The power of an enterprise privacy compliance governance platform lies in automating how organisations validate their compliance with privacy regulation, under:

• Regional regulation, inc. General Data Protection Regulation & ePrivacy Directive
• National legislation, inc. Privacy and Electronic Communications Regulations & Data Use and Access Act 2025

Modern marketing stacks and website ecosystems are complex, dynamic, and often sprawling across multiple domains, third-party tools, and fragmented ownership. The Cressive Privacy Score creates a single, objective, quantifiable measure that enables governance at scale.

It can be used by DPOs in their role to ensure operations comply with regulations, by CMOs as the owners and promoters of brand assets (as well as their marketing agencies responsible for campaign activities), and by technical teams charged with implementation.

Why a Privacy Score Matters

1. Automation with Precision, Scale & Speed

Governance processes are enabled by automated scanning and provide:

• Deep detection across modern marketing and analytics technology stacks
• Independent verification and AI-assisted identification of complex tracking patterns
• Scalable and fast auditing across large portfolios of websites and digital properties
• Continuous monitoring rather than periodic manual checks

The resulting privacy score becomes the central metric used throughout the governance lifecycle – from auditing and remediation to ongoing monitoring and improvement.

A well-known management maxim often attributed to Peter Drucker states:

“What gets measured gets managed.”

A standardised privacy score enables organisations to prioritise remediation, benchmark progress, and provide measurable governance.

2. What the Privacy Score Measures

A website can only be considered privacy compliant when it achieves 100 /100.
Any lower score indicates a gap in compliance with legislation regarding the processing of personal data.

The Cressive Privacy Score evaluates:

• Use of tracking technologies
• Consent practices
• Data sharing with third-party domains
• Behaviour of scripts and marketing technology
• Compliance before and after consent interaction

Three Critical Phases Are Assessed

1. Pre-consent – What tracking is initiated before the user interacts with the banner
2. Consent interaction – The banner, choices presented, and consent capture
3. Post-rejection – Whether tracking respects the user’s refusal

3. How the Assessment Works

Detection Includes:

• Cookie deployment timing and type
• Third-party domain network requests
• Marketing and analytics technology firing patterns
• Effectiveness of consent enforcement

Legal Evaluation Framework

Assessed against:

• GDPR Articles 5, 6 and 7 (principles, lawful basis, consent)
• ePrivacy Article 5(3) (cookies and tracking technologies)
• UK regulatory requirements under PECR and DUAA

4. Scoring Methodology

5. Data Collection & Scope

• Analysis is based solely on publicly observable behaviour (NB nothing sneaky, no hacking, all externally available data, experienced by every user and seen by regulators)
• No privileged access, credentials, or internal systems are used
• Results reflect what any visitor experiences
• Findings are independently verified

6. Integrating Privacy Scoring Into Governance & Marketing Operations

The Privacy Score becomes most powerful when integrated into:

• Marketing dashboards
• Analytics reporting frameworks
• Ongoing operational monitoring

This allows marketing and digital teams to see compliance status directly, rather than waiting for issues to be escalated by legal, privacy, or security teams.

Agencies and external partners should be held accountable for the tracking technologies they deploy, ensuring privacy is built into the digital supply chain rather than retrofitted.

7. Operationalising Privacy by Design

The Cressive Privacy Compliance platform embeds:

• Continuous monitoring
• Portfolio-wide visibility
• Automated auditing
• Clear remediation pathways

This shifts privacy from a periodic compliance exercise into an ongoing operational discipline.

Summary

A measurable, standardised privacy score enables organisations to:

• Build trust through demonstrable compliance
• Understand compliance posture at scale
• Prioritise remediation
• Maintain regulatory alignment
• Operationalise privacy governance

The post Cressive Privacy Score: Calculation & Methodology appeared first on Cressive DX.

Here’s the thing about agencies and privacy compliance – they don’t mix.

The truth is – privacy compliance tools weren’t built for agency operations.
(btw if you need a fast intro to privacy compliance, this quick read will help.)

They expect you to manually configure scanning for each client/site, provide violation reports without explaining how to actually fix things, and miss violations anyway. On the other hand, clients expect agencies to “handle the privacy stuff” but don’t want to pay for the time it actually takes using conventional tooling.

Below we explain how Cressive Privacy Compliance helps digital agencies efficiently implement privacy compliance workflows their clients need.

✔ Cressive Privacy Compliance enables fast audits, at scale

Assessment-focused privacy compliance that integrates with site evaluation workflows:

• Minimal configuration setup: Start comprehensive privacy scanning without any pre-configuration
• Automated classification: AI-powered violation categorization reduces manual review requirements
• Batch assessment capabilities: Efficiently evaluate privacy compliance across multiple client sites, locations, privacy law regimes, reporting into client-wise portfolios

✔ Cressive Privacy Compliance helps marketing agencies succeed

Our super-smart Privacy Compliance agent, Cressive AI, understands both digital marketing and privacy law. It helps automate the entire privacy compliance process for our clients and agencies.

• Pre-deployment scanning: Analyse privacy compliance impact before go-live
• Complete tracking detection: Network requests, pixels, API calls, and data transmission patterns that traditional tools miss
• Marketing platform integration: Understand tracking implementations across Google Ads, Facebook, LinkedIn, and other campaign platforms
• Campaign-specific guidance: Remediation guidance based on Martech being used.

