Original Research
We audited 24 East Bay business websites. 22 had no cookie consent.
We ran 24 local small-business websites (restaurants, salons, contractors, dentists, auto shops) through a twelve-point technical audit: HTTPS, meta descriptions, mobile viewport, heading structure, image alt text, tap-to-call, privacy policy, cookie consent, robots.txt, sitemap, content depth.
These are real, working businesses, and several have hundreds of five-star reviews. The results were worse than we expected and very consistent.
The headline: 22 of 24 had no cookie consent banner
We mean no banner at all.
California’s CCPA and CPRA expect a business collecting personal information from California residents to give people a way to control non-essential tracking, and to honor an opt-out. Almost nobody in our sample had anything, and the gap was the same across the whole market.
Alt text is a catastrophe
Alt text is the description a screen reader speaks aloud to a blind visitor. To that visitor, an image without it is a locked door, and Google Images can’t see it either.
The worst result in our sample was a painting company with 64 of its 66 images missing alt text. For a painter, that’s the entire portfolio, the actual proof of their work, unreadable to a screen reader and invisible to image search.
They hadn’t decided to exclude anyone. Nobody had ever told them the field existed.
The pattern nobody talks about: Wix and Squarespace scored worst
This surprised us, so we’ll state it plainly. Every Wix and Squarespace site in our sample failed on both missing alt text and missing privacy/cookie compliance. The WordPress sites scored better.
The problem is less the platforms than what they imply. Drag-and-drop builders promise that anyone can make a professional website, and the result does look professional. The compliance and accessibility layer underneath is never mentioned, so it never gets built.
The site looks finished, and that’s the trap.
Tap-to-call is missing almost everywhere
Most of these businesses live or die on the phone ringing. Most of their visitors are on a phone. And on most of the sites, the phone number was plain text that you couldn’t tap.
One massage business in our sample has 1,268 reviews and a phone number you cannot tap.
One site scored a perfect zero
A different painting company passed all twelve checks with no failures.
We mention it because it matters. The bar here is sitting on the floor and few businesses have stepped over it, but one local contractor did. It can be done.
What this actually means for you
If you own a small business with a website, the odds are good (roughly nine in ten, based on our sample) that you have no cookie consent, missing alt text and no tap-to-call.
None of these are expensive, and all of them are boring. That’s exactly why nobody fixes them, and why fixing them puts you ahead of nearly everyone you compete with.
Want a straight answer about your website? We’ll tell you what’s working, what isn’t, and the top three things to fix. Free, no pitch.
Methodology: 24 non-chain small-business websites in Concord, Pleasant Hill, Walnut Creek and Martinez, sampled from public listings and audited against 12 automatically detectable, homepage-level signals in July 2026. This is a practical technical baseline, not a legal review. A privacy policy that matches your actual data practices should be confirmed with an attorney.