FanDuel Cookie Compliance Report

FanDuel

fanduel.com

Compare

https://fanduel.com

Scanned Apr 15, 2026 · 26.8s

Your website score is

0/100

Critical

Grade

BannerConsent Banner

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 72 user data leaks before consent on fanduel.com, including Amplitude, Amplitude (Analytics Tracker), Snapchat Pixel and 21 more.

Security Headers

6/6 present

Strict-Transport-Security

max-age=15768000 max-age=31536000

Content-Security-Policy

frame-ancestors 'self' http://localhost:3333 https://fanduel-marketing-production.sanity.studio https://fanduel-marketing-development.sanity.studio

X-Frame-Options

SAMEORIGIN

X-Content-Type-Options

nosniff

Referrer-Policy

no-referrer

Permissions-Policy

clipboard-read=(),clipboard-write=(),gamepad=(),speaker-selection=(),accelerometer=(),ambient-light-sensor=(),autoplay=(),battery=(),camera=(),cross-origin-isolated=(),display-capture=(),document-domain=(),encrypted-media=(),execution-while-not-rendered=(),execution-while-out-of-viewport=(),fullscreen=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),midi=(),navigation-override=(),payment=(),picture-in-picture=(),publickey-credentials-get=(),screen-wake-lock=(),sync-xhr=(),usb=(),web-share=(),xr-spatial-tracking=()

Google Consent Mode

Not Detected

Google Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.

GTM container detected (GTM-5DGV8G4M) but no consent mode initialisation found. Add gtag('consent', 'default', ...) before your GTM snippet.

Post-Rejection Audit

Reject Button

Missing

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

2315ms pre-consent

Google Tag Manager(GTM-5DGV8G4M)

Loaded 2315ms after page load — before the consent banner was detected. Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

No consent record written — cannot prove consent was given

No CMP consent cookie or localStorage entry was found after the consent interaction. GDPR requires controllers to demonstrate consent was given.

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising16 vendors

Analytics4 vendors

Marketing3 vendors

Functional1 vendor

Tag Management1 vendor

Critical54

TikTok Pixel6 findingsID tracked

analytics.tiktok.com, _ttp, _tt_enable_cookie, tt_sessionId, tt_appInfo, tt_pixel_session_index

criticalNetworkAdvertisingTikTok Pixel

TikTok Pixel (TikTok) loaded before consent: Sends event data to TikTok for ad measurement

ID: C0JCDQ52BAPH375FC790Host: analytics.tiktok.comFired: 2599ms after load

criticalCookieAdvertisingTikTok Pixel

TikTok Pixel cookie "_ttp" set before consent

Cookie: _ttpDomain: .tiktok.com

criticalCookieAdvertisingTikTok Pixel

TikTok Pixel cookie "_tt_enable_cookie" set before consent

Cookie: _tt_enable_cookieDomain: .fanduel.com

criticalStorageAdvertisingTikTok Pixel

TikTok Pixel (TikTok) wrote "tt_sessionId" to sessionStorage before consent

Key: tt_sessionIdType: sessionStorageFired: 3699ms after load

criticalStorageAdvertisingTikTok Pixel

TikTok Pixel (TikTok) wrote "tt_appInfo" to sessionStorage before consent

Key: tt_appInfoType: sessionStorageFired: 3712ms after load

criticalStorageAdvertisingTikTok Pixel

TikTok Pixel (TikTok) wrote "tt_pixel_session_index" to sessionStorage before consent

Key: tt_pixel_session_indexType: sessionStorageFired: 3713ms after load

Meta Pixel3 findingsID tracked

www.facebook.com, connect.facebook.net, _fbp

criticalNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded before consent: Meta Pixel tracking endpoint

ID: 317146971777296Host: www.facebook.comFired: 3608ms after load

criticalNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded before consent: Sends user data to Meta for ad targeting and conversion tracking

Host: connect.facebook.netFired: 2599ms after load

criticalCookieAdvertisingMeta Pixel

Meta Pixel cookie "_fbp" set before consent

Cookie: _fbpDomain: .fanduel.com

Amplitude3 findings

cdn.amplitude.com, amp_device_id, amp_session_id

criticalNetworkAnalyticsAmplitude

Amplitude (Amplitude) loaded before consent: Amplitude product analytics

Host: cdn.amplitude.comFired: 641ms after load

criticalCookieAnalyticsAmplitude

Amplitude cookie "amp_device_id" set before consent — Registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator.

