Privacy signals on 10 AI companies' websites

We scanned the public starting pages of ten AI companies: OpenAI, Anthropic, Google DeepMind, Meta AI, xAI, Mistral, Perplexity, Cohere, Groq, and Hugging Face. The reports cover cookies and storage set before consent, tracking requests, and activity after a visitor clicks “Reject.” The scores below summarize the observations from those visits.

Key findings

Hugging Face scored highest at 92, with a single minor pre-consent storage observation.
On 2 of 10 sites, tracking requests kept firing after a confirmed Reject click: 8 non-essential Google requests on one site, 2 on another.
Pre-consent tracking was common: Google Analytics on Mistral before any click, YouTube cookies on DeepMind via embeds, a Reddit pixel on Groq.
Findings are automated observations of public pages, not legal advice or compliance determinations.

The leaderboard

01huggingface.coHugging Face Only flag: a pre-consent storage item (AWS WAF token, likely security-related) 92View report ↗ 02meta.aiMeta AI Pre-consent storage flag; otherwise clean 89View report ↗ 03anthropic.comAnthropic Decline/reject control only partially supported in testing 81View report ↗ 04x.aixAI Pre-consent storage; uses OneTrust consent tooling 80View report ↗ 05cohere.comCohere 8 non-essential Google requests fired 7+ seconds after a confirmed Reject 77View report ↗ 06openai.comOpenAI 2 tracking requests (incl. Cloudflare) began after the Reject click 75View report ↗ 07groq.comGroq Pre-consent tracking incl. Reddit pixel and PostHog 71View report ↗ 08mistral.aiMistral Google Analytics fired pre-consent; no reject option on the first consent layer 62View report ↗ 09deepmind.googleGoogle DeepMind YouTube embeds set cookies pre-consent; heaviest deduction set in the group 59View report ↗ n/aPerplexity, not scored.perplexity.ai Limited coverage on this run, no score produced. View report ↗

Findings

Hugging Face had the highest score.

Hugging Face scored 92. Its report flagged one pre-consent storage item, an AWS WAF token described as likely security-related.

Tracking requests after Reject clicks.

On cohere.com, eight non-essential Google requests were observed more than seven seconds after a confirmed Reject click. On openai.com, two tracking requests began just under a second after Reject. Under GDPR/ePrivacy logic, a refusal should suppress optional tracking. The reports describe both as “partial concern” / “potential gap” findings. These are observations from the recorded visits, not legal verdicts.

Pre-consent tracking.

Mistral's site fired Google Analytics before any consent interaction, and its banner didn't offer reject on the first layer. DeepMind's pages set YouTube cookies (__Secure-ROLLOUT_TOKEN) before consent via embeds. Groq's pre-consent inventory included a Reddit pixel.

All nine scored sites had review notes.

Scores ranged from 59 to 92. All nine scored sites had something flagged for review, mostly storage set before consent where essentiality could not be confirmed.

Methodology

Each site was scanned with CertScore.ai MCP Light (free, no-auth endpoint), tracking_check purpose, on October 12, 2026, from the EU-IE region.
Scans cover the public starting page: pre-consent cookies/storage, tracker requests, consent-control behavior including eligible Accept/Reject click observations, and policy surfaces.
Scores follow CertScore.ai's overall-posture scoring policy (base 100 minus policy deductions). Most runs completed with partial coverage (completed_limited), automated single-page scans, not full-site audits.
Perplexity.ai could not be scored on this run due to limited coverage; that's a measurement limitation, not a judgment.

HTTP cross-check

To check the scanner's work, we re-verified the headline signals without touching CertScore.ai: fresh, cookie-less HTTP fetches of each homepage (no JavaScript, no consent interaction), inspecting response Set-Cookie headers and the raw HTML for tracker/CMP signatures.

7 OF 10

Vendor presence confirmed

The HTML shows YouTube embeds on deepmind.google, Axeptio on mistral.ai, OneTrust on x.ai, CookieYes on cohere.com, PostHog on groq.com, Stripe on huggingface.co, and Webflow + CloudFront on anthropic.com, matching the vendors CertScore.ai reported.

EXACT COOKIE MATCH

x.ai

gb_anon_id is set on the very first HTTP response, before any consent is possible, the same cookie CertScore.ai flagged as its first retained pre-consent item.

MECHANISM CHECK

JavaScript timing

Most flagged cookies don't appear in response headers at all; they're set by JavaScript seconds after load, consistent with CertScore.ai's “first observed N seconds after scan start” timings.

LIMITS

Post-Reject behavior

Post-Reject behavior (the cohere.com and openai.com findings) can't be validated without driving consent clicks in a real browser, so that part rests on CertScore.ai's evidence alone. openai.com and meta.ai block plain-HTTP fetching with bot challenges, so their HTML couldn't be independently inspected either.

Reading the results

Please keep this attached to any republication.

These are automated observations of public web pages, not legal advice, certification, or a determination of compliance. A flagged signal means “worth a human look,” not “violation.” Sites change constantly. Rescan before citing.

Run your own

Put your own site on the scanner. Check your privacy posture.

Every scan above links to a full evidence report. You can request the same check for a public website without an account:

Scan your site: https://certscore.ai
For AI agents: CertScore.ai MCP Light works with any MCP client, no OAuth required.

Individual scan reports:

FAQ

Which AI company has the best privacy posture on its own website?

According to CertScore.ai MCP Light scans conducted on October 12, 2026, Hugging Face scored highest among the ten websites, at 92, with a single minor pre-consent storage observation. Its report describes an AWS WAF token as likely security-related. This ranking covers the recorded starting-page visit, not a full-site audit or compliance determination.

What happens after you click Reject on AI company websites?

On 2 of the 10 sites, tracking requests kept firing after a confirmed Reject click: eight non-essential Google requests on one site and two tracking requests on another. The linked reports retain the observations. These results describe the recorded visits and do not establish how every visitor or later visit will behave.

How does CertScore.ai scan a website?

CertScore.ai runs an automated browser scan of a website's public starting page. It observes pre-consent cookies and storage, tracker requests, consent-control behavior, including eligible Accept and Reject clicks, and policy surfaces. No account is needed. The linked report shows the retained observations and any limits on what the scan could assess.

Are these findings legal determinations?

No. The findings are automated observations of public pages, not legal advice, certification, or a compliance determination. A flagged signal identifies something to review against the retained evidence and its context. The scans cover a starting page and a bounded visit, so they do not establish a website's complete behavior.

What is CertScore.ai MCP Light?

CertScore.ai MCP Light is a free, no-auth MCP endpoint that lets AI agents run public website privacy scans from a compatible MCP client, with no OAuth required. You can also run the same type of scan manually in your browser at certscore.ai. Each report shows the observed signals, evidence and coverage limits.