https://fool.com
Scanned Apr 15, 2026 · 36.7s
Your website score is
Grade
BannerConsent Banner
Yes
Regulatory Compliance
Multi-regulation overview — click any regulation for details
Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.
Tag Leak detected 69 user data leaks before consent on fool.com, including convertexperiments.com (Analytics Tracker), dianomi (Advertising Tracker), Segment and 9 more.
Security Headers
2/6 presentStrict-Transport-Security
max-age=15552000
Content-Security-Policy
Add a Content-Security-Policy header to prevent XSS and code injection attacks
X-Frame-Options
Add X-Frame-Options header to prevent clickjacking attacks
X-Content-Type-Options
Set X-Content-Type-Options to 'nosniff' to prevent MIME type sniffing
Referrer-Policy
no-referrer-when-downgrade
Permissions-Policy
Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation
Google Consent Mode
V2Consent Parameters
Issues (1)
No default consent call detected — consent mode may not be initialised correctly
Post-Rejection Audit
Reject Button
Found
Post-Rejection Fires
2 vendors
Consent Mode
Not Detected
GTM Load
1878ms pre-consent
Google Tag Manager(GTM-HQ4K)
Loaded 1878ms after page load — before the consent banner was detected (banner appeared at 7805ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.
Consent Mode V2: Not Detected
Google Consent Mode was not detected on this site.
✓ gtag('consent', 'update') call detected on rejection
Vendors firing after rejection (2)
| Vendor | Category | Timing | URL |
|---|---|---|---|
| Twilio — Segment | analytics | 18342ms | api.segment.io |
| Braze — Braze | marketing | 23631ms | sdk.iad-05.braze.com |
Consent Record Audit
Issues detectedConsent record stored after interaction
GDPR Art. 7(1)Found: OptanonConsent (OneTrust)
Record contains timestamp
Art. 7(1)Timestamp field detected
Record contains consent state
Art. 7(1)Accept/reject state detected
Record contains consent categories
Art. 7(1)Consent categories (analytics, marketing, etc.) not found in record
Consent withdrawal mechanism accessible
GDPR Art. 7(3)No way for users to withdraw consent found on page
No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.
Why this matters
Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.
Tracker categories detected
Critical31
convertexperiments.com (analytics) loaded before consent
dianomi (advertising) loaded before consent
Segment5 findingscdn.segment.com, api.segment.io, ajs_anonymous_id, ajs_user_id
cdn.segment.com, api.segment.io, ajs_anonymous_id, ajs_user_id
Segment (Twilio) loaded before consent: Segment customer data platform — routes data to multiple destinations
Segment (Twilio) loaded before consent: Segment data collection endpoint
Segment cookie "ajs_anonymous_id" set before consent
Segment (Twilio) wrote "ajs_user_id" to localStorage before consent
Segment (Twilio) wrote "ajs_anonymous_id" to localStorage before consent
Braze3 findingssdk.iad-05.braze.com, ab.storage.deviceId.1fb61b1f-a3bb-4874-b48f-358535dd909f, ab.storage.sessionId.1fb61b1f-a3bb-4874-b48f-358535dd909f
sdk.iad-05.braze.com, ab.storage.deviceId.1fb61b1f-a3bb-4874-b48f-358535dd909f, ab.storage.sessionId.1fb61b1f-a3bb-4874-b48f-358535dd909f
Braze (Braze) loaded before consent: Braze customer engagement and marketing automation
Braze cookie "ab.storage.deviceId.1fb61b1f-a3bb-4874-b48f-358535dd909f" set before consent — Randomly-generated string used to identify anonymous users, and to differentiate users’ devices and enables device-based messaging.
Braze cookie "ab.storage.sessionId.1fb61b1f-a3bb-4874-b48f-358535dd909f" set before consent — Randomly-generated string used to determine whether the user is starting a new or existing session to sync messages and calculate session analytics.
Crazy Egg4 findingsscript.crazyegg.com, cebs, _ce.s, _ce.clock_data
script.crazyegg.com, cebs, _ce.s, _ce.clock_data
Crazy Egg (Crazy Egg) loaded before consent: Crazy Egg heatmap and scroll tracking
Crazy Egg cookie "cebs" set before consent — This cookie is used to track the current user session internally.
Crazy Egg cookie "_ce.s" set before consent
Crazy Egg cookie "_ce.clock_data" set before consent
Google Ads3 findingswww.google.com, _gcl_au, _gcl_ls

www.google.com, _gcl_au, _gcl_ls

Google Ads (Google) loaded before consent: Google Consent Mode data collection for ad measurement

