PHILADELPHIA, PA — More than 40% of major U.S. websites failed basic privacy compliance tests in October 2026, according to research released by DataTrue, raising concerns about whether businesses are honoring consumer requests to limit online advertising tracking.
The study, titled The Consent Gap: DataTrue’s US Website Tracking Benchmark 2026, examined 242 heavily visited websites across retail, healthcare, banking, higher education and media. Researchers found that 104 sites, or 43%, failed a combination of tests involving advertising trackers, accessible opt-out mechanisms and browser-based privacy signals.
The findings point to a disconnect between the privacy choices websites present to consumers and the tracking activity that continues behind the scenes.
Among 173 websites identified as using advertising trackers, 139, or 80%, provided no obvious way for visitors to opt out.
The study also found that 76% of websites with advertising tracking did not fully honor Global Privacy Control, or GPC, a browser signal that communicates a user’s preference to opt out of certain data sharing and sales.
California privacy law recognizes GPC as a mechanism through which consumers can exercise opt-out rights, making websites’ responses to the signal particularly relevant for businesses subject to the state’s requirements.
Researchers identified another potential weakness in consent systems: Websites sometimes continued contacting advertising companies even after visitors explicitly rejected tracking.
Of 24 sites offering a clear rejection button, 20 continued making connections to advertising companies after the button was selected.
That finding suggests that displaying a consent interface does not necessarily mean the underlying tracking technology responds to users’ selections.
“On most of the sites we tested, clicking ‘reject’ didn’t actually stop the site from sending data about your visit to ad companies,” said Sayf Sharif, DataTrue’s executive vice president of commercial operations.
“Simply having a consent banner isn’t enough. Knowing that your tags actually listen to it is the part most companies are missing.”
DataTrue conducted the tests in October using three browsing conditions for each website: an initial visit without making a privacy selection, a visit with GPC enabled and a visit after selecting a rejection option when one was available.
Researchers also manually reviewed websites classified as lacking an obvious opt-out mechanism.
The methodology allowed the company to compare tracking behavior before and after consumers expressed privacy preferences, rather than relying exclusively on the presence of consent banners or published privacy policies.
The results carry implications for companies that depend on advertising technology while operating under increasingly complex consumer privacy requirements.
Website tracking systems commonly involve multiple advertising and analytics services, making the enforcement of privacy preferences dependent on how those technologies are configured and managed.
The study’s findings identify instances in which websites continued contacting advertising companies after rejection requests, although those connections alone do not establish the precise information transmitted or whether an individual website violated a particular law.
DataTrue said the research is intended to provide a benchmark for businesses evaluating their privacy controls across the five industries examined.
“Privacy, legal and marketing teams are being asked to stand behind what their websites do, often without a clear view,” said Robin Jowett, DataTrue’s co-founder and chief executive officer.
The findings underscore an operational challenge for businesses managing digital advertising: Privacy compliance depends not only on offering consumers choices but also on ensuring that website tracking systems consistently implement those choices.
Support the local news that supports Chester County. MyChesCo delivers reliable, fact-based reporting and essential community resources—free for everyone. If you value that, click here to become a patron today.