Coca-Cola Cookie Compliance Report

Coca-Cola

coca-cola.com

Compare

https://coca-cola.com

Scanned Apr 15, 2026 · 36.0s

Your website score is

60/100

Needs Work

Grade

C60

BannerConsent Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 6 user data leaks before consent on coca-cola.com, including Advertising Tracker.

Security Headers

3/6 present

Strict-Transport-Security

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

default-src * data: mediastream: blob: filesystem: about: ws: wss: 'unsafe-eval' 'wasm-unsafe-eval' 'unsafe-inline';script-src * data: mediastream: blob: filesystem: about: 'unsafe-eval' 'unsafe-inline';connect-src * data: mediastream: blob: filesystem: about: 'unsafe-eval' 'unsafe-inline';frame-src * data: mediastream: blob: filesystem: about: 'unsafe-eval' 'unsafe-inline';frame-ancestors 'self' https://food.grab.com https://food.stg-myteksi.com

X-Frame-Options

Add X-Frame-Options header to prevent clickjacking attacks

X-Content-Type-Options

nosniff

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

70/100

GTM Containers:GTM-NBWPCZWGTM-WR2FVZCF

Consent Parameters

ParameterDefaultUpdated

Ad Storagenot_setgranted

Ad User Datanot_setgranted

Ad Personalizationnot_setgranted

Analytics Storagenot_setgranted

Functionality Storagenot_setgranted

Personalization Storagenot_setgranted

Security Storagenot_setgranted

Issues (1)

No default consent call detected — consent mode may not be initialised correctly

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

1018ms pre-consent

Google Tag Manager(GTM-NBWPCZW)

Loaded 1018ms after page load — before the consent banner was detected (banner appeared at 7205ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

✓ gtag('consent', 'update') call detected on rejection

No tracking vendors detected firing after rejection

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

Found: OptanonConsent (OneTrust)

Record contains timestamp

Art. 7(1)

Timestamp field detected

Record contains consent state

Art. 7(1)

Accept/reject state detected

Record contains consent categories

Art. 7(1)

Consent categories (analytics, marketing, etc.) not found in record

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising5 vendors

Analytics5 vendors

Marketing7 vendors

Security3

Functional2 vendors

Tag Management1 vendor

Critical2

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at rum.hlx.page loaded before consent

Host: rum.hlx.pageFired: 501ms after load

criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings5

Google Tag Manager2 findingsID tracked

www.googletagmanager.com

warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager loads before consent — this is expected and required for GCM v2 to initialise consent defaults before any tags fire

ID: GTM-NBWPCZWHost: www.googletagmanager.comFired: 869ms after load

warningGTMTag ManagementGoogle Tag Manager

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-NBWPCZW)

warningNetwork

Unknown third-party request to cdn.global.gcds.coke.com before consent

Host: cdn.global.gcds.coke.comFired: 505ms after load

warningNetwork

Unknown third-party request to www.google.com before consent

Host: www.google.comFired: 512ms after load

warningStorage

sessionStorage key "userTimeZone" written before consent

Key: userTimeZoneType: sessionStorageFired: 2611ms after load

Info4

OneTrust2 findings

cdn.cookielaw.org, OptanonConsent

infoNetworkConsent MgmtOneTrust

OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management

Host: cdn.cookielaw.orgFired: 502ms after load

infoCookieConsent MgmtOneTrust

OneTrust cookie "OptanonConsent" set before consent

Cookie: OptanonConsentDomain: .coca-cola.com

Google (Cdn)2 findings

www.gstatic.com, fonts.gstatic.com

infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: www.gstatic.comFired: 870ms after load

infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: fonts.gstatic.comFired: 2918ms after load

Compliant39

Microsoft Clarity3 findingsID tracked

www.clarity.ms, scripts.clarity.ms, _clck

CompliantNetworkAnalyticsMicrosoft Clarity

Microsoft Clarity (Microsoft) loaded correctly after consent

ID: p869ucv4v0Host: www.clarity.msFired: 2117ms after load

CompliantNetworkAnalyticsMicrosoft Clarity

Microsoft Clarity (Microsoft) loaded correctly after consent

Host: scripts.clarity.msFired: 2623ms after load

CompliantCookieAnalyticsMicrosoft Clarity

Microsoft Clarity cookie "_clck" set correctly after consent

Cookie: _clckDomain: .coca-cola.com

TikTok Pixel7 findingsID tracked

analytics.tiktok.com, analytics-ipv6.tiktokw.us, _ttp, _tt_enable_cookie, tt_sessionId, tt_appInfo, tt_pixel_session_index

CompliantNetworkAdvertisingTikTok Pixel

TikTok Pixel (TikTok) loaded correctly after consent

ID: CRQH5UJC77U87P3RBFU0Host: analytics.tiktok.comFired: 2121ms after load

CompliantNetworkAdvertisingTikTok Pixel

TikTok Pixel (TikTok) loaded correctly after consent

Host: analytics-ipv6.tiktokw.usFired: 4421ms after load

CompliantCookieAdvertisingTikTok Pixel

TikTok Pixel cookie "_ttp" set correctly after consent

Cookie: _ttpDomain: .tiktok.com

CompliantCookieAdvertisingTikTok Pixel

TikTok Pixel cookie "_tt_enable_cookie" set correctly after consent

Cookie: _tt_enable_cookieDomain: .coca-cola.com

CompliantStorageAdvertisingTikTok Pixel

TikTok Pixel (TikTok) wrote "tt_sessionId" to sessionStorage correctly after consent

Key: tt_sessionIdType: sessionStorageFired: -21984ms after load

CompliantStorageAdvertisingTikTok Pixel

TikTok Pixel (TikTok) wrote "tt_appInfo" to sessionStorage correctly after consent

