Confidence runs ahead of control.
800
Privacy, legal, marketing and IT professionals surveyedIndependent research conducted by Censuswide for Feroot, May 2026
92
Real-world websites audited by FerootConsent audits, July 15 to September 1, 2026
How to read the chartsThe outcome you wantPartialA gapContext
CMP adoption and confidence are widespread
Censuswide survey for Feroot, May 2026. Base: 800 survey respondents for CMP deployment; 640 respondents whose organizations use a CMP for confidence.
| Answer | Value |
|---|---|
| Have fully or partially deployed a CMP | 82% |
| CMP users who are somewhat or very confident it blocks all pre-consent scripts | 66% |
A CMP lowered the rate. It did not stop vendor scripts from firing.
Feroot consent audits, July 15 to September 1, 2026. Base: 92 audited websites; a CMP was identified on 52.
| Measure | Value |
|---|---|
| Sites with a CMP | 60% |
| Sites without a CMP | 81% |
Feroot consent audits, July 15 to September 1, 2026. Base: 92 audited websites; a CMP was identified on 52.
| Measure | Value |
|---|---|
| Median tracking vendors, sites with a CMP | 16 |
| Median tracking vendors, sites without a CMP | 9 |
What it meansCMPs show value. But deployment and confidence don’t prove that every consent choice is honored.
Real-world audits revealed five gaps
Share of audited websites with each gap, on the same 0 to 100% scale.
93%
of websites continued loading ad and tracking vendor scripts despite the presence of a Global Privacy Control signal.
Base: 83 websites tested
Global Privacy Control is a browser-level preference not to sell or share personal data. It is separate from the cookie banner.
69%
of websites continued loading advertising or tracking vendors after a visitor selected “Reject All.”
Base: 74 websites tested
Vendors kept loading even after visitors explicitly rejected tracking through the cookie banner.
69%
of websites placed a known advertising or analytics cookie in a category the CMP would not block.
Base: 90 websites tested
62%
used “Strictly Necessary” for at least one known advertising or analytics cookie.
Ad cookieLabeled “Necessary”Still allowed
A mislabeled advertising cookie can remain active even when the CMP follows its configured rules.
82%
of websites allowed third parties to read a form field and send data off-page.
Base: 91 websites tested
Some transfers support expected services, but the results raise questions about which vendors received the information, where it went, and whether those transfers aligned with the organization’s policies and legal requirements.
24%
of websites gave an outside vendor script password-field read access.
Base: 91 websites tested
35%
gave outside vendor scripts access when username fields were also included.
Advertising scripts were among those with access. Read access alone does not establish password transmission.
Feroot consent audits, July 15 to September 1, 2026. Base: websites where each check could be run, shown on each card.
| Gap | Share of websites | Base |
|---|---|---|
| Browser opt-outs: kept loading vendors despite a GPC signal | 93% | 83 websites tested |
| “Reject All”: kept loading vendors after Reject All | 69% | 74 websites tested |
| Cookie categories: ad or analytics cookie in a category the CMP would not block | 69% | 90 websites tested |
| Cookie categories: used “Strictly Necessary” for a known ad or analytics cookie | 62% | 90 websites tested |
| Third-party data flows: third party read a form field and sent data off-page | 82% | 91 websites tested |
| Sensitive fields: vendor script had password-field read access | 24% | 91 websites tested |
| Sensitive fields: access including username fields | 35% | 91 websites tested |
What it meansThe audits found vendors loading after browser opt-outs and “Reject All,” ad cookies filed as necessary, and form data read by third parties.
Confidence is high. Verification is less certain.
92% say at least some of their scripts are not fully authorized.
Censuswide survey for Feroot, May 2026. Base: 800 survey respondents.
| Answer | Value |
|---|---|
| All of them | 8% |
| Most (75 to 99%) | 28% |
| About half (50 to 74%) | 26% |
| Fewer than half | 38% |
Has a script ever fired before consent on your website?
Censuswide survey for Feroot, May 2026. Base: 640 respondents whose organizations use a CMP.
| Answer | Value |
|---|---|
| Tested and confirmed it hadn’t occurred | 14% |
| Don’t know or haven’t tested | 5% |
| Suspected but not confirmed | 28% |
| Confirmed it occurred | 53% |
What it meansConfidence doesn’t always come with technical verification.
How teams find unauthorized scripts
More than one answer was allowed, so totals exceed 100%.
Censuswide survey for Feroot, May 2026. Base: 800 survey respondents.
| Answer | Value |
|---|---|
| Regulatory or legal notification | 29% |
| Internal security review | 26% |
| Manual audit | 24% |
| Automated scanning | 23% |
| Third-party vendor report | 12% |
| User complaint | 8% |
What it meansMore teams reported learning about an unauthorized script from a regulatory or legal notice than from automated scanning or any other internal check.
How ready are teams to prove compliance?
Censuswide survey for Feroot, May 2026. Base: 800 survey respondents.
| Answer | Value |
|---|---|
| Very confident | 17% |
| Somewhat confident | 46% |
| Not very confident | 27% |
| Not at all confident | 10% |
What it meansMore than a third (37%) are not confident they could demonstrate compliance if audited today.
The digital environment never stands still
54% say a vendor changed data collection without notice more than once.
Censuswide survey for Feroot, May 2026. Base: 560 respondents asked about vendor changes; 800 survey respondents for discovery.
| Answer | Value |
|---|---|
| Had a marketing vendor change data collection without notifying the privacy team | 88.6% |
| Discover unauthorized scripts at least a few times a year | 83% |
Scale
65.5%
run 11 to 50 third-party vendor scripts on their websites
Censuswide survey for Feroot, May 2026. Base: 800 survey respondents.
What it meansThird-party technologies multiply and vendor behavior changes between reviews, so what was checked last quarter may not match what runs on the site today.
Periodic review is carrying a continuous responsibility
Censuswide survey for Feroot, May 2026. Base: 800 survey respondents.
| Answer | Value |
|---|---|
| Fully proactive | 6% |
| Mostly proactive | 22% |
| Primarily reactive | 72% |
What it meansWebsites and vendors change continuously. For most teams, verification does not.
The verification gap
Censuswide survey for Feroot, May 2026. Base: 640 respondents whose organizations use a CMP.
| Answer | Value |
|---|---|
| Somewhat or very confident their CMP blocks all pre-consent scripts | 66% |
| Tested and confirmed pre-consent firing had never occurred | 14% |
Digital environments change continuously, while verification is often periodic.
What it meansClosing that gap requires moving beyond having consent controls in place to continuously verifying how they actually perform.
Put your website to the test
See what’s happening across your website with Feroot’s free Privacy Consent Assessment.
Get your free assessment For public-facing websites. No installation or code changes required.Censuswide surveyed 800 privacy, legal, marketing and IT professionals at mid-size to large organizations in the US, UK, Canada and Australia, across financial services, healthcare, retail, technology and media, in May 2026. The research was conducted independently on behalf of Feroot Security.
Some questions went to a subset of respondents, such as the 640 whose organizations use a CMP. Each chart shows its base.
Between July 15 and September 1, 2026, Feroot ran automated consent audits on 92 company websites, counting each company once. Each gap is reported as a share of the websites where that check could be run.
The audited companies requested a Feroot consent audit, so the results describe that group rather than a random sample of all websites.
Percentages are rounded, so some totals differ from 100%.