More than 90% of publishers that use compliance management platforms are passing consumer data on to third parties before actually receiving consent, according to research from digital compliance technology company Compliant.

The data comes from a Publisher Compliance Index based on examination of billions of ad impressions and scoring regulatory risk for nearly all individual publishers outside of China, and from a Campaign Compliance Index that scores data compliance across brands’ entire media spend.

Compliant bills its tracking as adding a privacy compliance dimension metric alongside such things as viewability, brand safety and sustainability in media buys. The research finds that most of the online advertising system is out of sync with U.S. privacy laws such as the California Privacy Act and Virginia’s Consumer Data Protection Act, according to Compliant.

“We’re not trying to solve all the privacy problems,” said Jamie Barnard, Compliant CEO and a former general counsel of Unilever. “What we’re trying to do is identify the areas where advertisers, agencies and publishers need to fine-tune the engine and take some risks out of the ecosystem.”

Barnard said Compliant looked at about 600 ad campaigns from a dozen brands on the open web that ran on 150,000 publishers and generated about 1.5 billion ad impressions, and found 85% of those impressions were below the company’s “compliance baseline.”

About 62% of U.S. publishers have consent management platforms, but they mostly aren’t managing consent properly, Barnard said. “It’s not the fault of the CMP,” he said. “It’s just that they’ve been configured wrongly. So, every consumer that lands on a U.S. publisher site who’s asked whether they consent to use cookies or other tracking technologies, if they say no or give discretionary consent, frankly it doesn’t matter, because in most cases the data fired before the pop-up even appeared.”

Also read: A marketing guide to CES

Barnard added that publishers generally haven’t gotten themselves into the situation knowingly. “Often it’s advertisers and ad tech vendors that push these tags into the ecosystem, because people want the data,” he said.

“We’ve seen Compliant’s indices and underlying data and believe that media buyers will start to scrutinize data compliance alongside brand safety, viewability and ESG metrics when choosing their media partners and programmatic supply paths,” said David Kohl, president and CEO of TrustX, a private marketplace provider, in a statement. “Strong privacy, data protection and data compliance build consumer trust, which creates a clear competitive advantage for publishers and advertisers that get it right.”