrStorageArtifacts": [
{
"artifactRef": "storage_001",
"role": "finding_supporting_artifact",
"name": "_ga",
"valueRedacted": true,
"timestampMs": 3468,
"essentiality": "non_essential",
"purposeCategory": "analytics_identifier"
}
],
"vendorCategory": "Example Tag Manager",
"queryStringsRedacted": true,
"valuesRedacted": true,
"manualReviewNeeded": true
}
}Non-essential tracking continued after reject
reject_tracking_persists_after_reject
Illustrative public evidence sample
Non-essential tracking continued after reject
reject_tracking_persists_after_reject
Illustrative public evidence sample
{
"finding_id": "reject_tracking_persists_after_reject",
"finding_label": "Non-essential tracking continued after reject",
"category": "Consent / tracking",
"criticality": "high",
"evidenceConfidence": "good",
"directVsInferred": "direct_observation",
"observed": "Retained runtime evidence showed a reject-style consent interaction followed by classified non-essential request or storage activity in the observed scan scope.",
"evidence": {
"summary": "Retained runtime evidence showed a reject-style consent interaction followed by classified non-essential request or storage activity in the observed scan scope.",
"examples": [
{
"title": "Post-reject runtime artifact",
"lines": [
"artifact=req_002",
"role=finding_supporting_artifact",
"url=https://example.com/",
"reject_action_timestamp_ms=2600",
"reject_action_observed=true",
"post_reject_request_timestamp_ms=4120",
"request_origin=https://analytics.example",
"request_path=/collect [query_redacted=true]",
"vendor_category=analytics",
"essentiality=non_essential",
"review_caveat=manual review should confirm reject success, queued-beacon timing, purpose, necessity, and CMP/vendor configuration"
]
}
],
"automationLimits": [
"Automated evidence may not fully determine reject success, queued beacons, vendor responsibility, consent validity, or legal status.",
"Manual review is needed to confirm timing, purpose, CMP propagation, and remediation quality."
]
},
"evidenceVersion": "2.0",
"scanContext": {
"domain": "example.com",
"requestedUrl": "https://example.com/",
"finalUrl": "https://example.com/",
"publicWebObservation": true,
"legalConclusion": false
},
"artifacts": {
"runtimeAnchors": [],
"requestSamples": [],
"cookieOrStorageSamples": [],
"policyAnchors": [],
"rawValuesRetained": false
},
"classification": {
"section": "Review signal",
"criticality": "high",
"evidenceConfidence": "good",
"directVsInferred": "direct_observation",
"legalStatusDetermined": false
},
"coverage": {
"coverageFlags": [],
"coverageReliableForTopRanking": true,
"notDetectedMeans": "not_observed_in_scan_scope",
"manualReviewNeeded": true
},
"topFindingCalibration": {
"minimumToSurface": [
"Reject interaction plus post-reject classified non-essential request/storage."
],
"highConfidenceRequires": [
"Reject success.",
"Pre/post sequence.",
"Artifact classification."
],
"criticalOrTopRankingRequires": [
"Post-reject advertising/replay/identifier sync or repeated post-reject artifacts."
],
"demoteOrSuppressWhen": [
"Reject button present but not clicked.",
"Unknown essentiality.",
"Queued pre-reject beacon likely."
]
},
"automationLimits": [
"Automated public-web observations do not determine legal status, compliance status, proof that a law was breached, proof of data capture, or tracking lawfulness.",
"Manual review is needed to confirm purpose, necessity, jurisdiction, configuration, exemptions, and remediation quality."
