Allstate

allstate.com

Compare

https://allstate.com

Scanned Apr 15, 2026 · 36.7s

Your website score is

0/100
Critical

Grade

F0

Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 24 user data leaks before consent on allstate.com, including Adobe (Tracker Tracker), Akamai (Analytics Tracker), DataDog (Analytics Tracker) and 3 more.

Security Headers

3/6 present

Strict-Transport-Security

max-age=15768000 ; includeSubDomains ; preload

Content-Security-Policy

Add a Content-Security-Policy header to prevent XSS and code injection attacks

X-Frame-Options

SAMEORIGIN

X-Content-Type-Options

nosniff

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

Not Detected

Google Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

Not detected

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

No tracking vendors detected firing after rejection

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

Found: OptanonConsent (OneTrust)

Record contains timestamp

Art. 7(1)

Timestamp field detected

Record contains consent state

Art. 7(1)

Accept/reject state detected

Record contains consent categories

Art. 7(1)

Consent categories (analytics, marketing, etc.) not found in record

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising1 vendor
Analytics3 vendors
Marketing2 vendors
Security3
Functional4 vendors
Critical13
Adobe (Tracker Tracker)
criticalNetworkAdobe (Tracker Tracker)

Adobe (tracker) loaded before consent

Host: dpm.demdex.netFired: 1407ms after load
Akamai (Analytics Tracker)
Akamai (Analytics Tracker)3 findings

s.go-mpulse.net, c.go-mpulse.net, 0217991b.akstat.io

Akamai (Analytics Tracker)
criticalNetworkAnalyticsAkamai (Analytics Tracker)

Akamai (analytics) loaded before consent

Host: s.go-mpulse.netFired: 1425ms after load
Akamai (Analytics Tracker)
criticalNetworkAnalyticsAkamai (Analytics Tracker)

Akamai (analytics) loaded before consent

Host: c.go-mpulse.netFired: 1990ms after load
Akamai (Analytics Tracker)
criticalNetworkAnalyticsAkamai (Analytics Tracker)

Akamai (analytics) loaded before consent

Host: 0217991b.akstat.ioFired: 4352ms after load
DataDog (Analytics Tracker)
criticalNetworkAnalyticsDataDog (Analytics Tracker)

DataDog (analytics) loaded before consent

Host: browser-intake-datadoghq.comFired: 2757ms after load
Advertising Tracker
criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at awa-useast1-1.advanced-web-analytics.com loaded before consent

Host: awa-useast1-1.advanced-web-analytics.comFired: 3331ms after load
Adobe Analytics
Adobe Analytics3 findings

allstate.tt.omtrdc.net, s_ecid, AMCV_97021C8B53295DF30A490D4D%40AdobeOrg

Adobe Analytics
criticalNetworkAnalyticsAdobe Analytics

Adobe Analytics (Adobe) loaded before consent: Adobe Analytics tracking endpoint

Host: allstate.tt.omtrdc.netFired: 3616ms after load
Adobe Analytics
criticalCookieMarketingAdobe Analytics

Adobe Analytics cookie "s_ecid" set before consent — This cookie is set by the customer's domain after the AMCV cookie is set by the client. The purpose of this cookie is to allow persistent ID tracking in the 1st-party state and is used as a reference ID if the AMCV cookie has expired.

Cookie: s_ecidDomain: .allstate.comRetention: 2 years
Adobe Analytics
criticalCookieAnalyticsAdobe Analytics

Adobe Analytics cookie "AMCV_97021C8B53295DF30A490D4D%40AdobeOrg" set before consent

Cookie: AMCV_97021C8B53295DF30A490D4D%40AdobeOrgDomain: .allstate.com
Adobe Audience Manager
Adobe Audience Manager3 findings

demdex, AMCVS_97021C8B53295DF30A490D4D%40AdobeOrg, mbox

Adobe Audience Manager
criticalCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "demdex" set before consent — Unique value with which Audience Manager can identify a user. Used, among others, for identification, segmentation, modeling and reporting purposes.

Cookie: demdexDomain: .demdex.netRetention: 180 days after last activity or 10 years when opting out
Adobe Audience Manager
criticalCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "AMCVS_97021C8B53295DF30A490D4D%40AdobeOrg" set before consent — The AMCVS cookie serves as a flag indicating that the session has been initialized. Its value is always 1 and discontinues when the session has ended.