Developer-focused remediation guidance that connects privacy compliance and technical implementation:

• Prioritized fix lists: High-impact violations first
• Technical implementation steps: Specific changes, configuration adjustments, and platform settings for each violation type
• Platform-specific guidance: Different approaches for WordPress, Shopify, custom applications, and various CMS platforms

The post Why Agencies Struggle with Client Privacy Compliance appeared first on Cressive DX.

✔ Cressive AI categorises all tracking technologies without any manual input

Our super-smart Privacy Compliance agent, Cressive AI, understands both digital marketing and privacy law. It helps us achieve:

• Instant categorization: New tracking pixels get automatically classified by business purpose and regulatory risk
• Marketing intelligence: Differentiates cart abandonment from advertising retargeting, conversion measurement from audience building
• Campaign-aware scanning: Understands Google Ads, Facebook Campaigns, and marketing automation in context
• Risk-based approvals: No-risk functional tracking gets approved automatically; high-risk advertising pixels get flagged.

The post Why Marketing Teams Struggle with Privacy Compliance appeared first on Cressive DX.

Problem 1: Privacy Compliance Reporting for Execs

Board meetings and executive reviews typically include privacy compliance questions like:

• “How compliant are we across all markets to their respective privacy laws?”
• “Are we improving or getting worse quarter-over-quarter?”
• “If we’re regressing, where and why?”

For organisations with multiple websites across different countries, current tools typically show:

• Website A: “5 violations detected”
• Website B: “Cookie scan complete ✓”
• Website C: “Tracking pixels found”

These reports don’t answer the strategic questions. When violations increase from 3 to 7, it’s unclear whether compliance actually worsened or scanning improved. The data doesn’t indicate which business units or geographic regions are driving trends.

✗ Other tools don’t solve the reporting problem

Current tools have limitations in executive-level reporting:

• Limited comparative context: Show current violations but don’t track trends or explain changes over time
• No root cause analysis: Can’t identify whether increases come from new violations, improved detection, or specific business units
• Equal violation weighting: Treat all violations the same, making it difficult to assess compliance risk
• Fragmented reporting: Each tool provides disparate data without portfolio-level aggregation or geographic context
• Tactical focus: Generate violation lists rather than help define a strategy for privacy compliance across the organisation

✔ Cressive Privacy Compliance solves the Exec Reporting Problem

Executive dashboards that address strategic questions:

“How compliant are we?”

• Risk-based scoring (0-100) across all properties and jurisdictions
• Weighted by violation severity and regulatory context
• Adjusted for classification accuracy

“Are we improving or worsening?”

• Quarter-over-quarter trend analysis with explanations
• Scoring that accounts for detection improvements
• Progress tracking against compliance targets

“Where and why are we regressing?”

• Geographic and business unit breakdowns showing risk concentration
• Root cause analysis: new violations vs. detection improvements
• Automated alerts when specific regions or properties show compliance issues

Problem 2: Privacy >> Cookies

Quarterly compliance reviews may show clean results, but regulatory investigations can reveal network requests to Google Analytics and Facebook that transmitted user data without consent. These were added by marketers, who don’t have compliance visibility. These violations often go undetected by scanning tools.

As we explain in our on primer on website privacy compliance, network requests can transmit personal data (IP addresses, referrer URLs, user agents) to third parties through pixels and API calls without setting cookies. Tools focused on cookie detection miss these data transmissions.

✗ Most tools can only detect non-compliance from cookies

Detection and diagnostics of violations caused by network requests, hybrid mechanisms and emerging techniques is very hard. That’s why most tools either don’t detect these or require extensive pre-configuration by the user to blacklist them individually.

Cookie-focused and pre-configured scanning creates detection gaps, that put your brands at risk:

• Network-level tracking: API calls, pixels, and beacons transmit personal data without setting cookies
• Hybrid mechanisms: JavaScript combines cookie data with network requests
• Advanced techniques: Browser fingerprinting, cache timing attacks, and other cookie-less methods
• Third-party integrations: Marketing automation, chat widgets, and analytics tools making data calls

✔ Cressive Privacy Compliance detects and diagnoses all tracking tech

• Network request analysis: Every API call, pixel fire, and data transmission captured and analysed
• Data flow mapping: Visual representations of where user data goes, not just where cookies are set
• Hybrid violation detection: JavaScript-cookie combinations that create privacy violations
• Behavioural analysis: Automatic detection of fingerprinting, tracking pixels, and other techniques

This provides visibility into data transmission patterns that regulators examine during investigations.

Problem 3: Why is a violation a violation and how risky is it?

Compliance scans often flag violations but provide limited explanation. Legal teams receive reports like:

• “Adobe Analytics cookie: VIOLATION”
• “Facebook network request: VIOLATION”
• “Google Tag Manager script: VIOLATION”

Without understanding why each item violates regulations, legal teams spend time researching each violation to understand actual compliance risk and prepare explanations for potential regulatory scrutiny.

