Farfetch

farfetch.com

Compare

https://farfetch.com

Scanned Apr 15, 2026 · 31.9s

Your website score is

0/100
Critical

Grade

F0

Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 51 user data leaks before consent on farfetch.com, including Akamai (Analytics Tracker), Advertising Tracker, Microsoft Ads and 3 more.

Security Headers

6/6 present

Strict-Transport-Security

max-age=31536000

Content-Security-Policy

frame-ancestors 'none'

X-Frame-Options

DENY

X-Content-Type-Options

nosniff

Referrer-Policy

strict-origin-when-cross-origin

Permissions-Policy

geolocation=(self), microphone=(), payment=(self), usb=(self)

Google Consent Mode

V2
100/100
GTM Containers:GTM-5VWCDN

Consent Parameters

ParameterDefaultUpdated
Ad Storagedeniedgranted
Ad User Datadeniedgranted
Ad Personalizationdeniedgranted
Analytics Storagedeniedgranted
Functionality Storagenot_setnot_set
Personalization Storagenot_setnot_set
Security Storagenot_setnot_set

Post-Rejection Audit

Reject Button

Missing

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

1472ms pre-consent

Google Tag Manager(GTM-5VWCDN)

Loaded 1472ms after page load — before the consent banner was detected (banner appeared at 9514ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

No consent record written — cannot prove consent was given

No CMP consent cookie or localStorage entry was found after the consent interaction. GDPR requires controllers to demonstrate consent was given.

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising6 vendors
Analytics4 vendors
Marketing3 vendors
Functional4 vendors
Tag Management1 vendor
Critical14
Akamai (Analytics Tracker)
Akamai (Analytics Tracker)2 findings

s.go-mpulse.net, c.go-mpulse.net

Akamai (Analytics Tracker)
criticalNetworkAnalyticsAkamai (Analytics Tracker)

Akamai (analytics) loaded before consent

Host: s.go-mpulse.netFired: 1230ms after load
Akamai (Analytics Tracker)
criticalNetworkAnalyticsAkamai (Analytics Tracker)

Akamai (analytics) loaded before consent

Host: c.go-mpulse.netFired: 3421ms after load
Advertising Tracker
Advertising Tracker3 findings

ingress.eu2.rum-ingress-coralogix.com, beacon.riskified.com, bat.bing.net

Advertising Tracker
criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at ingress.eu2.rum-ingress-coralogix.com loaded before consent

Host: ingress.eu2.rum-ingress-coralogix.comFired: 3467ms after load
Advertising Tracker
criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at beacon.riskified.com loaded before consent

Host: beacon.riskified.comFired: 4911ms after load
Advertising Tracker
criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at bat.bing.net loaded before consent

Host: bat.bing.netFired: 5657ms after load
Microsoft Ads
criticalNetworkAdvertisingMicrosoft Ads

Microsoft Ads (Microsoft) loaded before consent: Microsoft Ads (Bing) UET conversion tracking

Host: bat.bing.comFired: 5035ms after load
Forter (Tracker Tracker)
criticalNetworkForter (Tracker Tracker)

Forter (tracker) loaded before consent

Host: 0c0275c12bca.cdn4.forter.comFired: 5086ms after load
Riskified (Analytics Tracker)
Riskified (Analytics Tracker)2 findings

img.riskified.com, c.riskified.com

Riskified (Analytics Tracker)
criticalNetworkAnalyticsRiskified (Analytics Tracker)

Riskified (analytics) loaded before consent

Host: img.riskified.comFired: 5644ms after load
Riskified (Analytics Tracker)
criticalNetworkAnalyticsRiskified (Analytics Tracker)

Riskified (analytics) loaded before consent

Host: c.riskified.comFired: 6692ms after load
Forter (Advertising Tracker)
Forter (Advertising Tracker)2 findings

cdn0.forter.com, cdn3.forter.com

Forter (Advertising Tracker)
criticalNetworkAdvertisingForter (Advertising Tracker)

Forter (advertising) loaded before consent

Host: cdn0.forter.comFired: 6138ms after load
Forter (Advertising Tracker)
criticalNetworkAdvertisingForter (Advertising Tracker)