Cookie: amp_device_idDomain: .fanduel.comRetention: 1 year

criticalCookieAnalyticsAmplitude

Amplitude cookie "amp_session_id" set before consent — Registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator.

Cookie: amp_session_idDomain: .fanduel.comRetention: 1 year

Amplitude (Analytics Tracker)3 findings

flag.lab.amplitude.com, api.lab.amplitude.com, api2.amplitude.com

criticalNetworkAnalyticsAmplitude (Analytics Tracker)

Amplitude (analytics) loaded before consent

Host: flag.lab.amplitude.comFired: 1688ms after load

criticalNetworkAnalyticsAmplitude (Analytics Tracker)

Amplitude (analytics) loaded before consent

Host: api.lab.amplitude.comFired: 2193ms after load

criticalNetworkAnalyticsAmplitude (Analytics Tracker)

Amplitude (analytics) loaded before consent

Host: api2.amplitude.comFired: 3213ms after load

Snapchat Pixel4 findings

sc-static.net, tr.snapchat.com, _scid, _scid_r

criticalNetworkAdvertisingSnapchat Pixel

Snapchat Pixel (Snapchat) loaded before consent: Loads Snapchat conversion tracking script

Host: sc-static.netFired: 2540ms after load

criticalNetworkAdvertisingSnapchat Pixel

Snapchat Pixel (Snapchat) loaded before consent: Snapchat pixel tracking endpoint

Host: tr.snapchat.comFired: 3310ms after load

criticalCookieAdvertisingSnapchat Pixel

Snapchat Pixel cookie "_scid" set before consent

Cookie: _scidDomain: .fanduel.com

criticalCookieAdvertisingSnapchat Pixel

Snapchat Pixel cookie "_scid_r" set before consent

Cookie: _scid_rDomain: .fanduel.com

criticalNetworkAdvertisingGenius Sports (Advertising Tracker)

Genius Sports (advertising) loaded before consent

Host: zz.connextra.comFired: 2543ms after load

Mediaocean (Advertising Tracker)2 findings

servedby.flashtalking.com, d9.flashtalking.com

criticalNetworkAdvertisingMediaocean (Advertising Tracker)

Mediaocean (advertising) loaded before consent

Host: servedby.flashtalking.comFired: 2544ms after load

criticalNetworkAdvertisingMediaocean (Advertising Tracker)

Mediaocean (advertising) loaded before consent

Host: d9.flashtalking.comFired: 2987ms after load

Dstillery (Advertising Tracker)2 findings

action.dstillery.com, action.media6degrees.com

criticalNetworkAdvertisingDstillery (Advertising Tracker)

Dstillery (advertising) loaded before consent

Host: action.dstillery.comFired: 2599ms after load

criticalNetworkAdvertisingDstillery (Advertising Tracker)

Dstillery (advertising) loaded before consent

Host: action.media6degrees.comFired: 3018ms after load

The Trade Desk (Tracker Tracker)3 findings

js.adsrvr.org, insight.adsrvr.org, match.adsrvr.org

criticalNetworkThe Trade Desk (Tracker Tracker)

The Trade Desk (tracker) loaded before consent

Host: js.adsrvr.orgFired: 2599ms after load

criticalNetworkThe Trade Desk (Tracker Tracker)

The Trade Desk (tracker) loaded before consent

Host: insight.adsrvr.orgFired: 5125ms after load

criticalNetworkThe Trade Desk (Tracker Tracker)

The Trade Desk (tracker) loaded before consent

Host: match.adsrvr.orgFired: 5125ms after load

criticalNetworkAdvertisingInnovid (Advertising Tracker)

Innovid (advertising) loaded before consent

Host: collector-7762.tvsquared.comFired: 2599ms after load

criticalNetworkAnalyticsSpotify (Analytics Tracker)

Spotify (analytics) loaded before consent

Host: cdn.pdst.fmFired: 2599ms after load

VDX (Advertising Tracker)2 findings

a.tribalfusion.com, s.tribalfusion.com

criticalNetworkAdvertisingVDX (Advertising Tracker)

VDX (advertising) loaded before consent

Host: a.tribalfusion.comFired: 2600ms after load

criticalNetworkAdvertisingVDX (Advertising Tracker)

VDX (advertising) loaded before consent

Host: s.tribalfusion.comFired: 3544ms after load

criticalNetworkAdvertisingQuora (Advertising Tracker)

Quora (advertising) loaded before consent

Host: a.quora.comFired: 2600ms after load

criticalNetworkAdvertisingAmazon (Advertising Tracker)

