Geo-redirect detected
https://BBC.CO.UK redirected to https://www.bbc.com/. This report shows the EU version of the site.
https://BBC.CO.UK
Scanned Apr 14, 2026 · 43.4s
Your website score is
Grade
BannerConsent Banner
Yes
Regulatory Compliance
Multi-regulation overview — click any regulation for details
Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.
Tag Leak detected 34 user data leaks before consent on bbc.co.uk, including Optimizely, comScore (Analytics Tracker), Didomi (Tracker Tracker) and 5 more.
Security Headers
6/6 presentStrict-Transport-Security
max-age=31536000; preload
Content-Security-Policy
default-src 'none'; script-src 'strict-dynamic' 'nonce-TuCTYvrSYDcUen9OsACYCe8r12X5ach0tgcHPUVKJGzJT1SkxY' 'self' 'report-sample' 'unsafe-inline' cdn.syndication.twimg.com connect.facebook.net c.files.bbci.co.uk emp.bbci.co.uk mybbc-analytics.files.bbci.co.uk nav.files.bbci.co.uk news.files.bbci.co.uk platform.twitter.com public.flourish.studio static.bbc.co.uk static.bbci.co.uk static.chartbeat.com static2.chartbeat.com www.bbc.co.uk www.instagram.com www.ons.gov.uk gn-web-assets.api.bbc.com www.google-analytics.com bitesize.files.bbci.co.uk www.tiktok.com lf16-tiktok-web.ttwstatic.com static.files.bbci.co.uk; img-src 'self' https: data:; font-src c.files.bbci.co.uk gel.files.bbci.co.uk static.files.bbci.co.uk static.bbci.co.uk news.files.bbci.co.uk ws-downloads.files.bbci.co.uk bitesize.files.bbci.co.uk; style-src branding.files.bbci.co.uk cdn.riddle.com flo.uri.sh news.files.bbci.co.uk platform.twitter.com static.bbc.co.uk static.bbci.co.uk static.files.bbci.co.uk ton.twimg.com www.riddle.com 'unsafe-inline' lf16-tiktok-web.ttwstatic.com; frame-src 'self' bbc001.carto.com bbc003.carto.com bbc-maps.carto.com cdn.riddle.com chartbeat.com emp.bbc.co.uk emp.bbc.com flo.uri.sh graphics.reuters.com www.reuters.com graphics.thomsonreuters.com dynamic.mc-cdn.io vapi.mc-cdn.io vapi.beta.mc-cdn.io elections.mapcreator.io elections.beta.mapcreator.io cdn.mapcreator.io m.facebook.com news.files.bbci.co.uk personaltaxcalculator2.deloittecloud.co.uk platform.twitter.com public.flourish.studio static2.chartbeat.com syndication.twitter.com web.facebook.com www.bbc.co.uk www.facebook.com www.instagram.com www.tiktok.com www.ons.gov.uk www.riddle.com www.youtube.com www.youtube-nocookie.com uk-script.dotmetrics.net ssp-app-uk.votenow.tv ssp-app-uktest.votenow.tv ssp-app-ukbench.votenow.tv session.test.bbc.co.uk session.bbc.co.uk session.stage.bbc.co.uk bitesize.files.bbci.co.uk; object-src 'none'; manifest-src static.files.bbci.co.uk bitesize.files.bbci.co.uk; media-src 'self' blob: https:; connect-src 'self' https:; child-src blob:; base-uri 'none'; form-action 'self' platform.twitter.com syndication.twitter.com uk-script.dotmetrics.net/DeviceInfo.dotmetrics account.bbc.com/auth/identifier/landing; frame-ancestors 'none'; upgrade-insecure-requests; report-to default; report-uri https://webcore.bbc-reporting-api.app/report-endpoint;
X-Frame-Options
DENY
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Permissions-Policy
accelerometer=(), autoplay=(self "https://emp.bbc.com" "https://emp.bbc.co.uk" "http://emp.bbc.com" "http://emp.bbc.co.uk"), camera=(), document-domain=(self "https://emp.bbc.com" "https://emp.bbc.co.uk" "http://emp.bbc.com" "http://emp.bbc.co.uk"), encrypted-media=(), fullscreen=(self "https://emp.bbc.com" "https://emp.bbc.co.uk" "http://emp.bbc.com" "http://emp.bbc.co.uk"), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(self "https://emp.bbc.com" "https://emp.bbc.co.uk" "http://emp.bbc.com" "http://emp.bbc.co.uk"), screen-wake-lock=(), sync-xhr=(self), usb=(), xr-spatial-tracking=() browsing-topics=(), join-ad-interest-group=(), run-ad-auction=()
Google Consent Mode
Not DetectedGoogle Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.
Post-Rejection Audit
Reject Button
Found
Post-Rejection Fires
2 vendors
Consent Mode
Not Detected
GTM Load
Not detected
Consent Mode V2: Not Detected
Google Consent Mode was not detected on this site.
