https://finviz.com
Scanned Apr 15, 2026 · 41.4s
Your website score is
Grade
BannerConsent Banner
Yes
Regulatory Compliance
Multi-regulation overview — click any regulation for details
Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.
Tag Leak detected 82 user data leaks before consent on finviz.com, including Admiral (Advertising Tracker), Microsoft Clarity, InvestingChannel (Advertising Tracker) and 21 more.
Security Headers
1/6 presentStrict-Transport-Security
Add HSTS header to enforce HTTPS connections and prevent downgrade attacks
Content-Security-Policy
Add a Content-Security-Policy header to prevent XSS and code injection attacks
X-Frame-Options
SAMEORIGIN
X-Content-Type-Options
Set X-Content-Type-Options to 'nosniff' to prevent MIME type sniffing
Referrer-Policy
Set a Referrer-Policy header to control how much referrer information is shared
Permissions-Policy
Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation
Google Consent Mode
Not DetectedGoogle Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.
GTM container detected (GTM-537M973G) but no consent mode initialisation found. Add gtag('consent', 'default', ...) before your GTM snippet.
Post-Rejection Audit
Reject Button
Found
Post-Rejection Fires
3 vendors
Consent Mode
Basic
GTM Load
455ms pre-consent
Google Tag Manager(GTM-537M973G)
Loaded 455ms after page load — before the consent banner was detected (banner appeared at 7462ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.
Consent Mode V2: Basic
Basic Consent Mode — anonymised pings still fire after rejection. Permitted by Google but legally contested under PECR.
Vendors firing after rejection (3)
| Vendor | Category | Timing | URL |
|---|---|---|---|
| Google — Google Ads | Basic CM ping | 20669ms | pagead2.googlesyndication.com |
| Google — GA4 | Basic CM ping | 20863ms | region1.analytics.google.com |
| Microsoft — Microsoft Clarity | Basic CM ping | 21555ms | scripts.clarity.ms |
Consent Record Audit
Issues detectedConsent record stored after interaction
GDPR Art. 7(1)No consent record written — cannot prove consent was given
No CMP consent cookie or localStorage entry was found after the consent interaction. GDPR requires controllers to demonstrate consent was given.
Consent withdrawal mechanism accessible
GDPR Art. 7(3)No way for users to withdraw consent found on page
No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.
Why this matters
Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.
Tracker categories detected
Critical50
Microsoft Clarity3 findingsID trackedwww.clarity.ms, scripts.clarity.ms, i.clarity.ms

www.clarity.ms, scripts.clarity.ms, i.clarity.ms

Microsoft Clarity (Microsoft) loaded before consent: Session recording and heatmap analytics

Microsoft Clarity (Microsoft) loaded before consent: Session recording and heatmap analytics

Microsoft Clarity (Microsoft) loaded before consent: Session recording and heatmap analytics
Meta Pixel3 findingsID trackedwww.facebook.com, connect.facebook.net, _fbp

www.facebook.com, connect.facebook.net, _fbp

Meta Pixel (Meta) loaded before consent: Meta Pixel tracking endpoint

Meta Pixel (Meta) loaded before consent: Sends user data to Meta for ad targeting and conversion tracking

Meta Pixel cookie "_fbp" set before consent
Google Analytics3 findingsID trackedregion1.analytics.google.com, _ga, _ga_ZT9VQEWD4N

region1.analytics.google.com, _ga, _ga_ZT9VQEWD4N

GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics

Google Analytics cookie "_ga" set before consent

Google Analytics cookie "_ga_ZT9VQEWD4N" set before consent
Google (Tracker Tracker)3 findingsID trackedstats.g.doubleclick.net, securepubads.g.doubleclick.net, ad.doubleclick.net
stats.g.doubleclick.net, securepubads.g.doubleclick.net, ad.doubleclick.net
Google (tracker) loaded before consent
Google (tracker) loaded before consent
Google (tracker) loaded before consent
Admiral (advertising) loaded before consent
InvestingChannel (Advertising Tracker)2 findingsu5.investingchannel.com, uat5-b.investingchannel.com
u5.investingchannel.com, uat5-b.investingchannel.com
InvestingChannel (advertising) loaded before consent
InvestingChannel (advertising) loaded before consent

Quantcast (Quantcast) loaded before consent: Quantcast audience measurement and advertising
Integral Ad Science (tracker) loaded before consent

Quantcast (advertising) loaded before consent
Google Ads4 findingswww.google.com, pagead2.googlesyndication.com, _gcl_au, _gcl_ls

www.google.com, pagead2.googlesyndication.com, _gcl_au, _gcl_ls

Google Ads (Google) loaded before consent: Google Consent Mode data collection for ad measurement

