eToro

etoro.com

Compare

https://etoro.com

Scanned Apr 15, 2026 · 35.2s

Your website score is

0/100
Critical

Grade

F0

Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 33 user data leaks before consent on etoro.com, including Google (Analytics Tracker), Accessibe (Advertising Tracker), Google Ads and 3 more.

Security Headers

3/6 present

Strict-Transport-Security

max-age=15552000; includeSubDomains; preload

Content-Security-Policy

Add a Content-Security-Policy header to prevent XSS and code injection attacks

X-Frame-Options

DENY

X-Content-Type-Options

nosniff

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

Not Detected

Google Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.

GTM container detected (GTM-N7SQ5DP) but no consent mode initialisation found. Add gtag('consent', 'default', ...) before your GTM snippet.

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

1 vendor

Consent Mode

Not Detected

GTM Load

716ms pre-consent

Google Tag Manager(GTM-N7SQ5DP)

Loaded 716ms after page load — before the consent banner was detected (banner appeared at 7325ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

Vendors firing after rejection (1)

VendorCategoryTimingURL
Google — Google Adsadvertising19905mspagead2.googlesyndication.com

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

Found: OptanonConsent (OneTrust)

Record contains timestamp

Art. 7(1)

Timestamp field detected

Record contains consent state

Art. 7(1)

Accept/reject state detected

Record contains consent categories

Art. 7(1)

Consent categories (analytics, marketing, etc.) not found in record

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising8 vendors
Analytics5 vendors
Marketing6 vendors
Security3
Functional2 vendors
Tag Management1 vendor
Critical12
Google (Analytics Tracker)
criticalNetworkAnalyticsGoogle (Analytics Tracker)

Google (analytics) loaded before consent

ID: GTM-55ZB4XNHost: www.googleoptimize.comFired: 288ms after load
GA4
criticalNetworkAnalyticsGA4

GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics

ID: G-B0NS054E7VHost: region1.google-analytics.comFired: 2743ms after load
Accessibe (Advertising Tracker)
Accessibe (Advertising Tracker)2 findings

acsbapp.com, cdn.acsbapp.com

Accessibe (Advertising Tracker)
criticalNetworkAdvertisingAccessibe (Advertising Tracker)

Accessibe (advertising) loaded before consent

Host: acsbapp.comFired: 526ms after load
Accessibe (Advertising Tracker)
criticalNetworkAdvertisingAccessibe (Advertising Tracker)

Accessibe (advertising) loaded before consent

Host: cdn.acsbapp.comFired: 2350ms after load
Google Ads
Google Ads2 findings

pagead2.googlesyndication.com, ade.googlesyndication.com

Google Ads
criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google ad syndication and remarketing

Host: pagead2.googlesyndication.comFired: 1582ms after load
Google Ads
criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google ad syndication and remarketing

Host: ade.googlesyndication.comFired: 3468ms after load
AppsFlyer
criticalNetworkAdvertisingAppsFlyer

AppsFlyer (AppsFlyer) loaded before consent: AppsFlyer mobile attribution and marketing analytics

Host: onelinksmartscript.appsflyer.comFired: 2518ms after load
Mixpanel
Mixpanel3 findings

mp_dbbd7bd9566da85f012f7ca5d8c6c944_mixpanel, mp_tab_id_mixpanel_dbbd7bd9566da85f012f7ca5d8c6c944, mp_gen_new_tab_id_mixpanel_dbbd7bd9566da85f012f7ca5d8c6c944

Mixpanel
criticalStorageAnalyticsMixpanel

Mixpanel (Mixpanel) wrote "mp_dbbd7bd9566da85f012f7ca5d8c6c944_mixpanel" to localStorage before consent

Key: mp_dbbd7bd9566da85f012f7ca5d8c6c944_mixpanelType: localStorageFired: 788ms after load
Mixpanel
criticalStorageAnalyticsMixpanel

Mixpanel (Mixpanel) wrote "mp_tab_id_mixpanel_dbbd7bd9566da85f012f7ca5d8c6c944" to sessionStorage before consent

Key: mp_tab_id_mixpanel_dbbd7bd9566da85f012f7ca5d8c6c944Type: sessionStorageFired: 799ms after load
Mixpanel
criticalStorageAnalyticsMixpanel

