Chipotle Cookie Compliance Report

Chipotle

chipotle.com

Compare

https://chipotle.com

Scanned Apr 15, 2026 · 41.2s

Your website score is

0/100

Critical

Grade

BannerConsent Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 35 user data leaks before consent on chipotle.com, including DataDog (Analytics Tracker), FullStory, Branch and 5 more.

Security Headers

3/6 present

Strict-Transport-Security

max-age=31557600

Content-Security-Policy

frame-ancestors 'self' sdiapi.com app.datadoghq.com; report-uri https://browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pub6df94c90ac4e89b7d31cb3f4ac5cc298&dd-evp-origin=content-security-policy&ddsource=csp-report; script-src 'self' blob: 'nonce-ad_69xHQFLiZp1f9h81MvwAAAWQ' 'strict-dynamic' 'unsafe-inline' https: http: ;object-src 'none';base-uri 'self';

X-Frame-Options

Add X-Frame-Options header to prevent clickjacking attacks

X-Content-Type-Options

nosniff

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

60/100

GTM Containers:GTM-5PRDNQPS

Consent Parameters

ParameterDefaultUpdated

Ad Storagegrantedgranted

Ad User Datagrantedgranted

Ad Personalizationgrantedgranted

Analytics Storagegrantedgranted

Functionality Storagenot_setnot_set

Personalization Storagenot_setnot_set

Security Storagenot_setnot_set

Issues (4)

ad_storage defaults to "granted" — should default to "denied" for GDPR compliance

ad_user_data defaults to "granted" — should default to "denied" for GDPR compliance

ad_personalization defaults to "granted" — should default to "denied" for GDPR compliance

analytics_storage defaults to "granted" — should default to "denied" for GDPR compliance

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

2 vendors

Consent Mode

Not Detected

GTM Load

1199ms pre-consent

Google Tag Manager(GTM-5PRDNQPS)

Loaded 1199ms after page load — before the consent banner was detected (banner appeared at 8157ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

✓ gtag('consent', 'update') call detected on rejection

Vendors firing after rejection (2)

Vendor	Category	Timing	URL
Google — Google Tag Manager	tag_management	21908ms	www.googletagmanager.com
Branch — Branch	advertising	23139ms	cdn.branch.io

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

No consent record written — cannot prove consent was given

No CMP consent cookie or localStorage entry was found after the consent interaction. GDPR requires controllers to demonstrate consent was given.

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising4 vendors

Analytics5 vendors

Security3

Tag Management2 vendors

Critical17

criticalNetworkAnalyticsDataDog (Analytics Tracker)

DataDog (analytics) loaded before consent

Host: www.datadoghq-browser-agent.comFired: 1044ms after load

FullStory3 findings

edge.fullstory.com, rs.fullstory.com, _fs_tab_id

criticalNetworkAnalyticsFullStory

FullStory (FullStory) loaded before consent: FullStory session recording and digital experience analytics

Host: edge.fullstory.comFired: 1606ms after load

criticalNetworkAnalyticsFullStory

FullStory (FullStory) loaded before consent: FullStory session recording and digital experience analytics

Host: rs.fullstory.comFired: 2474ms after load

criticalStorageAnalyticsFullStory

FullStory (FullStory) wrote "_fs_tab_id" to sessionStorage before consent

Key: _fs_tab_idType: sessionStorageFired: 2469ms after load

criticalNetworkAdvertisingBranch

Branch (Branch) loaded before consent: Branch deep linking and attribution

Host: cdn.branch.ioFired: 2074ms after load

Branch (Advertising Tracker)2 findings

app.link, api2.branch.io

criticalNetworkAdvertisingBranch (Advertising Tracker)

Branch (advertising) loaded before consent

Host: app.linkFired: 2485ms after load

criticalNetworkAdvertisingBranch (Advertising Tracker)

Branch (advertising) loaded before consent

Host: api2.branch.ioFired: 2926ms after load

Advertising Tracker2 findings

reporting.cdndex.io, r.sdiapi.net

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at reporting.cdndex.io loaded before consent

Host: reporting.cdndex.ioFired: 3516ms after load

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at r.sdiapi.net loaded before consent

Host: r.sdiapi.netFired: 3761ms after load

criticalCookieAnalyticsAdobe Analytics

Adobe Analytics cookie "AMCV_4E7F56EC5BE2CCCF0A495CE8%40AdobeOrg" set before consent

Cookie: AMCV_4E7F56EC5BE2CCCF0A495CE8%40AdobeOrgDomain: .chipotle.com

Marfeel2 findings

_swb, _swb_consent_

criticalCookieAnalyticsMarfeel

Marfeel cookie "_swb" set before consent — This cookie is used to store for temporary session

Cookie: _swbDomain: .chipotle.comRetention: Session

criticalCookieAnalyticsMarfeel

Marfeel cookie "_swb_consent_" set before consent — This cookie is used to store for temporary session

Cookie: _swb_consent_Domain: .chipotle.comRetention: Session

criticalCookieAnalyticsShopify

Shopify cookie "_s" set before consent — Shopify analytics.