Google Ads cookie "_gcl_au" set before consent

Google Ads (Google) wrote "_gcl_ls" to localStorage before consent
Google Analytics3 findingswww.google-analytics.com, _ga, _gid

www.google-analytics.com, _ga, _gid

GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics

Google Analytics cookie "_ga" set before consent

Google Analytics cookie "_gid" set before consent
Crazy Egg (Analytics Tracker)3 findingstracking.crazyegg.com, pagestates-tracking.crazyegg.com, assets-tracking.crazyegg.com
tracking.crazyegg.com, pagestates-tracking.crazyegg.com, assets-tracking.crazyegg.com
Crazy Egg (analytics) loaded before consent
Crazy Egg (analytics) loaded before consent
Crazy Egg (analytics) loaded before consent
Youtube3 findings__Secure-ROLLOUT_TOKEN, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA
__Secure-ROLLOUT_TOKEN, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA
Youtube cookie "__Secure-ROLLOUT_TOKEN" set before consent — Registers a unique ID to keep statistics of what videos from YouTube the user has seen.
Youtube cookie "VISITOR_INFO1_LIVE" set before consent — Tries to estimate the users' bandwidth on pages with integrated YouTube videos. Also used for marketing
Youtube cookie "VISITOR_PRIVACY_METADATA" set before consent — Youtube visitor privacy metadata cookie
Nativo cookie "Visitor" set before consent — This cookie is used to identify a unique visitor to the site.
Amplitude cookie "AMP_TOKEN" set before consent
Twilio — Segment fires after user rejected consent
Braze — Braze fires after user rejected consent
No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)
Warnings41
Google Tag Manager2 findingsID trackedwww.googletagmanager.com

www.googletagmanager.com

Google Tag Manager loads before consent — this is expected and required for GCM v2 to initialise consent defaults before any tags fire

