Original Research
We audited 24 East Bay business websites. 22 had no cookie consent.
We ran 24 local small-business websites — restaurants, salons, contractors, dentists, auto shops — through a twelve-point technical audit. HTTPS, meta descriptions, mobile viewport, heading structure, image alt text, tap-to-call, privacy policy, cookie consent, robots.txt, sitemap, content depth.
These are all real, working businesses. Several have hundreds of five-star reviews. And the results were both worse than we expected and remarkably consistent.
The headline: 22 of 24 had no cookie consent banner
Not a bad one. None at all.
California’s CCPA and CPRA expect a business collecting personal information from California residents to give people a way to control non-essential tracking, and to honor an opt-out. Almost nobody in our sample had anything. This wasn’t one company being careless — it was the entire market, uniformly.
Alt text is a catastrophe
Alt text is the description a screen reader speaks aloud to a blind visitor. Without it, an image is a locked door — and it’s also invisible to Google Images.
The single worst result in our sample: a painting company with 64 of its 66 images missing alt text. A painting company. Their entire portfolio — the actual proof of their work — unreadable to a screen reader and invisible to image search.
They hadn’t decided to exclude anyone. Nobody had ever told them the field existed.
The pattern nobody talks about: Wix and Squarespace scored worst
This surprised us, so we’ll state it plainly. Every Wix and Squarespace site in our sample failed on both missing alt text and missing privacy/cookie compliance. The WordPress sites scored better.
This is not really a knock on the platforms. It’s a knock on what they imply. Drag-and-drop builders promise that anyone can make a professional website — and they deliver something that looks professional. The compliance and accessibility layer underneath is simply never mentioned, so it never gets built.
The site looks finished. That’s the trap.
Tap-to-call is missing almost everywhere
Most of these businesses live or die on the phone ringing. Most of their visitors are on a phone. And on most of the sites, the phone number was plain text — not a link, not tappable.
One massage business in our sample has 1,268 reviews and a phone number you cannot tap.
One site scored a perfect zero
A painting company — a different one — passed all twelve checks. No failures.
We mention it because it matters: this isn’t a story about how everything is broken and you’re doomed. It’s a story about a bar that is sitting on the floor, and how few people have stepped over it. One local contractor did. It’s entirely achievable.
What this actually means for you
If you own a small business with a website, the odds are strong — based on our sample, roughly nine in ten — that you have no cookie consent, missing alt text, and no tap-to-call.
None of these are expensive. All of them are boring. That is precisely why nobody fixes them, and precisely why fixing them puts you ahead of nearly everyone you compete with.
The comforting thing about a low bar is how easy it is to clear.
Want a straight answer about your website? We’ll tell you what’s working, what isn’t, and the top three things to fix. Free, no pitch.
Methodology: 24 non-chain small-business websites in Concord, Pleasant Hill, Walnut Creek and Martinez, sampled from public listings and audited against 12 automatically detectable, homepage-level signals in July 2026. This is a practical technical baseline, not a legal review. A privacy policy that matches your actual data practices should be confirmed with an attorney.