CMP Vendor Cookie Compliance

The companies that sell privacy tools should be experts. They sell compliance to others. Yet a scan of 42 homepages for Consent Management Platforms (CMPs) and privacy vendors shows that many cannot follow their own rules.

Only two sites definitively passed the scan. Eleven failed outright. These eleven "expert" sites set trackers for services such as Google, LinkedIn, and Twitter before a user interacts with their banners.

The list of failures includes names like Complianz, Didomi, and Cookie Information. These firms sell the very tools they fail to use correctly on their own domains. Complianz, for example, sets Google Analytics cookies immediately on page load. Its own Google Consent Mode integration is broken.

What the data shows

The verdict breakdown is stark. Of 38 sites that returned a valid result, just 2 passed and 11 failed. The remaining 25 received a warn verdict - meaning a consent banner was detected but signals were ambiguous: Google Consent Mode missing or misconfigured, banners present but non-required cookies already set.

The 11 failing sites share a common pattern. A banner appears. A user sees an "Accept" button. But the trackers have already started. Google Analytics fires on arrival. LinkedIn's lidc and bcookie cookies are set. The banner is decoration.

Google Consent Mode: a split picture

On GCM adoption, the industry shows more self-awareness than the cookie compliance results suggest. 17 of the 38 valid sites - 45% - have Google Consent Mode correctly configured in Advanced mode. That is a higher rate than the general web, where Advanced adoption remains low.

But 25 sites still fall short: 3 have broken or partial integrations, and 22 have no GCM implementation at all. For companies whose customers are often buying consent infrastructure partly because of GCM requirements, that gap is difficult to explain.

A failure of the industry

This is more than a technical slip. It is a credibility problem for an entire sector.

If a vendor cannot secure its own homepage, a customer cannot fully trust the tool they buy. The presence of a cookie banner is not evidence of compliance. These results show that a banner can exist alongside systematic non-compliance - and that even specialists in consent management are not immune.

The data also reveals that 25 of the 42 vendors have no identifiable consent management platform on their own site. Some may use custom implementations not yet recognised by our scanner. Others may have no consent layer at all.

Methodology

Scans were performed using ConsentScout with headless Chromium (Windows desktop user agent, en-GB locale). Each URL was loaded once in a fresh browser context (no stored cookies, no cached storage, no prior consent state) with no user interaction. A site is marked PASS only if, on first load, (1) no cookies classified as non-required (Analytics, Marketing, or Personalisation) are set, and (2) a recognised Consent Management Platform (CMP) is detected. FAIL indicates that one or more cookies were set on first load that are not typically considered "required" for delivering the requested service (e.g., analytics identifiers, marketing tags, cross-site IDs, or similar). WARN indicates cookies were set that ConsentScout could not confidently classify and therefore require manual verification. Sites returning HTTP errors, DNS failures, or timeouts are excluded from PASS/WARN/FAIL totals.