Google Ads (Google) loaded before consent: Google ad syndication and remarketing

Google Ads cookie "_gcl_au" set before consent

Google Ads (Google) wrote "_gcl_ls" to localStorage before consent
AssertiveYield (Advertising Tracker)3 findingsinvestingchannel.ay.delivery, vrtngjbrtn4xaetga.ay.delivery, rjiqyxqvpjnd5wjfi.ay.delivery
investingchannel.ay.delivery, vrtngjbrtn4xaetga.ay.delivery, rjiqyxqvpjnd5wjfi.ay.delivery
AssertiveYield (advertising) loaded before consent
AssertiveYield (advertising) loaded before consent
AssertiveYield (advertising) loaded before consent
Amazon (Advertising Tracker)3 findingsc.amazon-adsystem.com, config.aps.amazon-adsystem.com, aax.amazon-adsystem.com
c.amazon-adsystem.com, config.aps.amazon-adsystem.com, aax.amazon-adsystem.com
Amazon (advertising) loaded before consent
Amazon (advertising) loaded before consent
Amazon (advertising) loaded before consent
Confiant (advertising) loaded before consent
PubMatic (Advertising Tracker)2 findingsads.pubmatic.com, ut.pubmatic.com
ads.pubmatic.com, ut.pubmatic.com
PubMatic (advertising) loaded before consent
PubMatic (advertising) loaded before consent
Bombora (analytics) loaded before consent
ID5 (Advertising Tracker)2 findingscdn.id5-sync.com, api.id5-sync.com
cdn.id5-sync.com, api.id5-sync.com
ID5 (advertising) loaded before consent
ID5 (advertising) loaded before consent
Browsi (Advertising Tracker)3 findingscdn.browsiprod.com, events.browsiprod.com, yield-manager.browsiprod.com
cdn.browsiprod.com, events.browsiprod.com, yield-manager.browsiprod.com
Browsi (advertising) loaded before consent
Browsi (advertising) loaded before consent
Browsi (advertising) loaded before consent
eyeo (Advertising Tracker)2 findingsbtloader.com, api.btloader.com
btloader.com, api.btloader.com
eyeo (advertising) loaded before consent
eyeo (advertising) loaded before consent
AdDelivery (advertising) loaded before consent
Advertising Tracker2 findingsab.dns-finder.com, static.anonm.io
ab.dns-finder.com, static.anonm.io
advertising tracker at ab.dns-finder.com loaded before consent
advertising tracker at static.anonm.io loaded before consent
PublicisGroupe (Tracker Tracker)2 findingssecure.cdn.fastclick.net, tags.crwdcntrl.net
secure.cdn.fastclick.net, tags.crwdcntrl.net
PublicisGroupe (tracker) loaded before consent
PublicisGroupe (tracker) loaded before consent
Experian (advertising) loaded before consent
Anonymised (Advertising Tracker)3 findingsstatic.anonymised.io, cdn1.anonymised.io, api.anonymised.io
static.anonymised.io, cdn1.anonymised.io, api.anonymised.io
Anonymised (advertising) loaded before consent
Anonymised (advertising) loaded before consent
Anonymised (advertising) loaded before consent
No recognizable consent cookie or storage entry detected after interaction — GDPR Article 7(1) requires controllers to demonstrate consent was given (server-side storage cannot be verified)
No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)
Warnings37
Google Tag Manager2 findingsID trackedwww.googletagmanager.com

www.googletagmanager.com

Google Tag Manager (Google) loaded before consent: Loads the GTM container which may trigger other tags

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-537M973G)
Unknown was clicked but no consent storage was written — tags may continue firing as if consent was never given

Google — Google Ads ping fires after rejection (Basic Consent Mode — anonymised, legal grey zone)

Google — GA4 ping fires after rejection (Basic Consent Mode — anonymised, legal grey zone)