Forter (advertising) loaded before consent

Host: cdn3.forter.comFired: 7075ms after load
criticalConsent

No "reject all" option found — users cannot refuse non-essential cookies (ICO guidance requires this)

criticalConsent Record

No recognizable consent cookie or storage entry detected after interaction — GDPR Article 7(1) requires controllers to demonstrate consent was given (server-side storage cannot be verified)

criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings40
Google Tag Manager
Google Tag Manager2 findingsID tracked

www.googletagmanager.com

Google Tag Manager
warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager loads before consent — this is expected and required for GCM v2 to initialise consent defaults before any tags fire

ID: GTM-5VWCDNHost: www.googletagmanager.comFired: 1189ms after load
Google Tag Manager
warningGTMTag ManagementGoogle Tag Manager

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-5VWCDN)

GA4
warningNetworkAnalyticsGA4

GA4 cookieless ping detected before consent — GCM v2 active with analytics_storage: denied. No cookies or user identifiers are collected in this request.

ID: G-CEF7PMN9HXHost: region1.google-analytics.comFired: 4279ms after load
warningConsentUnknown

Unknown was clicked but no consent storage was written — tags may continue firing as if consent was never given

Google Ads
warningNetworkAdvertisingGoogle Ads

Google Ads cookieless ping detected before consent — GCM v2 active with ad_storage and ad_user_data: denied. No user identifiers are collected in this request.

Host: pagead2.googlesyndication.comFired: 4084ms after load
vendor logo
warningNetwork

Unknown third-party request to cdn-static.farfetch-contents.com before consent

Host: cdn-static.farfetch-contents.comFired: 781ms after load
vendor logo
warningNetwork

Unknown third-party request to accounts.google.com before consent

Host: accounts.google.comFired: 3123ms after load
vendor logo
warningNetwork

Unknown third-party request to api.farfetch.net before consent

Host: api.farfetch.netFired: 3302ms after load
vendor logo
warningNetwork

Unknown third-party request to google.com before consent

Host: google.comFired: 4753ms after load
warningStorage

sessionStorage key "rum_session" written before consent

Key: rum_sessionType: sessionStorageFired: 1139ms after load
warningStorage

localStorage key "cx-fingerprint" written before consent

Key: cx-fingerprintType: localStorageFired: 1139ms after load
warningStorage

localStorage key "_boomr_clss" written before consent

Key: _boomr_clssType: localStorageFired: 1463ms after load
warningStorage

localStorage key "dummy" written before consent

Key: dummyType: localStorageFired: 1695ms after load
warningStorage

localStorage key "ak_a" written before consent

Key: ak_aType: localStorageFired: 1864ms after load
warningStorage

localStorage key "__akfp_storage_test__" written before consent

Key: __akfp_storage_test__Type: localStorageFired: 3124ms after load
warningStorage

localStorage key "UniqueViewId_https://www.farfetch.com/nl/" written before consent

Key: UniqueViewId_https://www.farfetch.com/nl/Type: localStorageFired: 3275ms after load
warningStorage

sessionStorage key "__sak" written before consent

Key: __sakType: sessionStorageFired: 4720ms after load
warningStorage

localStorage key "1776288678715" written before consent

Key: 1776288678715Type: localStorageFired: 5244ms after load
warningStorage

localStorage key "lastRskxRun" written before consent

Key: lastRskxRunType: localStorageFired: 5549ms after load
warningStorage

localStorage key "rskxRunCookie" written before consent

Key: rskxRunCookieType: localStorageFired: 5557ms after load
warningStorage

localStorage key "rCookie" written before consent

Key: rCookieType: localStorageFired: 5560ms after load
warningStorage

localStorage key "forterToken" written before consent

Key: forterTokenType: localStorageFired: 5906ms after load
warningStorage

localStorage key "feh--9fd29358" written before consent

Key: feh--9fd29358Type: localStorageFired: 5910ms after load
warningStorage

localStorage key "feh--8ff2b28" written before consent

Key: feh--8ff2b28Type: localStorageFired: 5915ms after load
warningStorage

localStorage key "feh--e3a677a0" written before consent

Key: feh--e3a677a0Type: localStorageFired: 5921ms after load
warningStorage

localStorage key "__test__" written before consent

Key: __test__Type: localStorageFired: 5944ms after load
warningStorage

localStorage key "f3b83c8e592aef14c2204ee437d40785" written before consent

Key: f3b83c8e592aef14c2204ee437d40785Type: localStorageFired: 6011ms after load
warningStorage