✗ Most tools don’t provide the diagnostics and risk assessment

Most tools use basic rule matching without providing legal reasoning. They often don’t explain:

• Regulatory context: Why specific cookies or requests create compliance problems
• Classification confidence: Whether categorisation is based on database knowledge or assumptions
• Risk severity: How violations compare in terms of regulatory exposure/ which should be fixed first

✔ Cressive Privacy Compliance provides detailed violation reasoning and risk assessment

Every violation flagged by Cressive Privacy Compliance includes detailed compliance reasoning:

• Classification method: Database match, rule-based detection or AI-assisted classification
• Risk assessment: Severity level based on data type, party classification, and regulatory context
• Remediation guidance: Specific technical steps to resolve the violation, which your technical teams, whether in-house or outsourced to agencies will thank you for.

Legal teams get defensible explanations for compliance decisions rather than just violation flags.

The Business Impact of Compliance Gaps

Privacy violations create measurable business risks:

• Regulatory fines: Up to 4% of global revenue under GDPR, $7,500 per violation under CCPA
• Legal costs: Investigation responses, regulatory defense, and potential litigation
• Operational disruption: Emergency compliance fixes, campaign shutdowns, and audit preparation
• Reputation impact: Consumer trust issues and competitive disadvantage

Organizations that avoid these problems typically have comprehensive visibility into their compliance status rather than relying on tools with detection gaps.

Next Steps

The post How current Privacy Compliance tools fail privacy teams appeared first on Cressive DX.

How It Works

Add our “Privacy Monitored by Cressive” badge to your website footer. 

It signals to visitors that you’re compliant to GDPR — while we continuously scan your site to ensure it stays that way.

• Continuous Monitoring – Cressive Privacy Compliance, our best-in-class software, scans your website weekly for privacy issues, including cookies, trackers, and data collection methods.
• Customer Trust – Display the badge to prove to visitors that privacy compliance and data protection matter to you. That they – and their wishes – matter to you.
• Instant Alerts – Get notified the moment we detect a problem, so you can fix it before it becomes a fine.

FAQs

What does the badge mean?
It means Cressive actively monitors your website for privacy issues. If we find a problem, you get alerted so you can stay compliant.

I already have a Cookie Banner. What value does a badge add for me?
As we over in our privacy compliance introductory guide, only 5% of sites are GDPR/ privacy law compliant despite having a cookie banner. Our monitoring, on the other hand, captures and flags all tracking technologies, allowing full compliance. The badge guarantees we’re monitoring your site.

How often do you scan my website?
Monthly automated scans (unless you want more frequent).

What happens if you find compliance issues?
You’ll receive an alert with details on what needs fixing. Your badge stays active while you resolve them. 

Does this replace my privacy policy?
No. You still need GDPR-compliant policies and cookie consent. But we automate the monitoring whether your live site actually follows them.

So why monitor privacy?
Because technology changes constantly. Staying compliant means respecting your customers — and staying on the right side of the law.

What if I want to remove the badge?
You can. We’ll stop monitoring.

How much does it cost?
Ask about basic monitoring, or upgrade to premium features: detailed reports, priority support, and deeper scans.

What compliance standards do you monitor?
GDPR, CCPA, PDPL, PIPEDA, the ePrivacy Directive — plus best practices in cookie consent and data collection transparency.

Can customers click on the badge?
Yes. It links to a public status page showing your compliance level and last scan date.

Why Join the Privacy Monitor Network?

The Cressive Privacy Monitor network is designed to show solidarity in respect for customer privacy in a world moving the wrong way. Fight entropy with us.

It’s a cost-effective way to:

• demonstrate respect for your customers,
• meet legal digital privacy obligations, and
• reduce one more worry in managing your business.

The post Cressive Privacy Monitor Network appeared first on Cressive DX.

If reality of the current Internet is only 5.4% of websites are compliant, why have laws that aren’t policed? Actually they are — more fines are being issued every month.

Will you avoid a fine — or be next to be outed by your customers on social media for not caring?

Perhaps more remarkable: most non-compliant site owners don’t know they’re non-compliant until we tell them.

An Expensive Mistake 95% of Companies Are Making

This doesn’t mean 95% of companies don’t care about privacy — it means most think they’re compliant when they aren’t. 

Too many marketers believe a cookie banner = compliance. It does not. Not even close. We can show you.

A cookie banner can be like a cardboard cut-out security guard at the door while thieves climb through every window. It looks official, but the real threats walk straight in.

The current market share of cookie banners: OneTrust leads way with a 16% market share — and growing fast. But a cookie banner can be like printing an MOT certificate – pointless unless you perform the test itself and ensure safety, in this case privacy; the sector is flooded with ineffective, poorly configured banners.

What’s Collecting Data While Your Cookie Banner Isn’t Looking

And while you’re focused on cookies, everything else is still harvesting data:

• Network requests send IP addresses, referrer data, and user agent strings every time a page loads.
• Tracking pixels from Facebook, Google, LinkedIn beam back data before your banner even appears.
• Browser fingerprinting builds unique profiles from device settings, fonts, timezone.
• Client-side scripts from analytics, chat widgets, marketing tools start collecting instantly.

Your cookie banner may see none of this; may block none of this. Meanwhile, bad actors exploit these methods the way spammers dodge filters: endlessly, for their own gain.