Microsoft — Microsoft Clarity ping fires after rejection (Basic Consent Mode — anonymised, legal grey zone)
Unknown third-party request to mpc2-prod-26-is5qnl632q-uc.a.run.app before consent
Unknown third-party request to api.assertcom.de before consent
Unknown third-party request to pub.elevate14r.com before consent
Unknown third-party request to dtasrvr.com before consent
Unknown third-party request to cdn.insiad.com before consent
Unknown third-party request to static.dtasrvr.com before consent
Unknown third-party request to events.insiad.com before consent
Unknown third-party request to dd.insiad.com before consent
localStorage key "test" written before consent
localStorage key "usprivacy" written before consent
localStorage key "lastExternalReferrer" written before consent
localStorage key "ayManagerEnv__storage_test__" written before consent
sessionStorage key "ayManagerEnv__persistent_bid_cache_bids_v2" written before consent
localStorage key "ay_c" written before consent
localStorage key "ay_s" written before consent
localStorage key "modemobile_script_enabled" written before consent
sessionStorage key "BT_sid" written before consent
localStorage key "__broesiUc" written before consent
localStorage key "__brw_ua" written before consent
localStorage key "_ml_temp_" written before consent
sessionStorage key "idw-session-id" written before consent
sessionStorage key "idw-page-count" written before consent
localStorage key "idw-total-page-count" written before consent
localStorage key "idw-fe-id" written before consent
localStorage key "__localStorage_test__" written before consent
localStorage key "oidc.677de84a59ff4d7d8a8ee53361d731bc" written before consent
localStorage key "anon-sl" written before consent
localStorage key "__binsUID" written before consent
localStorage key "BT_AA_DETECTION" written before consent
localStorage key "_pubcid_exp" written before consent
localStorage key "_pubcid" written before consent
Info6
Google (cdn) loaded before consent

Cloudflare Web Analytics (Cloudflare) loaded before consent: Cloudflare Web Analytics beacon — privacy-focused, no cookies
Sourcepoint CMP2 findingsats-wrapper.privacymanager.io, geo.privacymanager.io
ats-wrapper.privacymanager.io, geo.privacymanager.io
Sourcepoint CMP (Sourcepoint) loaded before consent: Sourcepoint consent management platform
Sourcepoint CMP (Sourcepoint) loaded before consent: Sourcepoint consent management platform
PrivacyPillar cookie "usprivacy" set before consent — This cookie stores the US privacy string.
localStorage availability probe (null) wrote "__storage_test__" to localStorage before consent
Compliant84
Quantcast3 findingspixel.quantserve.com, mc, __qca

pixel.quantserve.com, mc, __qca

Quantcast (Quantcast) loaded correctly after consent

Quantcast cookie "mc" set correctly after consent

Quantcast cookie "__qca" set correctly after consent
Criteo2 findingsstatic.criteo.net, cto_bundle

static.criteo.net, cto_bundle

Criteo (Criteo) loaded correctly after consent

Criteo cookie "cto_bundle" set correctly after consent

Google Ads (Google) loaded correctly after consent
PubMatic12 findingspi, KADUSERCOOKIE, chkChromeAb67Sec, DPSync4, SyncRTB4, KRTBCOOKIE_153, PugT, KRTBCOOKIE_80, KRTBCOOKIE_377, KRTBCOOKIE_860, SPugT, KCCH
pi, KADUSERCOOKIE, chkChromeAb67Sec, DPSync4, SyncRTB4, KRTBCOOKIE_153, PugT, KRTBCOOKIE_80, KRTBCOOKIE_377, KRTBCOOKIE_860, SPugT, KCCH
PubMatic cookie "pi" set correctly after consent
PubMatic cookie "KADUSERCOOKIE" set correctly after consent
PubMatic cookie "chkChromeAb67Sec" set correctly after consent
PubMatic cookie "DPSync4" set correctly after consent
PubMatic cookie "SyncRTB4" set correctly after consent
PubMatic cookie "KRTBCOOKIE_153" set correctly after consent
PubMatic cookie "PugT" set correctly after consent
PubMatic cookie "KRTBCOOKIE_80" set correctly after consent
PubMatic cookie "KRTBCOOKIE_377" set correctly after consent
PubMatic cookie "KRTBCOOKIE_860" set correctly after consent
PubMatic cookie "SPugT" set correctly after consent
PubMatic cookie "KCCH" set correctly after consent
Bombora cookie "tp" set correctly after consent
Yahoo2 findingsA3, IDSYNC
A3, IDSYNC
Yahoo cookie "A3" set correctly after consent
Yahoo cookie "IDSYNC" set correctly after consent
Adform4 findingsuid, cto_bidid, C, c

uid, cto_bidid, C, c

Adform cookie "uid" set correctly after consent

Adform cookie "cto_bidid" set correctly after consent

Adform cookie "C" set correctly after consent

Adform cookie "c" set correctly after consent
Lotame6 findings_cc_dc, _cc_id, _cc_cc, _cc_aud, panoramaId, panoramaId_expiry
_cc_dc, _cc_id, _cc_cc, _cc_aud, panoramaId, panoramaId_expiry
Lotame cookie "_cc_dc" set correctly after consent
Lotame cookie "_cc_id" set correctly after consent
Lotame cookie "_cc_cc" set correctly after consent
Lotame cookie "_cc_aud" set correctly after consent
Lotame cookie "panoramaId" set correctly after consent
Lotame cookie "panoramaId_expiry" set correctly after consent
Snowplow cookie "sp" set correctly after consent
The Tradedesk2 findingsTDID, TDCPM
TDID, TDCPM
The Tradedesk cookie "TDID" set correctly after consent
The Tradedesk cookie "TDCPM" set correctly after consent
HAproxy cookie "SERVERID" set correctly after consent
Adobe Audience Manager2 findingsdemdex, dpm

