NEW YORK--(BUSINESS WIRE)--Jun 23, 2026--
Privado AI, the agentic privacy platform reducing compliance risk at scale, today released research finding that 48% of the most-visited websites it tested have a misconfigured Google Consent Mode, sending personal data to Google Ads, even when visitors opt out.
This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260623138373/en/
The scan of 250 of the most-visited websites across California, France and the UK was run the morning after June 15, 2026, when Google removed the Google Analytics setting that had limited personalized ads when consent was set up wrong. With that backstop gone, Consent Mode is now the only control standing between a visitor’s choice and the Google ad stack. Any Consent Mode misconfiguration will now send the full signal to Google Ads for cross-device remarketing against visitors’ consent.
Consent management platforms record a visitor’s choice, but they were not built to verify if it is enforced across the tags and third parties that fire on a page. As marketing teams change third-party data flows week to week, new gaps open that the banner cannot catch.
On 48% of the sites Privado AI scanned, the visitors’ personal data was sent to Google Ads without proper consent. A person who opts out, expecting not to be followed, will still see personalized ads from that website across devices linked to their Google account. For the business running the site, the gap between the choice on screen and the data leaving the page is the compliance exposure for CCPA, GDPR, and many other privacy laws.
What the scan found
Daniel Goldberg, Chair of Data Strategy & Privacy at Frankfurt Kurnit Klein + Selz, said, “GDPR, CCPA, and CIPA (California Invasion of Privacy Act) operate differently, yet many companies implement cookie-based approaches designed for GDPR. As a result, they miss key state law requirements, helping explain why California implementation lags. This increases regulatory and litigation risk, including exposure to dark patterns and misleading claims.”
The findings arrive as enforcement accelerates. Fines and lawsuits tied to website data sharing are rising under the CCPA, CIPA, the Video Privacy Protection Act (VPPA), and the EU’s General Data Protection Regulation (GDPR). Regulators in the UK and EU have announced enforcement sweeps. Under the CCPA, penalties are assessed per violation and rise when violations are intentional or involve minors, so a single misconfiguration repeated across millions of sessions can carry material exposure.
The full report, The State of Google Consent Mode, is available at privado.ai.
Vaibhav Antil, Co-Founder and CEO of Privado AI, said, “Collecting consent and enforcing it are two different things. The banner records the choice, and the data reaches Google Ads anyway. What our research shows is that surface-level compliance and manual checks are no longer enough. The controls change overnight and the websites change every week, so a setup that passed last month can be failing today, and no one would see it. Privacy is fast becoming critical infrastructure within businesses, too important and too complex to fail, and as such requires intelligent real-time monitoring.”
About Privado AI
Privado AI is the agentic privacy platform to reduce compliance risk at scale. With AI agents and real-time software scanning designed for privacy teams, Privado AI automates manual compliance work, delivers complete personal data visibility, and helps eliminate privacy risk. As technology has outpaced manual privacy controls, Privado AI has built AI-native solutions to automate risk discovery, assessments, and data maps. It prevents website and app privacy violations with automated audits that verify consent compliance, populates entire assessments with agents that analyze documentation, contracts, and data flows, and builds dynamic data maps by scanning web, app, backend, and third-party software. Founded in 2020 and based in New York, New York, Privado AI is trusted by enterprise and SMB companies around the world, including Riot Games, Principal Financial Group, Virgin Voyages, and HERE Technologies.
Notes to editors
Privado AI’s Web Auditor scanned the top 250 websites by traffic in each market (excluding .edu, .gov and .org domains) across California (CCPA), France and the UK (GDPR), simulating real user sessions that included Consent Mode parameters, Global Privacy Control opt-outs, and reject-all sessions. Sites were scanned before the change on June 11 and again after it on June 16, 2026.
Acronyms: CCPA, California Consumer Privacy Act; CIPA, California Invasion of Privacy Act; VPPA, Video Privacy Protection Act; GDPR, General Data Protection Regulation; GPC, Global Privacy Control.
Almost Half of Top Websites Now Misconfigure Google Consent Mode in Violation of Privacy Laws, Privado AI Research Finds
KYIV, Ukraine (AP) — Ukraine said Tuesday its forces struck a railway bridge, a power plant and other key infrastructure targets in Crimea as Kyiv’s military seeks to isolate the vital Russian-held peninsula in the latest stage of the 4-year-old war.
The drone attacks added to the woes on the Black Sea peninsula, where Russian authorities have had to suspend gasoline sales to civilians as Ukraine has intensified its recent campaign to disrupt supply lines and the electrical grid at the height of the summer tourist season.
The peninsula was seized by force and illegally annexed by Moscow in 2014. Ukraine's increasing use of long-range strikes has highlighted its ability to inflict painful damage on Russia and put added pressure on the Kremlin while Moscow’s advances recently have ground to a near halt, Western analysts and officials say.
Ukrainian Defense Minister Mykhailo Fedorov said last week that his forces are “isolating Crimea with drones.”