Key: tt_appInfoType: sessionStorageFired: -21958ms after load

CompliantStorageAdvertisingTikTok Pixel

TikTok Pixel (TikTok) wrote "tt_pixel_session_index" to sessionStorage correctly after consent

Key: tt_pixel_session_indexType: sessionStorageFired: -21954ms after load

Meta Pixel3 findingsID tracked

www.facebook.com, connect.facebook.net, _fbp

CompliantNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded correctly after consent

ID: 1217743172600881Host: www.facebook.comFired: 4036ms after load

CompliantNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded correctly after consent

Host: connect.facebook.netFired: 2117ms after load

CompliantCookieAdvertisingMeta Pixel

Meta Pixel cookie "_fbp" set correctly after consent

Cookie: _fbpDomain: .coca-cola.com

Snapchat Pixel4 findings

sc-static.net, tr.snapchat.com, _scid, _scid_r

CompliantNetworkAdvertisingSnapchat Pixel

Snapchat Pixel (Snapchat) loaded correctly after consent

Host: sc-static.netFired: 2508ms after load

CompliantNetworkAdvertisingSnapchat Pixel

Snapchat Pixel (Snapchat) loaded correctly after consent

Host: tr.snapchat.comFired: 4489ms after load

CompliantCookieAdvertisingSnapchat Pixel

Snapchat Pixel cookie "_scid" set correctly after consent

Cookie: _scidDomain: .coca-cola.com

CompliantCookieAdvertisingSnapchat Pixel

Snapchat Pixel cookie "_scid_r" set correctly after consent

Cookie: _scid_rDomain: .coca-cola.com

Google Ads3 findings

www.google.com, _gcl_au, _gcl_ls

CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: www.google.comFired: 2508ms after load

CompliantCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set correctly after consent

Cookie: _gcl_auDomain: .coca-cola.com

CompliantStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage correctly after consent

Key: _gcl_lsType: localStorageFired: -23335ms after load

CompliantCookieFunctionalSnapchat

Snapchat cookie "X-AB" set correctly after consent

Cookie: X-ABDomain: sc-static.netRetention: 1 day

CompliantCookieFunctionalGoogle reCAPTCHA

Google reCAPTCHA cookie "_GRECAPTCHA" set correctly after consent

Cookie: _GRECAPTCHADomain: www.google.comRetention: 179 days

CompliantCookieConsent MgmtOneTrust

OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent

Cookie: OptanonAlertBoxClosedDomain: .coca-cola.com

Google Analytics2 findings

_ga, _ga_LKYNYLPZ3Z

CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga" set correctly after consent

Cookie: _gaDomain: .coca-cola.com

CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_LKYNYLPZ3Z" set correctly after consent

Cookie: _ga_LKYNYLPZ3ZDomain: .coca-cola.com

Amazon2 findings

ad-id, ad-privacy

CompliantCookieMarketingAmazon

Amazon cookie "ad-id" set correctly after consent

Cookie: ad-idDomain: .amazon-adsystem.comRetention: 190 days

CompliantCookieMarketingAmazon

Amazon cookie "ad-privacy" set correctly after consent

Cookie: ad-privacyDomain: .amazon-adsystem.comRetention: 5 years

Adobe Audience Manager2 findings

demdex, dpm

CompliantCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "demdex" set correctly after consent

Cookie: demdexDomain: .demdex.netRetention: 180 days after last activity or 10 years when opting out

CompliantCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "dpm" set correctly after consent

Cookie: dpmDomain: .dpm.demdex.netRetention: 180 days

The Tradedesk2 findings

TDID, TDCPM

CompliantCookieMarketingThe Tradedesk

The Tradedesk cookie "TDID" set correctly after consent

Cookie: TDIDDomain: .adsrvr.orgRetention: 1 year

CompliantCookieMarketingThe Tradedesk

The Tradedesk cookie "TDCPM" set correctly after consent

Cookie: TDCPMDomain: .adsrvr.orgRetention: 1 year

CompliantCookieAnalyticsAdobe Analytics

Adobe Analytics cookie "AMCV_9075A2B154DE8AF80A4C98A7%40AdobeOrg" set correctly after consent

Cookie: AMCV_9075A2B154DE8AF80A4C98A7%40AdobeOrgDomain: .coca-cola.com

CompliantCookieMarketingAdobe Advertising

Adobe Advertising cookie "everest_g_v2" set correctly after consent

Cookie: everest_g_v2Domain: .everesttech.netRetention: 2 years

CompliantCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "IDE" set correctly after consent

Cookie: IDEDomain: .doubleclick.netRetention: 2 years

CompliantCookieMarketingQuantcast

Quantcast cookie "mc" set correctly after consent

Cookie: mcDomain: .quantserve.comRetention: 13 months

CompliantCookieAnalyticsWeborama

Weborama cookie "AFFICHE_W" set correctly after consent

Cookie: AFFICHE_WDomain: .weborama.frRetention: 3 months

CompliantCookieAnalyticsSnowplow

Snowplow cookie "sp" set correctly after consent

Cookie: spDomain: .quantserve.comRetention: 1 year

TikTok2 findings

ttcsid, ttcsid_CRQH5UJC77U87P3RBFU0

CompliantCookieMarketingTikTok

TikTok cookie "ttcsid" set correctly after consent

Cookie: ttcsidDomain: .coca-cola.comRetention: 1 year

CompliantCookieMarketingTikTok

TikTok cookie "ttcsid_CRQH5UJC77U87P3RBFU0" set correctly after consent

Cookie: ttcsid_CRQH5UJC77U87P3RBFU0Domain: .coca-cola.comRetention: 1 year

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan coca-cola.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com