Vendors firing after rejection (2)
| Vendor | Category | Timing | URL |
|---|---|---|---|
| Optimizely — Optimizely | analytics | 22894ms | cdn.optimizely.com |
| Google — Google Ads | advertising | 24221ms | pagead2.googlesyndication.com |
Consent Record Audit
Issues detectedConsent record stored after interaction
GDPR Art. 7(1)No consent record written — cannot prove consent was given
No CMP consent cookie or localStorage entry was found after the consent interaction. GDPR requires controllers to demonstrate consent was given.
Consent withdrawal mechanism accessible
GDPR Art. 7(3)Cookie settings link / floating button found
Why this matters
Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.
Tracker categories detected
Critical15
Data was transmitted to a third-party or storage was written on the user’s device before consent. This is a GDPR/ePrivacy violation, not just a script load.
Optimizely4 findingscdn.optimizely.com, a4621041136.cdn.optimizely.com, logx.optimizely.com, optimizelyEndUserId
cdn.optimizely.com, a4621041136.cdn.optimizely.com, logx.optimizely.com, optimizelyEndUserId
Optimizely (Optimizely) loaded before consent: Optimizely experimentation and A/B testing
Optimizely (Optimizely) loaded before consent: Optimizely experimentation and A/B testing
Optimizely (Optimizely) loaded before consent: Optimizely event logging endpoint
Optimizely cookie "optimizelyEndUserId" set before consent
comScore (analytics) loaded before consent
Didomi (tracker) loaded before consent
DotMetrics (Advertising Tracker)2 findingsuk-script.dotmetrics.net, rm-script.dotmetrics.net
uk-script.dotmetrics.net, rm-script.dotmetrics.net
DotMetrics (advertising) loaded before consent
DotMetrics (advertising) loaded before consent
Chartbeat (analytics) loaded before consent
Google Ads (Google) loaded before consent: Google ad syndication and remarketing
advertising tracker at a1.api.bbc.com loaded before consent
Chartbeat cookie "_chartbeat2" set before consent — Cookie is used to register if a person has visited the domain before (to calculate new vs returning users).
Optimizely — Optimizely fires after user rejected consent
Google — Google Ads fires after user rejected consent
No consent record stored after interaction — GDPR Article 7(1) requires controllers to demonstrate consent was given
Warnings23
A tag container or script loaded before consent but tags appear correctly gated (e.g. GTM with Consent Mode v2). Not a violation on its own — review to confirm downstream tags stay blocked.
Unknown CMP was clicked but no consent storage was written — tags may continue firing as if consent was never given
Unknown third-party request to ichef.bbci.co.uk before consent
Unknown third-party request to static.files.bbci.co.uk before consent
Unknown third-party request to nav.files.bbci.co.uk before consent
Unknown third-party request to www.bbc.com before consent
Unknown third-party request to static.bbci.co.uk before consent
Unknown third-party request to gn-web-assets.api.bbc.com before consent
Unknown third-party request to emp.bbci.co.uk before consent
Unknown third-party request to mybbc-analytics.files.bbci.co.uk before consent
localStorage key "optimizely_data$$oeu1776155995150r0.4981416952470944$$27302320011$$event_queue" written before consent
localStorage key "optimizely_data$$oeu1776155995150r0.4981416952470944$$27302320011$$tracker_optimizely" written before consent
localStorage key "optimizely_data$$oeu1776155995150r0.4981416952470944$$27302320011$$layer_states" written before consent
localStorage key "optimizely_data$$oeu1776155995150r0.4981416952470944$$27302320011$$session_state" written before consent
localStorage key "optimizely_data$$oeu1776155995150r0.4981416952470944$$27302320011$$visitor_profile" written before consent
localStorage key "optimizely_data$$oeu1776155995150r0.4981416952470944$$27302320011$$variation_map" written before consent
localStorage key "optimizely_data$$oeu1776155995150r0.4981416952470944$$27302320011$$layer_map" written before consent
localStorage key "optimizely_data$$oeu1776155995150r0.4981416952470944$$27302320011$$contextual_mab" written before consent
localStorage key "_cb_ls_test" written before consent
localStorage key "_cb" written before consent
localStorage key "_chartbeat2" written before consent
localStorage key "_cb_svref" written before consent
localStorage key "optimizely_data$$pending_events" written before consent
Page reloads after rejection — potential indicator of broken Consent Mode V2 implementation
Info9
Neutral observations — activity we detected that isn’t a violation but is useful context (e.g. essential cookies, CMP initialisation).
Piano (cdn) loaded before consent
Chartbeat (cdn) loaded before consent
Piano3 findings_pprv, _pcid, _pctx
_pprv, _pcid, _pctx
Piano cookie "_pprv" set before consent — This cookie contains the property consent (linked to a product) the end-user has consented to. More information about Consent management can be found here.