],
"redaction": {
"rawIdentifiersRetained": false,
"storageValueContentsRetained": false,
"completeQueryStringsRetained": false,
"requestBodiesRetained": false,
"renderedPageImagesRetained": false,
"sourceMarkupRetained": false,
"userEnteredValuesRetained": false
},
"selectionReason": "Illustrative public sample selected to show retained evidence, directness, limits, and top-finding calibration.",
"consentTimeline": {
"firstRequestMs": null,
"firstThirdPartyRequestMs": null,
"firstCookieSeenMs": null,
"consentActionObservedBeforeFirstSignal": false,
"consentStateBasis": "observed_scan_scope",
"manualReviewNeeded": true
},
"networkEvidence": {
"artifactRefs": [],
"cookieOrStorageArtifacts": [],
"vendorCategory": "manual_review_recommended",
"queryStringsRedacted": true,
"valuesRedacted": true,
"manualReviewNeeded": true
}
}Third-party cookie or storage observed before consent
third_party_cookie_pre_consent
Illustrative public evidence sample
Third-party cookie or storage observed before consent
third_party_cookie_pre_consent
Illustrative public evidence sample
{
"finding_id": "third_party_cookie_pre_consent",
"finding_label": "Third-party cookie or storage observed before consent",
"category": "Cookies",
"criticality": "high",
"evidenceConfidence": "review_signal",
"directVsInferred": "direct_observation",
"observed": "Retained runtime evidence showed a third-party cookie or storage artifact observed before CertScore recorded a consent action or a prior consent state associated with that purpose.",
"evidence": {
"summary": "Retained runtime evidence showed a third-party cookie or storage artifact observed before CertScore recorded a consent action or a prior consent state associated with that purpose.",
"examples": [
{
"title": "Third-party cookie timing example",
"lines": [
"artifact=storage_001",
"role=finding_supporting_artifact",
"url=https://example.com/",
"type=cookie_observed",
"cookie_name=example_id",
"value_redacted=true",
"cookie_domain=.ads.example",
"cookie_scope=third_party",
"first_seen_ms=1840",
"consent_action_observed_before_first_seen=false",
"prior_consent_state_for_purpose=false",
"purpose_category=advertising_or_measurement [manual_review_recommended]"
]
}
],
"automationLimits": [
"Automated storage evidence may not determine purpose, necessity, exemption status, or legal status.",
"Manual review is needed to confirm cookie purpose, consent state, regional configuration, and remediation quality."
]
},
"evidenceVersion": "2.0",
"scanContext": {
"domain": "example.com",
"requestedUrl": "https://example.com/",
"finalUrl": "https://example.com/",
"publicWebObservation": true,
"legalConclusion": false
},
"artifacts": {
"runtimeAnchors": [],
"requestSamples": [],
"cookieOrStorageSamples": [],
"policyAnchors": [],
"rawValuesRetained": false
},
"classification": {
"section": "Review signal",
"criticality": "high",
"evidenceConfidence": "review_signal",
"directVsInferred": "direct_observation",
"legalStatusDetermined": false
},
"coverage": {
"coverageFlags": [],
"coverageReliableForTopRanking": true,
"notDetectedMeans": "not_observed_in_scan_scope",
"manualReviewNeeded": true
},
"topFindingCalibration": {
"minimumToSurface": [
"Third-party cookie/storage artifact before consent."
],
"highConfidenceRequires": [
"Domain/scope/timing plus purpose or vendor classification."
],
"criticalOrTopRankingRequires": [
"Advertising/identity/sync persistent storage or repeated pages."
],
"demoteOrSuppressWhen": [
"Request only.",
"Cookie name only.",
"Unknown timing.",
"Blocked scan."
]
},
"automationLimits": [
"Automated public-web observations do not determine legal status, compliance status, proof that a law was breached, proof of data capture, or tracking lawfulness.",
"Manual review is needed to confirm purpose, necessity, jurisdiction, configuration, exemptions, and remediation quality."
],
"redaction": {
"rawIdentifiersRetained": false,
"storageValueContentsRetained": false,
"completeQueryStringsRetained": false,
"requestBodiesRetained": false,
"renderedPageImagesRetained": false,
"sourceMarkupRetained": false,
"userEnteredValuesRetained": false
},
"selectionReason": "Illustrative public sample selected to show retained evidence, directness, limits, and top-finding calibration.",
"consentTimeline": {
"firstRequestMs": null,
"firstThirdPartyRequestMs": null,
"firstCookieSeenMs": null,
"consentActionObservedBeforeFirstSignal": false,
"consentStateBasis": "observed_scan_scope",
"manualReviewNeeded": true
},
"networkEvidence": {
"artifactRefs": [],
"cookieOrStorageArtifacts": [],
"vendorCategory": "manual_review_recommended",
"queryStringsRedacted": true,
"valuesRedacted": true,
"manualReviewNeeded": true
}
}Summary for AI assistants
Website consent and tracking benchmark notes 2026 explains an observable public website review topic in CertScore.ai's evidence-backed scanning workflow.
CertScore.ai observes public website behavior around tracking, cookies, consent behavior, session replay indicators, fingerprinting-related signals, accessibility, and privacy disclosures. CertScore.ai findings are automated risk signals for review and are not legal advice, certification, or compliance determinations.
Related CertScore.ai pages
Run a free website behavior scan
Check observable tracking, cookies, consent, accessibility, and privacy risk signals.
Dataset note
- Current estimates are based on the Tranco top 1-2500 calibration set, an approximately 2,505-scan public-web calibration set.
- Percentages are approximate and will be refreshed as the benchmark corpus grows.