If you don’t know what’s firing, you need to audit your website’s privacy.heoretical. It’s operational. And “we thought the banner worked” won’t impress regulators – nor customers.

When the Fines Come, They Come Hard

Privacy regulators aren’t bluffing. During the last 18 months:

• Meta: €1.2 billion (data transfers)
• Amazon: €746 million (processing violations)
• TikTok: €345 million (failing to protect minors’ data)

These weren’t companies without cookie banners. They were companies who thought they were “covered.”

Healthcare, pharma, and finance are particular targets due to industry standards. Their banners and tracking setups are under scrutiny.

The pattern is clear: cookie banners create false confidence, and false confidence creates fines. (Privacy banner would be a better term than cookie banner but that’s another post…)

Your Website Changes Daily — Your Compliance Doesn’t

Most companies audit quarterly. That’s 89 days where a single rogue script can break compliance and cost millions / leave you at brand risk. (Think we’re exaggerating? Ask us about the predicament some of our US clients find themselves in.)

Meanwhile, your cookie banner sits there, looking official, blocking the same old cookies, while new trackers slip past unnoticed.

How to Increase the 5% of Compliant Websites

Truly compliant companies don’t just manage cookies. They monitor everything:

• Catch network requests sending data without consent.
• Detect when new trackers appear.
• Spot fingerprinting and pixels.
• Automate scanning in real-time, not months later.
• Keep detailed logs, timestamps, and proof regulators can accept.

Stop Guessing, Start Knowing

Your cookie banner is necessary but nowhere near sufficient. (Original: Your cookie banner is necessary but not sufficient. It’s not enough.)

If you’re serious about avoiding fines, you need to see what’s really tracking users. In business terms: audit, monitor, act.(Original: – where the business and professional version of ‘see’ is: audit, know, be proactive, monitor.)

Because when regulators come calling, “we had a cookie banner” won’t save you.

Fines are growing in size and frequency. Today, mostly for egregious breaches — but how long until regulators make an example of companies who simply flout the rules?

And beyond fines, there’s reputational risk: being outed on social media as a brand that ignores privacy.

Are you fine with that?

The post Cressive Privacy Data – Q3 2025 appeared first on Cressive DX.

Do you care about privacy? You should. Your customers do. The law says you must. Over 80% of users decline cookies – is that you? Yet more than 95% of websites track them anyway – is that you too?

Technically illegal; alarmingly common. Your site(s) is probably already non-compliant, ie. illegal.

Whenever inventing new technology (steam engines, electricity, TikTok), we rush to exploit it first and ask ethical questions later. Cookies were no different. Regulators are now catching up and fining companies millions for illegal non-compliant websites. And while the spectre of a fine may seem a long way off, can you in good conscience put hand on heart and say your website is respecting customer privacy?

Here is an introductory guide to privacy compliance and customer tracking — to challenge you: how not to be the moral equivalent of spam in your customers’ inbox. Do you like getting spam? No. Do you send spam? No. Do you like being tracked online? No. Does the website you’re responsible for track?…

Stage 1: Are You Required to Comply — Or Choose Not To?

Is Your Website (i.e. You) Legally Required to Comply?

Does this apply to you and me? In short, most likely, yes. If you:

• Receive traffic from the EU, UK, California, or Canada – to name but four hotspots
• Use any analytics, ad tracking, or CRM integrations – ie. is other than a single dormant page
• Share data with platforms for marketing or personalisation – most do, even unwittingly.

GDPR says: anything non-essential requires opt-in consent before it’s set.  GDPR is the main law; the ePrivacy Directive (a.k.a. “the cookie law”) is its sidekick. Together, they require prior, informed, opt-in consent. It is fast becoming the global standard, with CCPA PIPEDA and PDPL on the inside rail.

How & What We’re Talking About

Cookie banners: just showing one does not make you compliant. Most banners today are broken or misleading.

• Cookies should not be dropped before consent, but 95% of sites do it anyway – really
• Even when users click “Decline,” banners ignore this and sites still track them – alarmingly
• Obscure designs, delayed opt-outs, and dark patterns are everywhere – we’ve all seen it.

This applies to any website, large or small. And chances are you’re using tracking technology, whether you know it or not.

What Counts as Tracking?

• Cookies even for “basic” analytics – like Google Analytics (GA4), Google Tag Manager (GTM)
• Third-party pixels – like Meta/Facebook, LinkedIn
• Session replays – like Hotjar, FullStory
• Network requests, script injections, fingerprinting, pings, beacons, eTags – and many more nasties.

Why Businesses Don’t Comply

1. They don’t know the law – but ignorance is no defence
2. They assume tracking violation is too trivial to matter, or deprioritise it – to stay “under the radar”
3. They thought “someone else” in their company did it – yes, including that ‘external person’ you thought knew what they were doing when they set it up, and you didn’t know how to check their work
4. They ‘put off’ implementing consent so as not to ‘miss out on’ traffic data – an inevitable consequence
5. They don’t know for one website let alone the 100 they manage – but ‘it’s difficult’ is no defence.

Decision Point:

Are you comfortable tracking users without their consent, knowing it breaches the law — or by not knowing — if you might not get caught? This isn’t a grey area. It’s black and white, and you’re running a red light. 