Mixpanel (Mixpanel) wrote "mp_gen_new_tab_id_mixpanel_dbbd7bd9566da85f012f7ca5d8c6c944" to sessionStorage before consent

Key: mp_gen_new_tab_id_mixpanel_dbbd7bd9566da85f012f7ca5d8c6c944Type: sessionStorageFired: 799ms after load
Google — Google Ads
criticalPost-RejectionAdvertisingGoogle — Google Ads

Google — Google Ads fires after user rejected consent

Fired: 19905ms after load
criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings23
Google Tag Manager
Google Tag Manager2 findingsID tracked

www.googletagmanager.com

Google Tag Manager
warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager (Google) loaded before consent: Loads the GTM container which may trigger other tags

ID: GTM-N7SQ5DPHost: www.googletagmanager.comFired: 507ms after load
Google Tag Manager
warningGTMTag ManagementGoogle Tag Manager

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-N7SQ5DP)

vendor logo
warningNetwork

Unknown third-party request to marketing.etorostatic.com before consent

Host: marketing.etorostatic.comFired: 287ms after load
vendor logo
warningNetwork

Unknown third-party request to accounts.google.com before consent

Host: accounts.google.comFired: 288ms after load
vendor logo
warningNetwork

Unknown third-party request to google.com before consent

Host: google.comFired: 3557ms after load
vendor logo
warningNetwork

Unknown third-party request to wp-nav-pro.com before consent

Host: wp-nav-pro.comFired: 5501ms after load
warningStorage

localStorage key "etoro_usid" written before consent

Key: etoro_usidType: localStorageFired: 466ms after load
warningStorage

localStorage key "__mplss_dmokxid9" written before consent

Key: __mplss_dmokxid9Type: localStorageFired: 774ms after load
warningStorage

sessionStorage key "__mplss_zstipcj7" written before consent

Key: __mplss_zstipcj7Type: sessionStorageFired: 798ms after load
warningStorage

localStorage key "etoroMarketingUserSession" written before consent

Key: etoroMarketingUserSessionType: localStorageFired: 1299ms after load
warningStorage

localStorage key "__mplss_4p0dj2eu" written before consent

Key: __mplss_4p0dj2euType: localStorageFired: 2514ms after load
warningStorage

localStorage key "__mpq_dbbd7bd9566da85f012f7ca5d8c6c944_ev:X" written before consent

Key: __mpq_dbbd7bd9566da85f012f7ca5d8c6c944_ev:XType: localStorageFired: 2514ms after load
warningStorage

localStorage key "__mpq_dbbd7bd9566da85f012f7ca5d8c6c944_ev:Y" written before consent

Key: __mpq_dbbd7bd9566da85f012f7ca5d8c6c944_ev:YType: localStorageFired: 2514ms after load
warningStorage

localStorage key "__mpq_dbbd7bd9566da85f012f7ca5d8c6c944_ev:Z" written before consent

Key: __mpq_dbbd7bd9566da85f012f7ca5d8c6c944_ev:ZType: localStorageFired: 2514ms after load
warningStorage

localStorage key "__mpq_dbbd7bd9566da85f012f7ca5d8c6c944_ev" written before consent

Key: __mpq_dbbd7bd9566da85f012f7ca5d8c6c944_evType: localStorageFired: 2516ms after load
warningStorage

localStorage key "ss_incoming_params" written before consent

Key: ss_incoming_paramsType: localStorageFired: 3245ms after load
warningStorage

localStorage key "ss_webReferrer" written before consent

Key: ss_webReferrerType: localStorageFired: 3246ms after load
warningStorage

localStorage key "__mplss_rpf527wo" written before consent

Key: __mplss_rpf527woType: localStorageFired: 3519ms after load
warningStorage

sessionStorage key "__sak" written before consent

Key: __sakType: sessionStorageFired: 3520ms after load
warningStorage

localStorage key "NRBA_SESSION" written before consent

Key: NRBA_SESSIONType: localStorageFired: 3563ms after load
warningStorage

localStorage key "__mplss_e63ot8by" written before consent

Key: __mplss_e63ot8byType: localStorageFired: 4522ms after load
warningStorage

localStorage key "__mplss_x2gzsgcw" written before consent

Key: __mplss_x2gzsgcwType: localStorageFired: 4524ms after load
warningStorage

localStorage key "__mplss_sc6c38d9" written before consent

Key: __mplss_sc6c38d9Type: localStorageFired: 5877ms after load
Info9
OneTrust
OneTrust2 findings

cdn.cookielaw.org, OptanonConsent

OneTrust
infoNetworkConsent MgmtOneTrust

OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management

Host: cdn.cookielaw.orgFired: 288ms after load
OneTrust
infoCookieConsent MgmtOneTrust