Amazon (advertising) loaded before consent

Host: s.amazon-adsystem.comFired: 2600ms after load

Google Ads3 findings

www.google.com, _gcl_au, _gcl_ls

criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google Consent Mode data collection for ad measurement

Host: www.google.comFired: 2940ms after load

criticalCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set before consent

Cookie: _gcl_auDomain: .fanduel.com

criticalStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage before consent

Key: _gcl_lsType: localStorageFired: 2898ms after load

criticalNetworkAdvertisingSpotify (Advertising Tracker)

Spotify (advertising) loaded before consent

Host: pixels.spotify.comFired: 3081ms after load

criticalNetworkAdvertisingQuora Pixel

Quora Pixel (Quora) loaded before consent: Quora conversion tracking pixel

Host: q.quora.comFired: 3229ms after load

criticalNetworkAnalyticsYahoo! (Analytics Tracker)

Yahoo! (analytics) loaded before consent

Host: sp.analytics.yahoo.comFired: 3614ms after load

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at tr6.snapchat.com loaded before consent

Host: tr6.snapchat.comFired: 3904ms after load

Microsoft (Advertising Tracker)2 findings

ib.adnxs.com, secure.adnxs.com

criticalNetworkAdvertisingMicrosoft (Advertising Tracker)

Microsoft (advertising) loaded before consent

Host: ib.adnxs.comFired: 4987ms after load

criticalNetworkAdvertisingMicrosoft (Advertising Tracker)

Microsoft (advertising) loaded before consent

Host: secure.adnxs.comFired: 5124ms after load

Comcast (Advertising Tracker)2 findings

match.prod.bidr.io, segment.prod.bidr.io

criticalNetworkAdvertisingComcast (Advertising Tracker)

Comcast (advertising) loaded before consent

Host: match.prod.bidr.ioFired: 5124ms after load

criticalNetworkAdvertisingComcast (Advertising Tracker)

Comcast (advertising) loaded before consent

Host: segment.prod.bidr.ioFired: 5125ms after load

Amazon2 findings

ad-id, ad-privacy

criticalCookieMarketingAmazon

Amazon cookie "ad-id" set before consent — Clickthroughs to Amazon websites: Noting how the user got to Amazon via this website

Cookie: ad-idDomain: .amazon-adsystem.comRetention: 190 days

criticalCookieMarketingAmazon

Amazon cookie "ad-privacy" set before consent — Provided by amazon-adsystem.com for tracking user actions on other websites to provide targeted content to the users.

Cookie: ad-privacyDomain: .amazon-adsystem.comRetention: 5 years

TikTok2 findings

ttcsid, ttcsid_C0JCDQ52BAPH375FC790

criticalCookieMarketingTikTok

TikTok cookie "ttcsid" set before consent — The TikTok cookie ttcsid likely serves as a session identifier, helping to maintain user sessions and track interactions across the platform. Its purpose is probably to manage user authentication or personalize content based on activity, similar to other session-related cookies used by TikTok.

Cookie: ttcsidDomain: .fanduel.comRetention: 1 year

criticalCookieMarketingTikTok

TikTok cookie "ttcsid_C0JCDQ52BAPH375FC790" set before consent — The TikTok cookie ttcsid likely serves as a session identifier, helping to maintain user sessions and track interactions across the platform. Its purpose is probably to manage user authentication or personalize content based on activity, similar to other session-related cookies used by TikTok.

Cookie: ttcsid_C0JCDQ52BAPH375FC790Domain: .fanduel.comRetention: 1 year

Beeswax2 findings

bitoIsSecure, bito

criticalCookieMarketingBeeswax

Beeswax cookie "bitoIsSecure" set before consent — This cookie is associated with bidr.io. It allows third party advertisers to target the visitor with relevant advertising. This pairing service is provided by third party advertisement hubs, which facilitate real-time bidding for advertisers.

Cookie: bitoIsSecureDomain: .bidr.ioRetention: 1 year

criticalCookieMarketingBeeswax

Beeswax cookie "bito" set before consent — This cookie is generally provided by bidr.io and is used for advertising purposes.