Do you in good conscience know either way?

Stage 2: Are You Taking Compliance Seriously?

Best not guess; proactively audit your risks. Even if enforcement hasn’t reached you yet, your privacy setup may already expose you — find out and ensure you know what your websites track, and how.

Red Flags & Risk Triggers

• You use Google Analytics, Meta Pixel, TikTok Ads, or HubSpot – or you have agencies adding this stuff – and let’s be very clear that any tracking of this kind is a serious risk to your compliance
• Your banner appears, but doesn’t block anything
• You use embedded YouTube, Maps, Calendly, or chat tools that set cookies silently
• You can’t say: “How many trackers fire on our homepage and are they blocked until consent?”

Key Questions to Ask (and Answer) Now

• Is our banner legally configured – or just cosmetic?
• Do we log consent properly – or just assume?
• Can we detect new trackers when devs or agencies add them – with or without our knowledge?
• Can we prove, with evidence: “We comply with the relevant GDPR/CCPA/CPRA rules”?

If you can’t answer these, your risk isn’t theoretical, it’s operational. Saying “we thought the banner was set up correctly” won’t impress regulators – nor customers.

Stage 3: Full Technical Compliance — Treat Customers With Respect

This is where mature organisations arrive (tickets for a trip to Cressive-ville available below) — because they care about customers, or at least about brand trust, data quality, and being ready for regulatory audits.

What Real Compliance Looks Like

• Privacy banners that actually block all un-consented tracking with suitable and correct configuration
• Automated detection of rogue scripts, cookies, and trackers (both client- and server-side)
• Customers’ geography accounted for (stricter in EU, Middle East, Canada, increasingly the US)
• Audits logged and documented, with monitoring that show regulators you are proactive
• Consideration of Global Privacy Control (GPC) – OK, a more advanced aspect but it’s here and important, and real compliance knows where you stand on it.

Still need convincing? There’s (a lot) more: i) the existence of Google Consent Mode* (GCMv2) confirms even Google knows that GA4 is not compliant, and ii) are you aware of the stipulation in Google’s own T&Cs that to use its products, like Google Ads, a (/your) website must itself remain privacy compliant? – therefore all those 95% of non-compliant websites will therefore be simultaneously not compliant with Google T&Cs , and iii) MS Clarity has followed suit in requiring you to be compliant to use it… … …

*(Google Tag Manager is now ruled to be not compliant by the German courts. True. Holy moly… Therefore if you use GA, GTM or GCMv2 on your website then it is likely illegal, Blimey. )

So, Why It Matters & What Matters Most To You

• Regulatory risk: non-compliant website (with broken banners, etc etc) now attract fines
• Brand trust: respect your customers or lose them
• Investor diligence: privacy is part of M&A checklists
• Legal compliance: you obey the law elsewhere – why not in website privacy compliance?

This isn’t just hygiene. It’s modern digital governance. It’s your brand respecting customers. And it’s the law.

A Real-Life Example (Because Humans Like Stories)

An American retailer installs a marketing pixel. EU visitors arrive. No consent asked. Data flows. One visitor complains. Regulators agree: personal data was processed without consent. Result: a hefty fine. This isn’t theory. It’s happening. But ignoring privacy isn’t just illegal — it’s bad manners, and a risk to your brand.

You risk brand reputation when you find yourself outed in social media by an irate customer whose privacy you did not respect. (Indeed, you might have the privilege of being showcased in one of our ‘Bad Examples of Privacy‘ updates, alongside ‘Good Examples of Privacy’ against which to benchmark your brand…)

The Three Stages (For People Who Like Tables)

Next Action?

Nearly every website tracks. Worryingly few do it transparently, respectfully, and legally.

Think of this as digital hygiene. In the 19th century, people learned not to dump sewage in the town well. In the 21st, we’re learning not to drop trackers before consent. Do your bit: our rivers — digital and real — are polluted enough already. You need to track — you do marketing — but do it nicely, and do it legally.

(Pragmatically, at least demonstrate your proactivity in being compliant,, to avoid costly and time consuming legal suits — be like our US clients, be monitored, and avoid getting sued every other week.)

Your choice: fix it now, or become the case study quoted in the next regulator’s press release. We can help. Take a Cressive approach to doing privacy properly: read more and ask for a free scan …

The post Is Your Website Tracking Visitors Legally? appeared first on Cressive DX.

In Part 1 of our series, we introduced Share of Voice (SOV) as a critical metric for understanding your brand’s digital market presence. Now, let’s dive deeper into how this powerful metric is calculated and why it provides insights that simpler metrics simply can’t match.

The Science Behind SOV Calculation

Let’s look at how our DX Studio data platform calculates Share of Voice in practice through a systematic five-step process:

1. Data Collection

First, we gather search data for your target keywords by:

• Identifying keywords that define your market
• Collecting SERP data across these keywords
• Capturing both your brand’s and competitors’ positions

Our experience shows that 250-1000 keywords provide the optimal balance for statistical significance, depending on your sector.

