We scanned UK private clinics for consent leaks. 37% failed.

We keep hearing that SMB websites are non-compliant because they lack cookie banners. So we tested it — properly, by loading real sites in a real browser and recording what actually fires before anyone clicks "Accept."

The result contradicted the assumption.

Method

We scanned a sample of private UK clinic sites — dental, aesthetic and physio. For each domain:

• Fresh browser context (no shared cookies between sites — cross-contamination is a real measurement trap).
• Recorded every cookie set and every network request made before any consent interaction.
• Fingerprinted the CMP (Cookiebot, OneTrust, Complianz, Borlabs, etc.).
• Checked the dataLayer for Google Consent Mode v2 default state, including the ad_user_data and ad_personalization signals.
• Flagged neglect signals like dead Universal Analytics tags.

What we found

Three findings stood out:

1. Misconfiguration, not absence. Every single site leaking data pre-consent already had a Consent Management Platform installed. The banner was there. It just wasn't enforcing anything. Complianz and Borlabs showed up repeatedly — installed, not wired.

2. Consent Mode v2 was universally absent. Not one site in the sample had the v2 signals in place. For advertisers, that means Google is modelling nothing and Smart Bidding is running on observed conversions only.

3. Neglect is visible. One site was still loading a dead Universal Analytics tag — sunset back in July 2023. When a tag nobody's touched in three years is still firing, it tells you the whole GTM container has been left to rot.

Why this is the real market

The "install a cookie banner" pitch targets a problem most of these businesses already think they've solved. They bought a CMP. They see a banner. As far as they know, they're done.

The actual problem is one layer down: the CMP was never connected to the tags. That's not something a business owner can see, and it's exactly what a behavioural scan surfaces.

What a fix looks like

For these sites, the fix isn't ripping out the CMP — it's making it enforce:

• Wire the consent state into GTM so tags defer until consent is granted.
• Add the Consent Mode v2 default/update states with ad_user_data and ad_personalization.
• Re-scan to prove the leaks are gone (red → green).

Then set expectations for the reported-conversion drop, and recover the legitimate signal with modelling and server-side tagging. See how we do it.

We'll keep scanning verticals and publishing what we find. If you run a site in one of these categories and want yours checked, it's free.