Piano cookie "_pcid" set before consent — This cookie contains the browserId (BID) that is used in Piano products for reporting and tracking purposes.
Piano cookie "_pctx" set before consent — This cookie is required to sync different Piano product scripts containing common data points. It contains data from different products, for example for Composer Insights or Ad Revenue Insights, but only IF you have implemented any of these products.
Sourcepoint CMP4 findings_sp_su, _sp_user_consent_26225, _sp_local_state, _sp_non_keyed_local_state
_sp_su, _sp_user_consent_26225, _sp_local_state, _sp_non_keyed_local_state
Sourcepoint CMP cookie "_sp_su" set before consent
Sourcepoint CMP (Sourcepoint) wrote "_sp_user_consent_26225" to localStorage before consent
Sourcepoint CMP (Sourcepoint) wrote "_sp_local_state" to localStorage before consent
Sourcepoint CMP (Sourcepoint) wrote "_sp_non_keyed_local_state" to localStorage before consent
Compliant44
Tags that fired only after the user gave consent — working as intended.
Cookiebot cookie "consentUUID" set correctly after consent
Piano6 findings__tbc, xbc, _pcus, cX_P, gckp, cX_G
__tbc, xbc, _pcus, cX_P, gckp, cX_G
Piano cookie "__tbc" set correctly after consent
Piano cookie "xbc" set correctly after consent
Piano cookie "_pcus" set correctly after consent
Piano cookie "cX_P" set correctly after consent
Piano cookie "gckp" set correctly after consent
Piano cookie "cX_G" set correctly after consent
Permutive2 findingspermutive-id, pxid
permutive-id, pxid
Permutive cookie "permutive-id" set correctly after consent
Permutive cookie "pxid" set correctly after consent
Adform3 findingsUID, C, uid
UID, C, uid
Adform cookie "UID" set correctly after consent
Adform cookie "C" set correctly after consent
Adform cookie "uid" set correctly after consent
ComScore cookie "XID" set correctly after consent
DoubleClick/Google Marketing2 findings__gads, IDE
__gads, IDE
DoubleClick/Google Marketing cookie "__gads" set correctly after consent
DoubleClick/Google Marketing cookie "IDE" set correctly after consent
Google AdSense2 findings__gpi, __eoi
__gpi, __eoi
Google AdSense cookie "__gpi" set correctly after consent
Google AdSense cookie "__eoi" set correctly after consent
Google cookie "DSID" set correctly after consent
The Ozone Project cookie "ozone_uid" set correctly after consent
openx.net cookie "i" set correctly after consent
TripleLift cookie "tluid" set correctly after consent
Casale Media3 findingsCMID, CMPS, CMPRO
CMID, CMPS, CMPRO
Casale Media cookie "CMID" set correctly after consent
Casale Media cookie "CMPS" set correctly after consent
Casale Media cookie "CMPRO" set correctly after consent
PubMatic10 findingsKADUSERCOOKIE, chkChromeAb67Sec, pi, DPSync4, SyncRTB4, KRTBCOOKIE_632, PugT, KRTBCOOKIE_391, KRTBCOOKIE_377, SPugT
KADUSERCOOKIE, chkChromeAb67Sec, pi, DPSync4, SyncRTB4, KRTBCOOKIE_632, PugT, KRTBCOOKIE_391, KRTBCOOKIE_377, SPugT
PubMatic cookie "KADUSERCOOKIE" set correctly after consent
PubMatic cookie "chkChromeAb67Sec" set correctly after consent
PubMatic cookie "pi" set correctly after consent
PubMatic cookie "DPSync4" set correctly after consent
PubMatic cookie "SyncRTB4" set correctly after consent
PubMatic cookie "KRTBCOOKIE_632" set correctly after consent
PubMatic cookie "PugT" set correctly after consent
PubMatic cookie "KRTBCOOKIE_391" set correctly after consent
PubMatic cookie "KRTBCOOKIE_377" set correctly after consent
PubMatic cookie "SPugT" set correctly after consent
Admatic cookie "uids" set correctly after consent
CreativeCDN cookie "g" set correctly after consent
PayPal cookie "ts" set correctly after consent
The Tradedesk2 findingsTDID, TDCPM
TDID, TDCPM
The Tradedesk cookie "TDID" set correctly after consent
The Tradedesk cookie "TDCPM" set correctly after consent
Adobe Audience Manager2 findingsdemdex, dpm
demdex, dpm
Adobe Audience Manager cookie "demdex" set correctly after consent
Adobe Audience Manager cookie "dpm" set correctly after consent
Amazon2 findingsad-id, ad-privacy
ad-id, ad-privacy
Amazon cookie "ad-id" set correctly after consent
Amazon cookie "ad-privacy" set correctly after consent
Chartbeat cookie "_chartbeat4" set correctly after consent