Cookie Consent &
the Verification Gap
Confidence runs ahead of control.
compliance leaders surveyedIndependent research conducted by Censuswide
audited by Feroot
1The digital environment
never stands still
experienced a marketing vendor changing data collection without notifying the privacy team.
discover unauthorized or undocumented scripts at least occasionally.
average third-party technologies per organization.
Third-party technologies multiply. Vendor behavior changes. Visibility struggles to keep pace.
2CMP adoption and
confidence are widespread
of organizations
have fully or partially
deployed a CMP.
of CMP users are somewhat
or very confident their
platform blocks
pre-consent scripts.
But what did the website audits show?
vendor script-firing rate
with a CMP
vendor script-firing rate
without a CMP
median tracking vendors on sites
with a CMP
median tracking vendors on sites
without a CMP
CMPs show value. But deployment and confidence don’t prove that every consent choice is honored.
3Confidence is high.
Verification is less certain.
of respondents believe
every website script
is fully authorized.
How teams verify their
consent controls
Confidence doesn’t always come with technical verification.
4Real-world audits revealed five gaps
14%of surveyed organizations with CMPs deployed were able to confirm that pre-consent firing had never occurred.
Browser
opt-outs
of websites continued loading ad and tracking vendor scripts despite the presence of a Global Privacy Control signal.
It provides a separate signal from choices made through the visible cookie banner.
“Reject All”
of websites continued loading advertising or tracking vendors after a visitor selected “Reject All.”
Cookie
categories
of websites placed a known advertising or analytics cookie in a category the CMP would not block.
62%used “Strictly Necessary” for at least one known advertising or analytics cookie.
Third-party
data flows
of websites allowed third parties to read a form field and send data off-page.
Sensitive
fields
of websites gave an outside vendor script password-field read access.
35%gave outside vendor scripts access when username fields were also included.
5Regulatory or legal notices were
the most reported discovery path
How unauthorized scripts were discovered
Regulatory or legal notification was the most commonly reported way organizations discovered unauthorized scripts.
6How ready are teams to produce
consent evidence?
If a consent-related legal action were filed today, how ready would your organization be to produce evidence?
Fully prepared
Historical, auditable evidence is available on demand.
Mostly prepared
Evidence could be produced, but assembling it would take time.
Uncertain
It is unclear what evidence exists or where to find it.
Not prepared
No audit trail is available.
The takeaway
For most respondents, producing consent evidence would require time—or they were uncertain about what evidence was available.
7Periodic review is carrying a
continuous responsibility
did not report continuous
auditing with dedicated tooling.
How teams audit CMP performance
Continuous
with dedicated
tooling
Periodic
reviews
Rely on CMP
vendor reporting
No runtime
audit
Websites and vendors change continuously.
For most teams, verification does not.
8The verification gap
Consent controls are widely adopted. Confidence is high.
But neither guarantees that consent choices are being honored in practice.
change continuously,
while verification is
often periodic.
Closing that gap requires moving beyond having consent controls in place to continuously verifying how they actually perform.