2. Position Analysis

We analyze the raw position data to understand:

• Your brand’s placement in search results
• Position changes over time
• Competitor presence for your target keywords
• Position distribution across keyword groups (awareness, consideration, action)

3. Traffic Estimation

To estimate potential traffic value, we combine:

• Search volume data
• Position-based CTR models
• Search features that affect CTR

This transforms position data into visibility and potential traffic estimations.

4. Share Calculation

We calculate market share by combining position and traffic data across all competing brands, expressing your brand’s portion as a percentage of the total market. This gives us your Share of Voice – the percentage of potential search visibility belonging to your brand.

5. Monthly Aggregation and Reporting

Daily data is aggregated and reported monthly using DX Spotlight to provide:

• Stable metrics that smooth daily fluctuations
• Period-over-period comparisons
• Progress tracking against targets and competitors

What makes this metric particularly powerful is its ability to account for both the quality of your positions (through CTR curves) and the quantity of potential traffic (through search volume data). This combination provides a much more accurate picture of market presence than simpler metrics like average position or keyword rankings alone.

SOV in Action: A Real-World Example

Let’s dive into a real-world example that demonstrates how Share of Voice translates into actionable insights. Looking at one of our client performance charts, we can see significant growth in both Position Score and SOV over time:

A detailed analysis of position ownership across keyword categories reveals:

Key insights from the data:

• Increased Top 3 positions across all stages driving SOV growth
• Strong dominance in awareness stage (47.1% of Top 3 positions)
• Weaker presence in action stage despite recent gains
• Concentrated growth in high-CTR top positions
• Only 30% of consideration and 25% of action keywords owned by tracked competitors, revealing unidentified market players

The month-over-month improvements might seem incremental, but they represent significant gains in market visibility when you consider:

• The competitive nature of these positions
• The high search volume associated with these terms
• The compounding effect of improvements across different keyword groups

Short-Term vs. Long-Term Value of SOV

The example above demonstrates the immediate value of SOV in tracking and improving digital performance. While this client is already seeing tangible benefits, the real power of SOV lies in both its short-term insights and long-term predictive capabilities.

As seen in our research and echoed by experts like Les Binet, SOV delivers value across multiple time horizons:

Short-Term Benefits:

1. SEO Focus and Prioritization
   • Forces assessment and pragmatic prioritization of SEO factors
   • Drives focus on the most valuable keywords based on search volume
   • Encourages consideration of click-through rates, not just rankings
2. Competitor Intelligence
   • Reveals competitors you didn’t know you had in search
   • Provides insights into competitive strategies
   • Measures the whole sector, not just a few pre-selected competitors
3. Brand Visibility Insights
   • Spotlights opportunities to improve brand visibility
   • Identifies weaknesses relative to competitors
   • Provides a list of actionable improvements
4. Organizational Capabilities
   • Helps CMOs inform search strategy direction
   • Enables tracking of consumer demand
   • Provides a framework for reporting progress to stakeholders

As Richard Game captures here, these immediate benefits make SOV valuable even before its long-term impact on market share is realised.

In our final instalment, we’ll show how to transform SOV insights into strategic action and reveal how leading brands use this metric to drive sustainable growth.

To learn more about how Cressive DX can help you measure and improve your brand’s Share of Voice, contact our team for a personalised demonstration of our DX Spotlight platform.

The post The Science Behind Share of Voice: How It’s Measured and Why It Matters appeared first on Cressive DX.

Ah, the joy. The moment when you pull up your monthly performance dashboard and see those trend lines heading in the right direction. A rare point of agreement for both client and consultant. That steady climb in Search Performance KPIs isn’t just a validation of the underlying strategy; it’s a clear signal that your brand is gaining ground in the digital battlefield.

But what exactly are we looking at here, and why does it matter so much for a digital Brand?

Understanding Search Performance: The Digital Battleground

In a digital-first world, your brand’s search performance is arguably its most critical competitive advantage. Think about it – when was the last time you, or anyone you know, made a significant purchase decision without consulting Google? Search performance represents your brand’s ability to be present and prominent when potential customers are looking for solutions you provide.

But what exactly constitutes search performance? At its core, it’s your brand’s visibility and ranking in search engines compared to your competitors across the keywords that matter in your market. It’s not just about ranking well for a few terms – it’s about dominating the digital conversation in your industry.

Ranking position equates to being found, being ‘in the game’, to be seen by prospective customers at the top of the search funnel.

Share of Voice vs Position Score: The Two Pillars of Search Performance

At Cressive DX, we summarize search performance through two high-level KPIs: Position Score and Share of Voice (SOV). While both are important, they serve different purposes and provide different insights.

Position Score is the simpler of the two metrics. It provides a straightforward summary of your SERP (Search Engine Results Page) positions across all your target keywords.

For instance – from the below chart (which our tech team calls the “position tube map”) Cressive ranks No. 1 for the keyword Digital Brand Governance in March 2025.

Each keyword has similar daily position data that we collect, which when averaged out over all keywords and a period of time leads to Position Score. Think of it as your brand’s average ranking report card. It’s useful because:

• It gives you a quick snapshot of your overall ranking health
• It’s easy to understand and communicate to stakeholders
• It helps track basic SEO progress over time

But Share of Voice? That’s where things get really interesting.