localStorage key "feh--30cb83" written before consent

Key: feh--30cb83Type: localStorageFired: 6031ms after load
warningStorage

localStorage key "feh--330df5" written before consent

Key: feh--330df5Type: localStorageFired: 6044ms after load
warningStorage

localStorage key "feh--1aea3" written before consent

Key: feh--1aea3Type: localStorageFired: 6053ms after load
warningStorage

localStorage key "feh--1bc22" written before consent

Key: feh--1bc22Type: localStorageFired: 6063ms after load
warningStorage

localStorage key "ftr__sf" written before consent

Key: ftr__sfType: localStorageFired: 6063ms after load
warningStorage

localStorage key "feh--19c44" written before consent

Key: feh--19c44Type: localStorageFired: 6093ms after load
warningStorage

localStorage key "feh--6bc5339" written before consent

Key: feh--6bc5339Type: localStorageFired: 6270ms after load
warningStorage

localStorage key "feh--c52" written before consent

Key: feh--c52Type: localStorageFired: 6275ms after load
warningStorage

localStorage key "feh--37d28a" written before consent

Key: feh--37d28aType: localStorageFired: 6320ms after load
warningStorage

localStorage key "feh--1bda6" written before consent

Key: feh--1bda6Type: localStorageFired: 6351ms after load
warningStorage

localStorage key "feh--da4" written before consent

Key: feh--da4Type: localStorageFired: 6544ms after load
warningStorage

localStorage key "__$intc" written before consent

Key: __$intcType: localStorageFired: 8696ms after load
warningStorage

localStorage key "feh--1b2b8" written before consent

Key: feh--1b2b8Type: localStorageFired: 9126ms after load
Info13
Paypal (Cdn)
Paypal (Cdn)4 findings

c.paypal.com, b.stats.paypal.com, c6.paypal.com, slc.stats.paypal.com

Paypal (Cdn)
infoNetworkPaypal (Cdn)

Paypal (cdn) loaded before consent

Host: c.paypal.comFired: 4911ms after load
Paypal (Cdn)
infoNetworkPaypal (Cdn)

Paypal (cdn) loaded before consent

Host: b.stats.paypal.comFired: 5304ms after load
Paypal (Cdn)
infoNetworkPaypal (Cdn)

Paypal (cdn) loaded before consent

Host: c6.paypal.comFired: 5305ms after load
Paypal (Cdn)
infoNetworkPaypal (Cdn)

Paypal (cdn) loaded before consent

Host: slc.stats.paypal.comFired: 5727ms after load
infoCookieFunctionalTripadvisor

Tripadvisor cookie "RT" set before consent — This cookie is used to identify the visitor through an application. This allows the visitor to login to a website through their LinkedIn application for example.

Cookie: RTDomain: .www.farfetch.comRetention: 399 days
infoCookieFunctionalPayPal

PayPal cookie "l7_az" set before consent — This cookie is necessary for the PayPal login-function on the website.