Cookie: AMCVS_97021C8B53295DF30A490D4D%40AdobeOrgDomain: .allstate.comRetention: Session
Adobe Audience Manager
criticalCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "mbox" set before consent — Adobe Target uses cookies to give website operators the ability to test which online content and offers are more relevant to visitors.

Cookie: mboxDomain: .allstate.comRetention: 2 years
criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings12
Analytics proxy
warningNetworkAnalytics proxy

Possible server-side tag proxy at smetrics.allstate.com — analytics data may be forwarded to third parties before consent. Browser scanning cannot verify downstream recipients; audit your GTM Server-side or CNAME configuration.

Host: smetrics.allstate.comFired: 2265ms after load
vendor logo
warningNetwork

Unknown third-party request to assets.adobedtm.com before consent

Host: assets.adobedtm.comFired: 1968ms after load
vendor logo
warningNetwork

Unknown third-party request to schema.milestoneinternet.com before consent

Host: schema.milestoneinternet.comFired: 1997ms after load
warningStorage

sessionStorage key "com.adobe.reactor.core.visitorTracking.landingPage" written before consent

Key: com.adobe.reactor.core.visitorTracking.landingPageType: sessionStorageFired: 1401ms after load
warningStorage

sessionStorage key "com.adobe.reactor.core.visitorTracking.trafficSource" written before consent

Key: com.adobe.reactor.core.visitorTracking.trafficSourceType: sessionStorageFired: 1402ms after load
warningStorage

localStorage key "dummy" written before consent

Key: dummyType: localStorageFired: 1525ms after load
warningStorage

localStorage key "ak_a" written before consent

Key: ak_aType: localStorageFired: 1591ms after load
warningStorage

localStorage key "_boomr_clss" written before consent

Key: _boomr_clssType: localStorageFired: 1595ms after load
warningStorage

localStorage key "__akfp_storage_test__" written before consent

Key: __akfp_storage_test__Type: localStorageFired: 1911ms after load
warningStorage

localStorage key "SESSION_STATE" written before consent

Key: SESSION_STATEType: localStorageFired: 2011ms after load
warningStorage

sessionStorage key "__stest__" written before consent

Key: __stest__Type: sessionStorageFired: 2624ms after load
warningStorage

sessionStorage key "___so529001" written before consent

Key: ___so529001Type: sessionStorageFired: 2725ms after load
Info10
OneTrust
OneTrust2 findings

cdn.cookielaw.org, OptanonConsent

OneTrust
infoNetworkConsent MgmtOneTrust

OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management

Host: cdn.cookielaw.orgFired: 1451ms after load
OneTrust
infoCookieConsent MgmtOneTrust

OneTrust cookie "OptanonConsent" set before consent

Cookie: OptanonConsentDomain: .allstate.com
OneTrust CMP
infoNetworkConsent MgmtOneTrust CMP

OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location

Host: geolocation.onetrust.comFired: 2243ms after load
Akamai
infoCookieFunctionalAkamai

Akamai cookie "AKA_A2" set before consent — Used for Akamai's Advanced Acceleration feature, intended to improve web performance

Cookie: AKA_A2Domain: .allstate.comRetention: 1 hour or longer
infoCookieFunctionalf5 BIG-IP

f5 BIG-IP cookie "BIGipServereacs-cdn-443-pool" set before consent — Used by the f5 BIG-IP load balancer to ensure one user's request is always handled by the same server to maintain a consistent user experience

Cookie: BIGipServereacs-cdn-443-poolDomain: www.allstate.comRetention: Unknown
Adobe Audience Manager
infoCookieFunctionalAdobe Audience Manager

Adobe Audience Manager cookie "at_check" set before consent — A simple test value used to determine if a visitor supports cookies. Set each time a visitor requests a page.

Cookie: at_checkDomain: .allstate.comRetention: session
infoCookieFunctionalTripadvisor

Tripadvisor cookie "RT" set before consent — This cookie is used to identify the visitor through an application. This allows the visitor to login to a website through their LinkedIn application for example.

Cookie: RTDomain: .allstate.comRetention: 399 days
infoCookieFunctional

Akamai bot manager — necessary for site protection

Cookie: _abckDomain: .allstate.com
infoCookieFunctional

Akamai bot management — necessary for site protection

Cookie: bm_svDomain: .allstate.com
infoCookieFunctional

Akamai bot management session — necessary for site protection

Cookie: ak_bmscDomain: .allstate.com
Compliant1
OneTrust
CompliantCookieConsent MgmtOneTrust

OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent

Cookie: OptanonAlertBoxClosedDomain: .allstate.com

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan allstate.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com