- Homepage-oriented scans can undercount behavior that appears only after navigation, login, checkout, geolocation changes, or delayed consent interactions.
- Directional density from recent public-web scan calibration batches. Rank bands are approximate and may contain minor overlap. Not a legal, compliance, or statistical conclusion.
Citation-friendly benchmark table
| Signal | Approx. observed frequency | Signal definition | Interpretation / review note |
|---|---|---|---|
| Pre-consent tracking | Seen on ~18% of scanned top sites | Non-essential third-party tracking or identifier-bearing requests observed before a clear user consent action. | Common consent-timing review signal; review vendor necessity, CMP timing, and default firing rules. |
| Third-party cookies before consent | Seen on ~12% of scanned top sites | Third-party cookies or cookie-like identifiers observed before a consent action. | More specific cookie-layer subset of pre-consent tracking; useful for reviewing consent gating and tag manager rules. |
| RTB cookie sync | Seen on ~9% of scanned top sites | Adtech synchronization behavior consistent with vendors mapping identifiers across domains or partners. | Higher-signal advertising ecosystem telemetry; review consent basis, vendor disclosures, and whether sync behavior is expected. |
| Session replay service signal observed | Seen on ~9% of scanned top sites | Session recording / replay vendor activity or instrumentation observed during the automated scan. | Broad replay-service presence signal; not necessarily sensitive-input capture by itself. |
| Fingerprinting-related signals | Seen on ~16% of scanned top sites | Browser, device, canvas/WebGL, hardware, viewport, locale, storage, or network-surface telemetry that can be fingerprinting-adjacent. | Broad review signal; intentionally includes lower-confidence telemetry and should not be treated as confirmed fingerprinting. |
| Reject/refusal option not observed or nested | Seen on ~4% of scanned top sites | Consent interface review signal where rejecting or declining tracking appears unavailable, difficult to access, or placed behind additional preference steps. | Choice-architecture review signal; confirm actual CMP configuration and regional behavior. |
| Probable fingerprinting | Seen on <1% of scanned top sites | Higher-confidence fingerprinting subset supported by stronger evidence such as high-entropy telemetry, known vendor corroboration, identifier shaping, transmission, or cross-context linkage. | Conservative signal; should remain much lower than broad fingerprinting-related signals. |
| Possible session replay on sensitive input surfaces | Seen on <1% of scanned top sites | Higher-urgency subset where replay/session-recording activity appears near sensitive input surfaces such as forms collecting personal, account, financial, health, or similar sensitive information. | Uncommon but high-priority review signal when supported by evidence. |
How to read these estimates
- Percentages are approximate, not population-wide claims.
- Signals are derived from automated public-web observations.
- Some behavior may be undercounted because scans are homepage-oriented.
- Blocking, bot defenses, geolocation, CMP personalization, and delayed tag firing can affect observed rates.
- A finding's frequency is not the same as legal risk; it is a benchmark context point for evidence review.
Definitions
Pre-consent tracking
Pre-consent tracking means non-essential third-party tracking or identifier-bearing requests observed before a clear user consent action. CertScore uses observable public-web behavior, and consent state, geography, CMP behavior, and scan coverage can affect results.
RTB cookie sync
RTB cookie sync means adtech identifier synchronization behavior, usually involving redirect, pixel, or server calls that appear designed to map identifiers across vendors or domains. It is an observed behavior that requires context review.
Fingerprinting-related signals vs probable fingerprinting
Fingerprinting-related signals are intentionally broad: browser, device, canvas/WebGL, hardware, viewport, locale, storage, or network-surface telemetry that may warrant review. Probable fingerprinting is a conservative higher-confidence subset supported by stronger corroborating evidence.
Session recording services vs sensitive-input session replay
Session replay service signal observed is a broad vendor-presence or instrumentation signal. Sensitive-input session replay is a higher-urgency subset where replay-like activity appears near sensitive input surfaces.
Reject/refusal option not observed or nested
Reject/refusal option not observed or nested is a consent-interface review signal where declining tracking appears unavailable, difficult to access, or placed behind additional preference steps. Confirm the actual CMP configuration and regional behavior before acting.
Third-party cookies before consent
Third-party cookies before consent is a cookie-layer subset of pre-consent tracking where third-party cookies or cookie-like identifiers are observed before a consent action.
Run a free website behavior scan
Check observable tracking, cookies, consent, accessibility, and privacy risk signals.
CertScore.ai automated findings may contain errors. Always review the underlying evidence. CertScore.ai does not provide legal advice, certification, or compliance determinations.