Healthcare finished first and still came away looking bad in The Consent Gap, a benchmark that loaded 242 of the most visited US websites three different ways in October 2026 and recorded every tag, cookie and outbound request.
Among the 50 hospital and health sites tested, 28% flunked the core privacy checks. That beat media, retail, banking and higher education, where the overall failure rate was 43% of all sites. It also means roughly one in four provider sites hands visitor data to ad firms regardless of what the visitor wants.
Choice arrives too late
Eighteen of the 50 healthcare sites contacted advertising or social platforms before giving anyone a choice. Of those, 14 ignored the Global Privacy Control signal entirely when it was switched on, two trimmed some tracking and two stopped.
Opting out was barely offered either: 32 sites had no way to decline, seven buried it and 11 displayed a clear option. Nine began session replay recording on arrival, capturing keystrokes and clicks before a decision was possible.
Why hospitals should care now
Scheduler pages that leak appointment reasons, symptom checkers and provider directories are the usual offenders, and California has begun collecting penalties for exactly this. Only three of the 242 sites nationwide passed every test.
The practical ask from researchers is unglamorous: confirm that a tag management platform actually stops firing tags when consent is withheld, rather than assuming the banner did its job.