Cookie: bitoDomain: .bidr.ioRetention: 1 year

criticalNetwork

No consent banner detected — all cookies and tags fire without user consent

criticalConsent

No "reject all" option found — users cannot refuse non-essential cookies (ICO guidance requires this)

criticalConsent Record

No recognizable consent cookie or storage entry detected after interaction — GDPR Article 7(1) requires controllers to demonstrate consent was given (server-side storage cannot be verified)

criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings21

Google Tag Manager2 findingsID tracked

www.googletagmanager.com

warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager (Google) loaded before consent: Loads the GTM container which may trigger other tags

ID: GTM-5DGV8G4MHost: www.googletagmanager.comFired: 2185ms after load

warningGTMTag ManagementGoogle Tag Manager

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-5DGV8G4M)

warningNetwork

Unknown third-party request to s3.us-east-1.amazonaws.com before consent

Host: s3.us-east-1.amazonaws.comFired: 642ms after load

warningNetwork

Unknown third-party request to images.contentstack.io before consent

Host: images.contentstack.ioFired: 643ms after load

warningNetwork

Unknown third-party request to cdn.sanity.io before consent

Host: cdn.sanity.ioFired: 645ms after load

warningStorage

localStorage key "EXP_test" written before consent

Key: EXP_testType: localStorageFired: 1741ms after load

warningStorage

sessionStorage key "EXP_e9867ea3d1_DEFAULT_USER_PROVIDER" written before consent

Key: EXP_e9867ea3d1_DEFAULT_USER_PROVIDERType: sessionStorageFired: 1769ms after load

warningStorage

localStorage key "EXP_e9867ea3d1" written before consent

Key: EXP_e9867ea3d1Type: localStorageFired: 1774ms after load

warningStorage

localStorage key "amp-exp-$default_instance-cfgV04-flags" written before consent

Key: amp-exp-$default_instance-cfgV04-flagsType: localStorageFired: 1793ms after load

warningStorage

localStorage key "EXP_unsent_$default_instance" written before consent

Key: EXP_unsent_$default_instanceType: localStorageFired: 1810ms after load

warningStorage

localStorage key "AMP_e9867ea3d1" written before consent

Key: AMP_e9867ea3d1Type: localStorageFired: 2169ms after load

warningStorage

localStorage key "AMP_MKTG_e9867ea3d1" written before consent

Key: AMP_MKTG_e9867ea3d1Type: localStorageFired: 2174ms after load

warningStorage

localStorage key "AMP_unsent_e9867ea3d1" written before consent

Key: AMP_unsent_e9867ea3d1Type: localStorageFired: 2191ms after load

warningStorage

localStorage key "amp-exp-$default_instance-cfgV04" written before consent

Key: amp-exp-$default_instance-cfgV04Type: localStorageFired: 2589ms after load

warningStorage

sessionStorage key "__pdst" written before consent

Key: __pdstType: sessionStorageFired: 3073ms after load

warningStorage

localStorage key "spdt-1776283395.33-526" written before consent

Key: spdt-1776283395.33-526Type: localStorageFired: 3079ms after load

warningStorage

localStorage key "u_sclid" written before consent

Key: u_sclidType: localStorageFired: 3259ms after load

warningStorage

sessionStorage key "u_scsid" written before consent

Key: u_scsidType: sessionStorageFired: 3260ms after load

warningStorage

localStorage key "u_sclid_r" written before consent

Key: u_sclid_rType: localStorageFired: 3262ms after load

warningStorage

sessionStorage key "u_scsid_r" written before consent

Key: u_scsid_rType: sessionStorageFired: 3262ms after load

warningStorage

localStorage key "lastExternalReferrer" written before consent

Key: lastExternalReferrerType: localStorageFired: 3561ms after load

Info7

infoNetworkCloudflare (Cdn)

Cloudflare (cdn) loaded before consent

Host: cdnjs.cloudflare.comFired: 641ms after load

Google (Cdn)2 findings

fonts.googleapis.com, fonts.gstatic.com

infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: fonts.googleapis.comFired: 642ms after load

infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: fonts.gstatic.comFired: 1516ms after load

infoNetworkAmazon (Cdn)

Amazon (cdn) loaded before consent

Host: s3.amazonaws.comFired: 642ms after load

infoNetworkUNPKG (Cdn)

UNPKG (cdn) loaded before consent

Host: unpkg.comFired: 645ms after load

infoNetworkYahoo! (Cdn)

Yahoo! (cdn) loaded before consent

Host: s.yimg.comFired: 2577ms after load

infoCookieFunctionalSnapchat

Snapchat cookie "X-AB" set before consent — This cookie is used by the website’s operator in context with multi-variate testing. This is a tool used to combine or change content on the website. This allows the website to find the best variation/edition of the site.

Cookie: X-ABDomain: sc-static.netRetention: 1 day

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan fanduel.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com