Cookie: l7_azDomain: .paypal.comRetention: 1 day
infoStorageFunctionallocalStorage availability probe

localStorage availability probe (null) wrote "__storage_test__" to localStorage before consent

Key: __storage_test__Type: localStorageFired: 3272ms after load
infoCookieFunctional

Cross-site request forgery token — security mechanism

Cookie: __Host-CSRF-TOKENDomain: www.farfetch.com
infoCookieFunctional

Akamai bot manager — necessary for site protection

Cookie: _abckDomain: .farfetch.com
infoCookieFunctional

Cross-site request forgery token — security mechanism

Cookie: __Host-CSRF-REQUEST-TOKENDomain: www.farfetch.com
infoCookieFunctional

Cross-site request forgery token — security mechanism

Cookie: __Secure-CSRF-REQUEST-TOKENDomain: .farfetch.com
infoCookieFunctional

Akamai bot management — necessary for site protection

Cookie: bm_svDomain: .farfetch.com
infoCookieFunctional

Akamai bot management session — necessary for site protection

Cookie: ak_bmscDomain: .farfetch.com
Compliant19
Twitter/X Pixel
Twitter/X Pixel2 findingsID tracked

t.co, static.ads-twitter.com

Twitter/X Pixel
CompliantNetworkAdvertisingTwitter/X Pixel

Twitter/X Pixel (X (Twitter)) loaded correctly after consent

ID: twHost: t.coFired: 4440ms after load
Twitter/X Pixel
CompliantNetworkAdvertisingTwitter/X Pixel

Twitter/X Pixel (X (Twitter)) loaded correctly after consent

Host: static.ads-twitter.comFired: 4286ms after load
Meta Pixel
Meta Pixel2 findingsID tracked

www.facebook.com, connect.facebook.net

Meta Pixel
CompliantNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded correctly after consent

ID: 371589359697106Host: www.facebook.comFired: 4781ms after load
Meta Pixel
CompliantNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded correctly after consent

Host: connect.facebook.netFired: 4286ms after load
Google Ads
Google Ads4 findings

googleads.g.doubleclick.net, www.googleadservices.com, _gcl_au, _gcl_ls

Google Ads
CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: googleads.g.doubleclick.netFired: 3459ms after load
Google Ads
CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: www.googleadservices.comFired: 4224ms after load
Google Ads
CompliantCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set correctly after consent

Cookie: _gcl_auDomain: .farfetch.com
Google Ads
CompliantStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage correctly after consent

Key: _gcl_lsType: localStorageFired: -15911ms after load
Microsoft Ads
Microsoft Ads3 findings

bat.bing.com, _uetsid, _uetvid

Microsoft Ads
CompliantNetworkAdvertisingMicrosoft Ads

Microsoft Ads (Microsoft) loaded correctly after consent

Host: bat.bing.comFired: 4365ms after load
Microsoft Ads
CompliantCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetsid" set correctly after consent

Cookie: _uetsidDomain: .farfetch.com
Microsoft Ads
CompliantCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetvid" set correctly after consent

Cookie: _uetvidDomain: .farfetch.com
Google Analytics
Google Analytics3 findings

_ga, _ga_CEF7PMN9HX, _ga_QJBZM1L4HL

Google Analytics
CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga" set correctly after consent

Cookie: _gaDomain: .farfetch.com
Google Analytics
CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_CEF7PMN9HX" set correctly after consent

Cookie: _ga_CEF7PMN9HXDomain: .farfetch.com
Google Analytics
CompliantCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_QJBZM1L4HL" set correctly after consent

Cookie: _ga_QJBZM1L4HLDomain: .farfetch.com
DoubleClick/Google Marketing
DoubleClick/Google Marketing2 findings

test_cookie, IDE

DoubleClick/Google Marketing
CompliantCookieFunctionalDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "test_cookie" set correctly after consent

Cookie: test_cookieDomain: .doubleclick.netRetention: 1 year
DoubleClick/Google Marketing
CompliantCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "IDE" set correctly after consent

Cookie: IDEDomain: .doubleclick.netRetention: 2 years
Bing / Microsoft
CompliantCookieMarketingBing / Microsoft

Bing / Microsoft cookie "MUID" set correctly after consent

Cookie: MUIDDomain: .bing.comRetention: 1 year
X2 findings

muc_ads, personalization_id

CompliantCookieMarketingX

X cookie "muc_ads" set correctly after consent

Cookie: muc_adsDomain: .t.coRetention: 24 months
CompliantCookieMarketingX

X cookie "personalization_id" set correctly after consent

Cookie: personalization_idDomain: .twitter.comRetention: 2 years

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan farfetch.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com