Share of Voice goes beyond simple rankings to tell a more powerful story. While Position Score tells you where you rank, SOV reveals how much of the market you actually own by measuring your brand’s share of the digital conversation. It’s a sophisticated metric that analyses your visibility across search results, weighted by search volume and click-through rates. It takes into account:

• The actual search volume for each keyword
• The click-through rates at different positions
• Your competitors’ presence and rankings
• Both organic and paid search results
• The relative importance of different keywords in your market

This complexity makes SOV a more accurate representation of your brand’s true digital market presence and potential impact, relative to your competition. As referenced in multiple contributors on shareofvoice.com, SOV has historically been one of the most reliable predictors of market share growth, and in the digital age, this relationship has become even more pronounced.

Furthermore, as we cover here, a focus on Share of Voice/ Share of Search delivers value to the business in the short term.

The Market Dimensions of Share of Voice

Understanding Share of Voice requires thinking about your digital market in three key dimensions:

• the search terms people use when engaging with your market i.e. keywords
• the platforms where these conversations happen
• and the geographic location of your audience.

Let’s break this down.

The Keyword Dimension: Defining Your Market Space

Your market isn’t just about what you sell – it’s about the entire conversation surrounding your industry. Think of keywords as the language your potential customers use when they’re in your market space. This language can be understood through two complementary lenses:

First, looking at user intent:

• Problem Space Keywords: Terms people use when trying to understand or solve a problem (e.g., “how to gain muscle mass”)
• Solution Space Keywords: Terms related to specific solutions or product categories (e.g., “whey protein powder”)

Second, considering the buyer’s journey:

• Awareness Stage: Broad industry terms and educational queries (e.g., “what causes hair loss”)
• Consideration Stage: Comparison and evaluation terms (e.g., “minoxidil vs finasteride”)
• Conversion Stage: Purchase-intent keywords (e.g., “buy hair loss treatment online”)

Importantly, your market definition specifically excludes brand-specific terms (like your company name or product names). Why? Because brand searches don’t represent market share – they represent brand awareness. To truly understand your competitive position, you need to focus on non-branded searches where you’re competing for new customers. This becomes even more critical in the era of Google’s AI Overviews which are changing search behaviour, especially at the top of the funnel.

The Platform Dimension: Where the Conversations Happen

While Google remains the dominant player in search, the digital landscape has evolved significantly, especially post-2020. Here’s how the platform dimension breaks down:

• Google Organic and Paid: Still accounts for the majority of website traffic and remains the primary battlefield for digital visibility
• Social Media: Brands generally have a strong presence across Facebook, Instagram, Twitter, LinkedIn in order to expand their audience and build engagement
• Community-based Platforms: These include the likes of Quora and Reddit
• eCommerce: Organic and Paid positions in Amazon are critical for consumer products

As discussed in our Top 5 DM issues for 2025 article, we know the customer journey is becoming more non-linear and ‘across channel’ so data capture of these platforms and attribution to each of them is key to understanding the complete picture.

The Location Dimension

Geographic location of the searcher is also an important dimension as search results are localised and are becoming more so. This dimension is more important to search engine platforms rather than social media and community-based platforms.

In our next article (Part 2 of the series), we’ll dive deeper into how Share of Voice is calculated and analyse a real-world example that demonstrates its impact on digital performance. We’ll explore the science behind the metric and reveal how leading brands are using it to drive measurable growth.

To learn more about how Cressive DX can help you measure and improve your brand’s Share of Voice, contact our team for a personalised demonstration of our DX Spotlight platform.

The post Understanding Share of Voice: The Digital Brand’s North Star Metric appeared first on Cressive DX.

Google’s AI Overviews (AIO)—the generative summaries sometimes appearing at the top of search results—are creating new opportunities and challenges for SEO. They provide quick, synthesised answers, often citing multiple organic pages. For marketers, AIOs can potentially reduce clicks on traditional organic links while also spotlighting the websites Google trusts most.

As we cover in our analysis of the top issues facing digital marketing in 2025, we believe AIOs will cause substantial disruption to search marketing in the months and years to come.

To understand how AIOs work “in the wild,” our team analysed 4,000 search queries (2,000 each from the US and the UK). These queries covered awareness, consideration, and conversion keywords as well as question vs. non-question formats and short-tail, medium-tail, and long-tail variants. The analysis was carried out on 23rd January 2025.

Below, we share our 10 biggest takeaways.

Note: For those who want to dive into statistical significance tests (e.g., Kruskal-Wallis, Z-statistics, McNemar’s test), check out the Detailed Methodology & Stats at the end.

1. AIOs Appear for Almost Half of Searches

Across the full range of search terms, 47% triggered an AI Overview while 53% did not. In other words, you’ve got nearly a 50-50 chance of seeing an AI Overview for a given query.

As Google refines its generative approach, this rate may well increase—making it crucial to understand how (and why) AIOs surface.

2. Minimal Geographic Differences: US vs. UK

Breaking down the same dataset by location, we see a 46.63% incidence for the UK and 47.76% for the US. Given how closely these figures align, it appears that Google’s AIO rollout is similarly advanced in both markets.

If you’re ranking for queries in either region, anticipate a comparable chance of generating an AI Overview.