OneTrust cookie "OptanonConsent" set before consent

Cookie: OptanonConsentDomain: .etoro.com
OneTrust CMP
infoNetworkConsent MgmtOneTrust CMP

OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location

Host: geolocation.onetrust.comFired: 573ms after load
New Relic
New Relic2 findings

js-agent.newrelic.com, bam.nr-data.net

New Relic
infoNetworkAnalyticsNew Relic

New Relic (New Relic) loaded before consent: New Relic browser monitoring agent

Host: js-agent.newrelic.comFired: 3557ms after load
New Relic
infoNetworkAnalyticsNew Relic

New Relic (New Relic) loaded before consent: New Relic browser data collection endpoint

Host: bam.nr-data.netFired: 3597ms after load
Cloudflare
infoCookieFunctionalCloudflare

Cloudflare cookie "__cflb" set before consent — When enabling session affinity with Cloudflare Load Balancer, Cloudflare sets a __cflb cookie with a unique value on the first response to the requesting client. Cloudflare routes future requests to the same origin, optimizing network resource usage. In the event of a failover, Cloudflare sets a new __cflb cookie to direct future requests to the failover pool.

Cookie: __cflbDomain: www.etoro.comRetention: session
infoCookieFunctional

Cloudflare challenge clearance — necessary for site access

Cookie: cf_clearanceDomain: .etoro.com
infoCookieFunctional

Cloudflare bot management — necessary for site operation

Cookie: __cf_bmDomain: .etoro.com
infoCookieFunctional

DataDome bot protection — necessary for site security

Cookie: datadomeDomain: .etoro.com
Compliant34
Google Analytics
Google Analytics3 findingsID tracked

region1.analytics.google.com, _ga_B0NS054E7V, _ga

GA4
CompliantNetworkAnalyticsGA4

GA4 (Google) loaded correctly after consent

ID: G-B0NS054E7VHost: region1.analytics.google.comFired: 2338ms after load
Google Analytics
CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_B0NS054E7V" set correctly after consent

Cookie: _ga_B0NS054E7VDomain: .etoro.com
Google Analytics
CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga" set correctly after consent

Cookie: _gaDomain: .etoro.com
Meta Pixel
Meta Pixel3 findingsID tracked

www.facebook.com, connect.facebook.net, _fbp

Meta Pixel
CompliantNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded correctly after consent

ID: 432617183539790Host: www.facebook.comFired: 3517ms after load
Meta Pixel
CompliantNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded correctly after consent

Host: connect.facebook.netFired: 1260ms after load
Meta Pixel
CompliantCookieAdvertisingMeta Pixel

Meta Pixel cookie "_fbp" set correctly after consent

Cookie: _fbpDomain: .etoro.com
Microsoft Ads
Microsoft Ads3 findings

bat.bing.com, _uetsid, _uetvid

Microsoft Ads
CompliantNetworkAdvertisingMicrosoft Ads

Microsoft Ads (Microsoft) loaded correctly after consent

Host: bat.bing.comFired: 1260ms after load
Microsoft Ads
CompliantCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetsid" set correctly after consent

Cookie: _uetsidDomain: .etoro.com
Microsoft Ads
CompliantCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetvid" set correctly after consent

Cookie: _uetvidDomain: .etoro.com
Taboola
Taboola5 findings

cdn.taboola.com, trc.taboola.com, taboola_session_id, t_gid, t_pt_gid

Taboola
CompliantNetworkAdvertisingTaboola

Taboola (Taboola) loaded correctly after consent

Host: cdn.taboola.comFired: 1266ms after load
Taboola
CompliantNetworkAdvertisingTaboola

