Booking.com Cookie Compliance Report

Booking.com

booking.com

Compare

https://booking.com

Scanned Apr 15, 2026 · 43.2s

Your website score is

0/100

Critical

Grade

BannerConsent Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 23 user data leaks before consent on booking.com, including Google Ads, Criteo (Advertising Tracker), RTBHouse (Advertising Tracker) and 4 more.

Security Headers

1/6 present

Strict-Transport-Security

max-age=63072000; includeSubDomains; preload

Content-Security-Policy

Add a Content-Security-Policy header to prevent XSS and code injection attacks

X-Frame-Options

Add X-Frame-Options header to prevent clickjacking attacks

X-Content-Type-Options

Set X-Content-Type-Options to 'nosniff' to prevent MIME type sniffing

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

70/100

GTM Containers:GTM-5Q664QZ

Consent Parameters

ParameterDefaultUpdated

Ad Storagenot_setgranted

Ad User Datanot_setgranted

Ad Personalizationnot_setgranted

Analytics Storagenot_setgranted

Functionality Storagenot_setgranted

Personalization Storagenot_setgranted

Security Storagenot_setgranted

Issues (1)

No default consent call detected — consent mode may not be initialised correctly

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

2 vendors

Consent Mode

Not Detected

GTM Load

6008ms pre-consent

Google Tag Manager(GTM-5Q664QZ)

Loaded 6008ms after page load — before the consent banner was detected (banner appeared at 8294ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

✓ gtag('consent', 'update') call detected on rejection

Vendors firing after rejection (2)

Vendor	Category	Timing	URL
Microsoft — Microsoft Ads	advertising	20941ms	bat.bing.com
Google — Google Ads	advertising	21471ms	pagead2.googlesyndication.com

Consent Record Audit

Pass

Consent record stored after interaction

GDPR Art. 7(1)

Found: OptanonConsent (OneTrust)

Record contains timestamp

Art. 7(1)

Timestamp field detected

Record contains consent state

Art. 7(1)

Accept/reject state detected

Record contains consent categories

Art. 7(1)

Consent categories (analytics, marketing, etc.) not found in record

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

Cookie settings link / floating button found

Consent record and withdrawal mechanism are both correctly implemented

Tracker categories detected

Advertising7 vendors

Analytics1 vendor

Marketing5 vendors

Security5

Tag Management1 vendor

Critical14

Criteo (Advertising Tracker)2 findingsID tracked

gum.criteo.com, dynamic.criteo.com

criticalNetworkAdvertisingCriteo (Advertising Tracker)

Criteo (advertising) loaded before consent

ID: 1Host: gum.criteo.comFired: 7126ms after load

criticalNetworkAdvertisingCriteo (Advertising Tracker)

Criteo (advertising) loaded before consent

Host: dynamic.criteo.comFired: 7126ms after load

Google Ads5 findings

pagead2.googlesyndication.com, e0da242d4959748d12951ae298c24bc5.safeframe.googlesyndication.com, www.google.com, _gcl_au, _gcl_ls

criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google ad syndication and remarketing

Host: pagead2.googlesyndication.comFired: 3101ms after load

criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google ad syndication and remarketing

Host: e0da242d4959748d12951ae298c24bc5.safeframe.googlesyndication.comFired: 6003ms after load

criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google Consent Mode data collection for ad measurement

Host: www.google.comFired: 7172ms after load

criticalCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set before consent

Cookie: _gcl_auDomain: .booking.com

criticalStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage before consent

Key: _gcl_lsType: localStorageFired: 7032ms after load

criticalNetworkAdvertisingRTBHouse (Advertising Tracker)

RTBHouse (advertising) loaded before consent

Host: creativecdn.comFired: 7131ms after load

criticalNetworkThe Trade Desk (Tracker Tracker)

The Trade Desk (tracker) loaded before consent

Host: js.adsrvr.orgFired: 7172ms after load

criticalNetworkAdvertisingMicrosoft Ads

Microsoft Ads (Microsoft) loaded before consent: Microsoft Ads (Bing) UET conversion tracking

Host: bat.bing.comFired: 7594ms after load

criticalCookieMarketingAdform

Adform cookie "uid" set before consent — Contains a unique ID to identify a user

Cookie: uidDomain: .criteo.comRetention: 60 days

criticalCookieAdvertisingCriteo

Criteo cookie "cto_bundle" set before consent

Cookie: cto_bundleDomain: .criteo.com

criticalPost-RejectionAdvertisingMicrosoft — Microsoft Ads

Microsoft — Microsoft Ads fires after user rejected consent

Fired: 20941ms after load

criticalPost-RejectionAdvertisingGoogle — Google Ads

Google — Google Ads fires after user rejected consent

Fired: 21471ms after load

Warnings11

Google Tag Manager2 findingsID tracked

www.googletagmanager.com

warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager loads before consent — this is expected and required for GCM v2 to initialise consent defaults before any tags fire

ID: GTM-5Q664QZHost: www.googletagmanager.comFired: 5882ms after load

warningGTMTag ManagementGoogle Tag Manager

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-5Q664QZ)

warningNetworkGA4 (server-side proxy)

Possible server-side tag proxy at gtp-mktg.booking.com — analytics data may be forwarded to third parties before consent. Browser scanning cannot verify downstream recipients; audit your GTM Server-side or CNAME configuration.

