We scanned UK private clinics for consent leaks. 37% failed.

Short answer: 37% of the private UK clinic sites we scanned fired Google trackers before anyone clicked anything — and 100% of those had a cookie banner already installed. The problem in this market isn't missing consent banners. It's banners that were bought, deployed, and never connected to the tags they were meant to control. Not one site in the sample had Consent Mode v2 configured.

We keep hearing that SMB websites are non-compliant because they lack cookie banners. So we tested it — properly, by loading real sites in a real browser and recording what actually fires before anyone clicks "Accept."

The result contradicted the assumption.

Method

We scanned a sample of private UK clinic sites — dental, aesthetic and physio. For each domain:

• Fresh browser context (no shared cookies between sites — cross-contamination is a real measurement trap).
• Recorded every cookie set and every network request made before any consent interaction.
• Fingerprinted the CMP (Cookiebot, OneTrust, Complianz, Borlabs, etc.).
• Checked the dataLayer for Google Consent Mode v2 default state, including the ad_user_data and ad_personalization signals.
• Flagged neglect signals like dead Universal Analytics tags.

What we found

Three findings stood out:

1. Misconfiguration, not absence. Every single site leaking data pre-consent already had a Consent Management Platform installed. The banner was there. It just wasn't enforcing anything. Complianz and Borlabs showed up repeatedly — installed, not wired.

2. Consent Mode v2 was universally absent. Not one site in the sample had the v2 signals in place. For advertisers, that means Google is modelling nothing and Smart Bidding is running on observed conversions only.

3. Neglect is visible. One site was still loading a dead Universal Analytics tag — standard UA properties stopped processing data on 1 July 2023. When a tag nobody's touched in three years is still firing, it tells you the whole GTM container has been left to rot.

What this scan does not tell you

Publishing a number obliges us to say what it's worth, so: this is a sample of private UK clinic sites, not a random sample of UK business, and you shouldn't read 37% as a national figure. It's a snapshot of one vertical at one moment.

More importantly, the measurement has known limits. Our scanner fingerprints a fixed list of consent platforms, and we later found — while scanning CMP vendors' own websites in a separate pilot — that the list didn't cover every certified vendor. Where a CMP isn't recognised, the scan can't tell "no consent layer" from "a consent layer we don't recognise." That doesn't affect the headline finding here, which is about tags firing before any interaction and doesn't depend on identifying the vendor. It does mean we're not publishing a per-CMP breakdown from this data, and we'd distrust anyone who published one without saying how they detected each platform.

The direction of the finding isn't ours alone, for what it's worth. The ConsentChk study, which analysed 1,793 sites across eight jurisdictions, found only 3.82% correctly enforcing user preferences. Different method, different sample, same shape of answer.

Why this is the real market

The "install a cookie banner" pitch targets a problem most of these businesses already think they've solved. They bought a CMP. They see a banner. As far as they know, they're done.

The actual problem is one layer down: the CMP was never connected to the tags. That's not something a business owner can see, and it's exactly what a behavioural scan surfaces.

What a fix looks like

For these sites, the fix isn't ripping out the CMP — it's making it enforce:

• Wire the consent state into GTM so tags defer until consent is granted.
• Add the Consent Mode v2 default/update states with ad_user_data and ad_personalization.
• Re-scan to prove the leaks are gone (red → green).

Then set expectations for the reported-conversion drop, and recover the legitimate signal with modelling and server-side tagging. See how we do it.

We'll keep scanning verticals and publishing what we find. If you run a site in one of these categories and want yours checked, it's free.

Sources

1. 1.Perfmetrix scanner — behavioural scan of private UK clinic sites (our own data; method below) · July 2026
2. 2.Google — Universal Analytics sunset: standard properties stopped processing data on 1 July 2023 · Checked 2026-07-25
3. 3.Google — Consent Mode v2 signals (ad_user_data, ad_personalization) for CMP providers · Checked 2026-07-25
4. 4.ICO — Our work on online tracking · Checked 2026-07-25
5. 5.ConsentChk: 1,793 sites, 3.82% correctly enforce user preferences — independent corroboration of the pattern · 2025