Taboola (Taboola) loaded correctly after consent

Host: trc.taboola.comFired: 2981ms after load
Taboola
CompliantCookieMarketingTaboola

Taboola cookie "taboola_session_id" set correctly after consent

Cookie: taboola_session_idDomain: .taboola.comRetention: Session
Taboola
CompliantCookieMarketingTaboola

Taboola cookie "t_gid" set correctly after consent

Cookie: t_gidDomain: .taboola.comRetention: 13 months
Taboola
CompliantCookieFunctionalTaboola

Taboola cookie "t_pt_gid" set correctly after consent

Cookie: t_pt_gidDomain: .taboola.comRetention: 1 Year
Twitter/X Pixel
CompliantNetworkAdvertisingTwitter/X Pixel

Twitter/X Pixel (X (Twitter)) loaded correctly after consent

Host: static.ads-twitter.comFired: 1266ms after load
Google Ads
Google Ads5 findings

www.google.com, googleads.g.doubleclick.net, www.googleadservices.com, _gcl_au, _gcl_ls

Google Ads
CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: www.google.comFired: 1267ms after load
Google Ads
CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: googleads.g.doubleclick.netFired: 2547ms after load
Google Ads
CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: www.googleadservices.comFired: 2705ms after load
Google Ads
CompliantCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set correctly after consent

Cookie: _gcl_auDomain: .etoro.com
Google Ads
CompliantStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage correctly after consent

Key: _gcl_lsType: localStorageFired: 1150ms after load
OneTrust
CompliantCookieConsent MgmtOneTrust

OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent

Cookie: OptanonAlertBoxClosedDomain: .etoro.com
X5 findings

guest_id_marketing, guest_id_ads, personalization_id, guest_id, muc_ads

CompliantCookieMarketingX

X cookie "guest_id_marketing" set correctly after consent

Cookie: guest_id_marketingDomain: .twitter.comRetention: 2 years
CompliantCookieMarketingX

X cookie "guest_id_ads" set correctly after consent

Cookie: guest_id_adsDomain: .twitter.comRetention: 2 years
CompliantCookieMarketingX

X cookie "personalization_id" set correctly after consent

Cookie: personalization_idDomain: .twitter.comRetention: 2 years
CompliantCookieMarketingX

X cookie "guest_id" set correctly after consent

Cookie: guest_idDomain: .twitter.comRetention: 2 years
CompliantCookieMarketingX

X cookie "muc_ads" set correctly after consent

Cookie: muc_adsDomain: .t.coRetention: 24 months
DoubleClick/Google Marketing
CompliantCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "IDE" set correctly after consent

Cookie: IDEDomain: .doubleclick.netRetention: 2 years
Adalyser.com4 findings

__adal_ses, __adal_id, __adal_ca, __adal_cw

CompliantCookieMarketingAdalyser.com

Adalyser.com cookie "__adal_ses" set correctly after consent

Cookie: __adal_sesDomain: .etoro.comRetention: session
CompliantCookieMarketingAdalyser.com

Adalyser.com cookie "__adal_id" set correctly after consent

Cookie: __adal_idDomain: .etoro.comRetention: 2 years
CompliantCookieMarketingAdalyser.com

Adalyser.com cookie "__adal_ca" set correctly after consent

Cookie: __adal_caDomain: .etoro.comRetention: 6 months
CompliantCookieMarketingAdalyser.com

Adalyser.com cookie "__adal_cw" set correctly after consent

Cookie: __adal_cwDomain: .etoro.comRetention: 7 days
Bing / Microsoft
CompliantCookieMarketingBing / Microsoft

Bing / Microsoft cookie "MUID" set correctly after consent

Cookie: MUIDDomain: .bing.comRetention: 1 year
Amazon
Amazon2 findings

ad-id, ad-privacy

Amazon
CompliantCookieMarketingAmazon

Amazon cookie "ad-id" set correctly after consent

Cookie: ad-idDomain: .amazon-adsystem.comRetention: 190 days
Amazon
CompliantCookieMarketingAmazon

Amazon cookie "ad-privacy" set correctly after consent

Cookie: ad-privacyDomain: .amazon-adsystem.comRetention: 5 years

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan etoro.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com