“It looks like in the nearest time, Crimea will become an island. This could lead to some very unexpected consequences for Russians,” Fedorov said on a blogger's YouTube channel.
Russian President Vladimir Putin said Moscow had been warned that Ukraine aimed to disrupt energy supplies and Russia’s tourism industry. He didn’t say who gave the warning.
Ukrainian drones “coming in a huge stream” seek to “destabilize” Russian society, Putin said.
Ukraine also has hit targets near to the Kremlin in Moscow and in St. Petersburg, Russia's second-largest city this month.
Ukraine’s Defense Ministry said drones struck an oil storage depot at the Kerch thermal power plant in eastern Crimea, an electrical substation in the west, and a liquefied natural gas distribution station in Simferopol, the peninsula’s second-biggest city.
In addition, Ukraine’s Special Operations Forces said their units, working with what it said was the resistance movement in Crimea, destroyed a rail bridge over the North Crimean Canal near the village of Rozdolne.
The military described the span as a key logistics route used to supply Russian forces in southern Ukraine and said drones began hitting the structure late Sunday to Monday, collapsing part of it. A second strike early Tuesday targeted railway repair equipment deployed at the bridge and its remaining sections, it said on Telegram.
It was not possible to independently verify the Ukrainian claims, and Russian officials made no immediate comment.
Parts of Crimea were without power Tuesday, the area’s energy supplier said. But it attributed the outages to “technical malfunctions” in local electrical grids and said it expected power to be restored within 24 hours.
Both Russia and Ukraine covet the diamond-shaped peninsula for its naval bases and beaches. Crimea's unique location in the Black Sea makes it a strategically important asset, and Russia has spent centuries fighting for it.
Russian-appointed officials in Crimea have appeared reluctant to discuss attacks on the peninsula, but new security measures suggest deepening tension.
Its Ministry of Sport on Tuesday canceled all sporting events, competitions, and training sessions for children through Sept. 1. It described the measures as “aimed solely at ensuring the safety of our children, athletes, and anyone who is involved with sport.”
On Monday, Gov. Sergei Aksyonov said that for security reasons, all summer camps in the region had stopped accepting children and new bookings until Sept. 1.
On the front line in eastern Ukraine, where Russia’s war of attrition has made slow and costly advances since Moscow’s full-scale invasion in February 2022, Ukraine has deployed cutting-edge drone technology to keep the enemy pinned down.
Meanwhile, its medium-range drones have also disrupted Russia’s supply lines to the front, and its long-range strikes have increasingly damaged Russian oil facilities that provide vital revenue for the Kremlin’s war effort.
The Ukrainian Defense Ministry said Monday its forces have hit more than 800,000 enemy targets with drones since the beginning of the year and that 95% of drones used by the armed forces are domestically produced.
The successes have boosted Ukrainian confidence, and President Volodymyr Zelenskyy says sustained foreign support is locked in to help stop Russia.
Officials have shown renewed vigor in talking about the war.
Ukraine’s U.N. Ambassador Andrii Melnyk said Monday that Kyiv remained ready for direct talks with Russia to achieve a “just and lasting peace” based on the U.N. Charter, but warned that Ukraine’s willingness to compromise was not open-ended.
Melnyk said at a U.N. Security Council meeting that a ceasefire along the current front line already represented a major concession and urged Russia to withdraw from occupied Ukrainian territory.
He also said recent Ukrainian strikes had altered the dynamics of the war, adding: “This is just the beginning.”
Meanwhile, the Kremlin is ready to “ensure the security” of its neighbor and ally Belarus, Russian Foreign Minister Sergey Lavrov said Tuesday, days after Zelenskyy demanded that Belarus remove relay equipment on its territory that Kyiv said aided Russian drone attacks.
The relay stations are used for signal transmissions to Russian drones attacking Ukraine, according to Zelenskyy.
Lavrov told the Russian news agency Interfax that Kyiv was trying to drag Belarus into the conflict. Moscow, in fact, had used Belarus territory to launch its invasion of Ukraine.
Follow the AP’s coverage of the war in Ukraine at https://apnews.com/hub/russia-ukraine
People buy food at an improvised outdoor market, burnt cars in the foreground, surrounded by damaged buildings covered with street artists paintings close to a big city marketplace that was ruined recently by Russian missiles in Kyiv, Ukraine, Monday, June 22, 2026. (AP Photo/Efrem Lukatsky)
Cars line up at a petrol station in Simferopol, Crimea, Friday, June 12, 2026. (AP Photo)
A mother pushes a stroller past a damaged building covered with street artist paintings and a big city marketplace that was destroyed recently by Russian missiles in Kyiv, Ukraine, Monday, June 22, 2026. (AP Photo/Efrem Lukatsky)
In this photo provided by the Ukrainian Emergency Service, emergency services personnel work to extinguish a fire following a Russian air attack in in Zaporizhzhia region, Ukraine, Monday, June 22, 2026. (Ukrainian Emergency Service via AP)