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-HQ4K)
LaunchDarkly2 findingsapp.launchdarkly.com, events.launchdarkly.com
app.launchdarkly.com, events.launchdarkly.com
LaunchDarkly (LaunchDarkly) loaded before consent: LaunchDarkly feature flag management
LaunchDarkly (LaunchDarkly) loaded before consent: LaunchDarkly event tracking endpoint
Unknown third-party request to g.foolcdn.com before consent
Unknown third-party request to cdn.userway.org before consent
Unknown third-party request to optimize.foolcdn.com before consent
Unknown third-party request to www.google.com before consent
Unknown third-party request to use.fontawesome.com before consent
Unknown third-party request to clientstream.launchdarkly.com before consent
Unknown third-party request to api.userway.org before consent
Unknown third-party request to ampcid.google.com before consent
sessionStorage key "sentryReplaySession" written before consent
localStorage key "ld:6467c6a8e9f88111e70f8038:$diagnostics" written before consent
localStorage key "ld:6467c6a8e9f88111e70f8038:eyJraW5kIjoibXVsdGkiLCJ1c2VyIjp7ImtpbmQiOiJ1c2VyIiwia2V5IjoiYW5vbnltb3VzIiwiYW5vbnltb3VzIjp0cnVlfSwiZHVicy1wYWdlIjp7ImtpbmQiOiJkdWJzLXBhZ2UiLCJrZXkiOiIvIiwicGF0aCI6Ii8iLCJpc19tb2JpbGUiOmZhbHNlLCJpc190YWJsZXQiOmZhbHNlLCJpc19kZXNrdG9wIjp0cnVlfSwidmlzaXRvciI6eyJraW5kIjoidmlzaXRvciIsImtleSI6IjM3NTRiN2JiLTExYTctNDE4Zi1iODM5LWViOWY0NzAwZWE1NyIsImlzX2xvZ2dlZF9pbiI6ZmFsc2UsInZpc2l0X2NvdW50IjoxfX0=" written before consent
localStorage key "ab.test" written before consent
localStorage key "ab.storage.events.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.sessionId.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.messagingSessionStart.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.deviceId.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.lastSdkReq.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.lastReqToEndpoint.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "uw-uid" written before consent
localStorage key "ab.storage.serverConfig.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.device.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.sdk_metadata.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.session_id_for_cached_metadata.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.triggers.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.triggers.ts.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.requestAttempts.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.globalRateLimitCurrentTokenCount.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "uw-tunings" written before consent
localStorage key "uw-tunings-checksum" written before consent
localStorage key "uw-icon-locales" written before consent
localStorage key "ab.storage.ff.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.ffLastRefreshAt.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "ab.storage.ff.sessionId.1fb61b1f-a3bb-4874-b48f-358535dd909f" written before consent
localStorage key "persisted-queue:v1:CL257pIDks5ukrbYAs7Ez3fkLz1bWVnJ:event-queue:lock" written before consent
localStorage key "persisted-queue:v1:CL257pIDks5ukrbYAs7Ez3fkLz1bWVnJ:dest-Google Analytics:lock" written before consent
localStorage key "persisted-queue:v1:CL257pIDks5ukrbYAs7Ez3fkLz1bWVnJ:dest-Google Tag Manager:lock" written before consent
localStorage key "persisted-queue:v1:CL257pIDks5ukrbYAs7Ez3fkLz1bWVnJ:dest-Segment.io:lock" written before consent
Info17
OneTrust2 findingscdn.cookielaw.org, OptanonConsent

cdn.cookielaw.org, OptanonConsent

OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management

OneTrust cookie "OptanonConsent" set before consent

Cloudflare Web Analytics (Cloudflare) loaded before consent: Cloudflare Web Analytics beacon — privacy-focused, no cookies
Google (Cdn)6 findingswww.youtube-nocookie.com, www.youtube.com, fonts.gstatic.com, i.ytimg.com, jnn-pa.googleapis.com, ampcid.google.nl
www.youtube-nocookie.com, www.youtube.com, fonts.gstatic.com, i.ytimg.com, jnn-pa.googleapis.com, ampcid.google.nl
Google (cdn) loaded before consent
Google (cdn) loaded before consent
Google (cdn) loaded before consent
Google (cdn) loaded before consent
Google (cdn) loaded before consent
Google (cdn) loaded before consent
Sentry (Sentry) loaded before consent: Sentry error reporting endpoint

OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location
Google cookie "__Secure-YNID" set before consent — It's a YouTube cookie used to enhance user experience by storing video player preferences and aiding in secure log-ins and spam detectio
Youtube cookie "YSC" set before consent — Registers a unique ID to keep statistics of what videos from YouTube the user has seen.
Convert Insights2 findings_conv_s, _conv_v
_conv_s, _conv_v
Convert Insights cookie "_conv_s" set before consent — This cookie contains an ID string on the current session. This contains non-personal information on what subpages the visitor enters – this information is used to optimize the visitor's experience.
Convert Insights cookie "_conv_v" set before consent — This cookie is used to identify the frequency of visits and how long the visitor is on the website. The cookie is also used to determine how many and which subpages the visitor visits on a website – this information can be used by the website to optimize the domain and its subpages.
Cloudflare challenge clearance — necessary for site access
Cross-site request forgery token — security mechanism
Compliant4
Google Analytics2 findings_gali, _gat

_gali, _gat

Google Analytics cookie "_gali" set correctly after consent

Google Analytics cookie "_gat" set correctly after consent

OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent

Cloudflare cookie "cf_clearance" set correctly after consent
Is this your site?
Run a full multi-page scan with monitoring and get detailed remediation steps
Scan fool.com →This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com