demdex, dpm

Adobe Audience Manager cookie "demdex" set correctly after consent

Adobe Audience Manager cookie "dpm" set correctly after consent
DoubleClick/Google Marketing2 findings__gads, IDE

__gads, IDE

DoubleClick/Google Marketing cookie "__gads" set correctly after consent

DoubleClick/Google Marketing cookie "IDE" set correctly after consent
openx.net2 findingsi, pd
i, pd
openx.net cookie "i" set correctly after consent
openx.net cookie "pd" set correctly after consent
Rapleaf2 findingsrlas3, pxrc
rlas3, pxrc
Rapleaf cookie "rlas3" set correctly after consent
Rapleaf cookie "pxrc" set correctly after consent
Magnite4 findingsaudit_p, khaos, khaos_p, audit
audit_p, khaos, khaos_p, audit
Magnite cookie "audit_p" set correctly after consent
Magnite cookie "khaos" set correctly after consent
Magnite cookie "khaos_p" set correctly after consent
Magnite cookie "audit" set correctly after consent
Google cookie "receive-cookie-deprecation" set correctly after consent
Casale Media3 findingsCMID, CMPS, CMPRO
CMID, CMPS, CMPRO
Casale Media cookie "CMID" set correctly after consent
Casale Media cookie "CMPS" set correctly after consent
Casale Media cookie "CMPRO" set correctly after consent
ID53 findingsid5, gdpr, 3pi
id5, gdpr, 3pi
ID5 cookie "id5" set correctly after consent
ID5 cookie "gdpr" set correctly after consent
ID5 cookie "3pi" set correctly after consent
Google AdSense2 findings__gpi, __eoi

__gpi, __eoi

Google AdSense cookie "__gpi" set correctly after consent

Google AdSense cookie "__eoi" set correctly after consent
OnAudience cookie "done_redirects162" set correctly after consent
Beeswax2 findingsbito, bitoIsSecure
bito, bitoIsSecure
Beeswax cookie "bito" set correctly after consent
Beeswax cookie "bitoIsSecure" set correctly after consent
CreativeCDN cookie "g" set correctly after consent
PayPal cookie "ts" set correctly after consent
TripleLift cookie "tluid" set correctly after consent
Amazon2 findingsad-id, ad-privacy
ad-id, ad-privacy
Amazon cookie "ad-id" set correctly after consent
Amazon cookie "ad-privacy" set correctly after consent
semasio.net cookie "SEUNCY" set correctly after consent
NGINX Ingresss cookie "INGRESSCOOKIE" set correctly after consent
ComScore cookie "pid" set correctly after consent
Smartadserver2 findingsTestIfCookieP, csync
TestIfCookieP, csync
Smartadserver cookie "TestIfCookieP" set correctly after consent
Smartadserver cookie "csync" set correctly after consent
Xandr3 findingsXANDR_PANID, uuid2, anj
XANDR_PANID, uuid2, anj
Xandr cookie "XANDR_PANID" set correctly after consent
Xandr cookie "uuid2" set correctly after consent
Xandr cookie "anj" set correctly after consent
Platform161 cookie "tuuid" set correctly after consent
bidswitch.net cookie "tuuid_lu" set correctly after consent

Adobe Advertising cookie "everest_g_v2" set correctly after consent
Improve Digital2 findingsum, umeh
um, umeh
Improve Digital cookie "um" set correctly after consent
Improve Digital cookie "umeh" set correctly after consent
GumGum cookie "vst" set correctly after consent
Yieldmo cookie "yieldmo_id" set correctly after consent
Tapad3 findingsTapAd_TS, TapAd_DID, TapAd_3WAY_SYNCS
TapAd_TS, TapAd_DID, TapAd_3WAY_SYNCS
Tapad cookie "TapAd_TS" set correctly after consent
Tapad cookie "TapAd_DID" set correctly after consent
Tapad cookie "TapAd_3WAY_SYNCS" set correctly after consent
Marfeel cookie "_ssuma" set correctly after consent
Neustar cookie "ab" set correctly after consent
Is this your site?
Run a full multi-page scan with monitoring and get detailed remediation steps
Scan finviz.com →This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com