Datatrue study: 28% of 50 US healthcare sites fail core privacy tests, most ignore Global Privacy Control
A Datatrue study of the 242 most visited U.S. websites, run on October 12-13, 2026, found that more than 4 in 10 failed its core privacy tests. Only 3 sites passed all of them. The sample included 50 healthcare websites, which performed best of any sector, with a 28% failure rate and a median of 1.5 ad companies per site. Healthcare nonetheless ranked worst for honoring the Global Privacy Control (GPC) signal, with only a 7% drop in ad domains when GPC was enabled. The findings matter because regulators, including California, have begun to penalize privacy failures.
Detalhes técnicos
- Each site was tested three times with the GPC signal enabled. Datatrue checked for ad tracking, a clear opt-out option, and session replay starting on arrival.
- 18 of the 50 healthcare sites contacted ad or social media companies before the visitor made a choice. Of those 18, 14 did nothing when GPC was on, 2 cut some tracking and 2 stopped all tracking.
- On opt-out options, 32 healthcare sites had none, 7 had one that was not obvious, and 11 had an obvious one.
- 9 healthcare sites (18%) started session replay on arrival, the second-lowest rate among sectors after media (12%). Media was the next best sector overall, with a 40% failure rate.
Remediação
Datatrue recommends:
- Show a clear choice on-screen when a visitor arrives.
- Switch off every tag that shares or sells data when GPC is enabled.
- Hold session replay until the visitor consents.
- Remove ad tracking code that is no longer used.
- Test what a page sends after a visitor rejects tracking, to confirm the choice is honored.
Linha do tempo
-
Datatrue study: 28% of 50 US healthcare sites fail core privacy tests, most ignore Global Privacy Control
ler a análise desta fonte ocultar
A Datatrue study of the 242 most visited U.S. websites, run on October 12-13, 2026, found that more than 4 in 10 failed its core privacy tests. Only 3 sites passed all of them. The sample included 50 healthcare websites, which performed best of any sector, with a 28% failure rate and a median of 1.5 ad companies per site. Healthcare nonetheless ranked worst for honoring the Global Privacy Control (GPC) signal, with only a 7% drop in ad domains when GPC was enabled. The findings matter because regulators, including California, have begun to penalize privacy failures.
Technical Details
- Each site was tested three times with the GPC signal enabled. Datatrue checked for ad tracking, a clear opt-out option, and session replay starting on arrival.
- 18 of the 50 healthcare sites contacted ad or social media companies before the visitor made a choice. Of those 18, 14 did nothing when GPC was on, 2 cut some tracking and 2 stopped all tracking.
- On opt-out options, 32 healthcare sites had none, 7 had one that was not obvious, and 11 had an obvious one.
- 9 healthcare sites (18%) started session replay on arrival, the second-lowest rate among sectors after media (12%). Media was the next best sector overall, with a 40% failure rate.
Remediation
Datatrue recommends:
- Show a clear choice on-screen when a visitor arrives.
- Switch off every tag that shares or sells data when GPC is enabled.
- Hold session replay until the visitor consents.
- Remove ad tracking code that is no longer used.
- Test what a page sends after a visitor rejects tracking, to confirm the choice is honored.