3. Question-Based Queries Are Far More Likely to Yield AIOs

One of the standout findings involves query intent:

Question-format keywords: ~85% show an AIO

Non-question keywords: ~43% show an AIO

If your audience tends to type “How do I…?” or “What is…?”, these types of queries are extremely likely to trigger an AIO.

4. Funnel Stage Influences AIO Appearance

We classified each query as awareness, consideration, or conversion. Here’s how often each stage displayed an AI Overview:

• Awareness: ~56% AIO incidence
• Consideration: ~23%
• Conversion: ~42%

5. Long-Tail Keywords Trigger AIOs Most Frequently

Next, we grouped queries into short-tail, medium-tail, and long-tail:

• Long-tail: ~65% include an AIO
• Medium-tail: ~49%
• Short-tail: ~34%

Specific, more detailed queries tend to invite more thorough AI Overviews—likely because Google sees a stronger need to synthesize multiple sources for these narrower topics.

6. The Nuanced Story of AIO Length

We also looked at the word count of AI Overviews based on funnel stage, keyword length, and whether it was a question or not.

Although these differences are statistically significant, the real-world impact may be relatively small. For example, consideration queries produce slightly longer overviews, but this could also be due to the complexity of the topic rather than the funnel stage itself.

In other words, AIO length is not driven exclusively by these factors—they’re just part of the picture. Content complexity and Google’s available data likely play a bigger role in shaping final word counts.

7. Nearly All AIOs Cite the Top 10 Organic Results

If you’re wondering whether organic rankings still matter when an AI is rewriting the SERP, the answer is a resounding yes. We found:

• 97.3% of AIOs cited at least one result from the top 10 organic listings.
• Only 2.7% didn’t cite any top 10 result.

8. The Two-Tier Citation Pattern: Positions 1–7 vs. 8–10

Digging deeper, we discovered a sharp divide in citation rates:

• Positions 1–7: ~83–85% citation rate
• Positions 8–10: ~56% citation rate

Our statistical tests show no meaningful difference between the top 3 positions and positions 4-7.

However, there’s a highly significant drop from positions 1–7 to positions 8–10. If you want to influence the AI Overview, aim to be within the top 7. After that point, citation rates plummet.

9. Number of Citations: More About Availability than Keyword Type

We also measured how many sources are typically cited in an AIO.

While the averages for awareness, consideration, conversion, and different keyword lengths varied (e.g., ~5–6 citations), the data suggests these slight differences don’t strongly correlate with the funnel stage or keyword type.

Instead, the number of citations appears to be driven by how much topically relevant content Google deems credible and already ranks highly. In other words, Google’s AI pulls from however many high-ranking pages it believes best serve the user query—so the richer the existing pool of quality and relevant content, the more citations you’ll see.

10 . Why Top Organic Results Are the Bedrock of AIO

One of our most compelling discoveries is also the most logical: AI Overviews essentially stand on the shoulders of Google’s ranking algorithms. Consider the following:

1. World-Class Relevance: Google has spent decades perfecting how to rank content. It’s far more efficient for them to build AI Overviews using the top-ranked pages than to re-invent the relevance engine from scratch.
2. Consistency vs. Contradiction: The AI Overview typically aligns with the consensus of top results. If an AIO were to contradict the highest-ranked sources, it would raise questions about whether the AI is incorrect or Google’s rankings are flawed. Either scenario undermines user trust.

For brands, this means SEO fundamentals still matter—perhaps more than ever. If you can get into (and stay in) the top 7 organic positions, you stand a much higher chance of:

• Being front and centre when an AI Overview appears.
• Shaping the narrative around a topic

Conclusions & Next Steps

The bottom line is that AI Overviews rely on the top organic results for both content and credibility. While AIOs may feel like a shortcut for users, relevance and authority remain rooted in Google’s ranking algorithms. With nearly half of all queries we examined triggering an AIO, your best strategy is to:

• Continue optimizing for Page 1, especially the top 7 positions.
• Craft comprehensive, relevant content that serves user intent (particularly for question-based queries)
• Monitor funnel-stage performance and adapt content strategy for awareness vs. consideration vs. conversion.

Generative AI may shift how users consume information on the SERP, but it doesn’t replace the fundamental importance of ranking highly for competitive keywords.

Detailed Methodology & Stats

1. Data Collection & Sample
   • 4,000 queries total: 2,000 each in the US and UK. Selected as indicative of client behaviour modelled over buying funnel.
   • Queries were classified by funnel stage, keyword length, and question vs. non-question.
2. AIO Incidence & Word Count
   • We recorded whether an AIO appeared and measured its word count if it did.
   • Sub-analyses split results by region, funnel stage, question format, and keyword length.
3. Citations
   • For each AIO, we noted whether it cited organic positions 1–10, and how many total sources it included.
4. Statistical Tests
   • We employed Kruskal-Wallis for comparing median word counts across multiple groups.
   • We used Z-statistics and McNemar’s tests to compare proportions (e.g., top 3 vs. positions 4–7, 1–7 vs. 8–10).
   • Significant differences suggest we can be confident the patterns (e.g., citation rates) are not due to random chance.

The post 10 Essential Insights From Our Google AI Overviews Study appeared first on Cressive DX.