On-demand session

The Global State of Privacy Compliance Across the Digital Experience Layer

Most conversations about consent compliance run on anecdote. This one runs on a survey. Censuswide interviewed 800 privacy, legal, marketing and IT professionals across four countries and five industries in May 2026, at mid-size to large enterprises.

• 800+Respondents
• 4Countries
• 5Industries
• May 2026Censuswide fieldwork

The most common way organizations find out about unauthorized scripts is regulatory or legal notification. They learn about compliance failures through enforcement, not internal monitoring.

From the research presented in the session

Oskar Trpisovsky, who leads KPMG’s privacy and data protection practice across Ontario and Atlantic Canada, moderates. He is joined by Ian Wardell, senior privacy and risk engineer at Reddit, and Ivan Tsarynny, CEO of Feroot. The panel takes the findings apart section by section rather than reading them out.

Five numbers that set the agenda for the hour:

• 81% Scripts fire before consent is given. Among organizations that have deployed a consent management platform, 81% have confirmed (53%) or suspect (28%) that scripts fired before the visitor made a choice. These are the teams who did the right thing and bought the tool.
• 8% Almost nobody can account for what runs on their own site. Only 8% believe all their scripts are fully authorized. The other 92% cannot account for all data collection activity across their properties, and 38% put the authorized share below half.
• 29% The regulator tells you first. Regulatory or legal notification is the single most common way unauthorized scripts get discovered — ahead of internal security review (26%) and manual audit (24%). Fewer than one in four use automated scanning.
• 88.6% Vendors change what they collect without telling you. Nearly nine in ten organizations have had a marketing vendor silently change its data collection practices without notifying the privacy team. For 54% it has happened more than once.
• 42% Authority and practice sit in different departments. IT and security hold formal approval authority for new scripts at 65% of organizations. But marketing teams are the ones most frequently adding them, at 42% — against 13% for privacy and legal.

Nearly every organization surveyed — 99.4% — runs at least one third-party script, and the median environment carries between 11 and 50 of them at once. The panel covers what is structurally hard rather than merely neglected: that two visitors loading the same page from different places get different scripts, that real-time bidding means the vendor list is not fixed at deploy time, and that first, second, third and fourth parties all end up in the same browser session with no single owner.

Worth watching if you own:

• Privacy program strategy, and you want benchmark data rather than vendor claims
• Vendor governance, and the fourth-party problem is currently unowned
• Board or regulator reporting, and “we have a CMP” is no longer a sufficient answer