Cookie: _sDomain: .app.linkRetention: 2 years

criticalPost-RejectionTag ManagementGoogle — Google Tag Manager

Google — Google Tag Manager fires after user rejected consent

Fired: 21908ms after load

criticalPost-RejectionAdvertisingBranch — Branch

Branch — Branch fires after user rejected consent

Fired: 23139ms after load

criticalConsent Record

No recognizable consent cookie or storage entry detected after interaction — GDPR Article 7(1) requires controllers to demonstrate consent was given (server-side storage cannot be verified)

criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings22

Google Tag Manager2 findingsID tracked

www.googletagmanager.com

warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager (Google) loaded before consent: Loads the GTM container which may trigger other tags

ID: GTM-5PRDNQPSHost: www.googletagmanager.comFired: 1044ms after load

warningGTMTag ManagementGoogle Tag Manager

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-5PRDNQPS)

warningConsentUnknown

Unknown was clicked but no consent storage was written — tags may continue firing as if consent was never given

warningNetworkAnalytics proxy

Possible server-side tag proxy at metrics.chipotle.com — analytics data may be forwarded to third parties before consent. Browser scanning cannot verify downstream recipients; audit your GTM Server-side or CNAME configuration.

Host: metrics.chipotle.comFired: 1258ms after load

warningNetwork

Unknown third-party request to vice-prod.sdiapi.com before consent

Host: vice-prod.sdiapi.comFired: 276ms after load

warningNetwork

Unknown third-party request to a40.usablenet.com before consent

Host: a40.usablenet.comFired: 276ms after load

warningNetwork

Unknown third-party request to assets.adobedtm.com before consent

Host: assets.adobedtm.comFired: 276ms after load

warningNetwork

Unknown third-party request to services.sdiapi.com before consent

Host: services.sdiapi.comFired: 722ms after load

warningNetwork

Unknown third-party request to global.ketchcdn.com before consent

Host: global.ketchcdn.comFired: 875ms after load

warningNetwork

Unknown third-party request to cdn.ketchjs.com before consent

Host: cdn.ketchjs.comFired: 1054ms after load

warningNetwork

Unknown third-party request to browser-intake-us3-datadoghq.com before consent

Host: browser-intake-us3-datadoghq.comFired: 2454ms after load

warningStorage

localStorage key "SD_SID" written before consent

Key: SD_SIDType: localStorageFired: 646ms after load

warningStorage

localStorage key "fgh57jPSMKUFH3gA-rc" written before consent

Key: fgh57jPSMKUFH3gA-rcType: localStorageFired: 1619ms after load

warningStorage

localStorage key "__SPLITSOFTWARE__" written before consent

Key: __SPLITSOFTWARE__Type: localStorageFired: 1889ms after load

warningStorage

sessionStorage key "test" written before consent

Key: testType: sessionStorageFired: 2474ms after load

warningStorage

sessionStorage key "branch_session" written before consent

Key: branch_sessionType: sessionStorageFired: 3519ms after load

warningStorage

localStorage key "branch_session_first" written before consent

Key: branch_session_firstType: localStorageFired: 3519ms after load

warningStorage

localStorage key "_swb_consent__metadata" written before consent

Key: _swb_consent__metadataType: localStorageFired: 3759ms after load

warningStorage

localStorage key "_swb_consent_" written before consent

Key: _swb_consent_Type: localStorageFired: 3759ms after load

warningStorage

localStorage key "_ketch_consent_v1_" written before consent

Key: _ketch_consent_v1_Type: localStorageFired: 3767ms after load

warningStorage

localStorage key "com.adobe.alloy.4E7F56EC5BE2CCCF0A495CE8_AdobeOrg.consentHashes.Adobe.2.0" written before consent

Key: com.adobe.alloy.4E7F56EC5BE2CCCF0A495CE8_AdobeOrg.consentHashes.Adobe.2.0Type: localStorageFired: 4310ms after load

warningStorage

localStorage key "fgh57jPSMKUFH3gA" written before consent

Key: fgh57jPSMKUFH3gAType: localStorageFired: 4423ms after load

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan chipotle.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com