Host: gtp-mktg.booking.comFired: 7728ms after load

warningNetwork

Unknown third-party request to d8c14d4960ca.337f8b16.us-east-2.token.awswaf.com before consent

Host: d8c14d4960ca.337f8b16.us-east-2.token.awswaf.comFired: 366ms after load

warningNetwork

Unknown third-party request to cf.bstatic.com before consent

Host: cf.bstatic.comFired: 3098ms after load

warningNetwork

Unknown third-party request to t-cf.bstatic.com before consent

Host: t-cf.bstatic.comFired: 3935ms after load

warningNetwork

Unknown third-party request to q-xx.bstatic.com before consent

Host: q-xx.bstatic.comFired: 4119ms after load

warningNetwork

Unknown third-party request to r-xx.bstatic.com before consent

Host: r-xx.bstatic.comFired: 6549ms after load

warningStorage

sessionStorage key "booking_product_session" written before consent

Key: booking_product_sessionType: sessionStorageFired: 5715ms after load

warningStorage

localStorage key "__rtbhouse.lid" written before consent

Key: __rtbhouse.lidType: localStorageFired: 7120ms after load

warningStorage

localStorage key "criteo_localstorage_check" written before consent

Key: criteo_localstorage_checkType: localStorageFired: 7759ms after load

Info4

OneTrust2 findings

cdn.cookielaw.org, OptanonConsent

infoNetworkConsent MgmtOneTrust

OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management

Host: cdn.cookielaw.orgFired: 3101ms after load

infoCookieConsent MgmtOneTrust

OneTrust cookie "OptanonConsent" set before consent

Cookie: OptanonConsentDomain: .www.booking.com

infoNetworkConsent MgmtOneTrust CMP

OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location

Host: geolocation.onetrust.comFired: 5187ms after load

infoNetworkNaver (Cdn)

Naver (cdn) loaded before consent

Host: s.yimg.jpFired: 7126ms after load

Compliant16

Google Ads3 findings

pagead2.googlesyndication.com, f60953dcd2937878e7ae5c157db65987.safeframe.googlesyndication.com, googleads.g.doubleclick.net

CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: pagead2.googlesyndication.comFired: 3448ms after load

CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: f60953dcd2937878e7ae5c157db65987.safeframe.googlesyndication.comFired: 4228ms after load

CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: googleads.g.doubleclick.netFired: 6179ms after load

Google Analytics5 findings

_ga, FPID, FPAU, FPLC, _ga_A12345

CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga" set correctly after consent

Cookie: _gaDomain: .booking.com

CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "FPID" set correctly after consent

Cookie: FPIDDomain: .booking.comRetention: session

CompliantCookieMarketingGoogle Analytics

Google Analytics cookie "FPAU" set correctly after consent

Cookie: FPAUDomain: .booking.comRetention: session

CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "FPLC" set correctly after consent

Cookie: FPLCDomain: .booking.comRetention: session

CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_A12345" set correctly after consent

Cookie: _ga_A12345Domain: .booking.com

Microsoft Ads2 findings

_uetsid, _uetvid

CompliantCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetsid" set correctly after consent

Cookie: _uetsidDomain: .booking.com

CompliantCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetvid" set correctly after consent

Cookie: _uetvidDomain: .booking.com

CompliantCookieAdvertisingCriteo

Criteo cookie "cto_bundle" set correctly after consent

Cookie: cto_bundleDomain: .booking.com

CompliantCookieMarketingBing / Microsoft

Bing / Microsoft cookie "MUID" set correctly after consent

Cookie: MUIDDomain: .bing.comRetention: 1 year

CompliantCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "IDE" set correctly after consent

Cookie: IDEDomain: .doubleclick.netRetention: 2 years

The Tradedesk2 findings

TDID, TDCPM

CompliantCookieMarketingThe Tradedesk

The Tradedesk cookie "TDID" set correctly after consent

Cookie: TDIDDomain: .adsrvr.orgRetention: 1 year

CompliantCookieMarketingThe Tradedesk

The Tradedesk cookie "TDCPM" set correctly after consent

Cookie: TDCPMDomain: .adsrvr.orgRetention: 1 year

CompliantCookieConsent MgmtOneTrust

OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent

Cookie: OptanonAlertBoxClosedDomain: .www.booking.com

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan booking.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com