Forbes Cookie Compliance Report

Forbes

forbes.com

Compare

https://forbes.com

Scanned Apr 15, 2026 · 35.7s

Your website score is

0/100

Critical

Grade

BannerConsent Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 15 user data leaks before consent on forbes.com, including Datadome (Tracker Tracker), Marfeel.

Security Headers

5/6 present

Strict-Transport-Security

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

upgrade-insecure-requests

X-Frame-Options

SAMEORIGIN

X-Content-Type-Options

Set X-Content-Type-Options to 'nosniff' to prevent MIME type sniffing

Referrer-Policy

strict-origin-when-cross-origin

Permissions-Policy

unload=()

Google Consent Mode

Not Detected

Google Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

Not detected

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

No tracking vendors detected firing after rejection

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

No consent record written — cannot prove consent was given

No CMP consent cookie or localStorage entry was found after the consent interaction. GDPR requires controllers to demonstrate consent was given.

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising6 vendors

Analytics5 vendors

Marketing36 vendors

Security1 vendor

Functional11 vendors

Tag Management1 vendor

Critical6

Datadome (Tracker Tracker)2 findings

js.datadome.co, api-js.datadome.co

criticalNetworkDatadome (Tracker Tracker)

Datadome (tracker) loaded before consent

Host: js.datadome.coFired: 84ms after load

criticalNetworkDatadome (Tracker Tracker)

Datadome (tracker) loaded before consent

Host: api-js.datadome.coFired: 1773ms after load

Marfeel2 findings

_swb, _swb_consent_

criticalCookieAnalyticsMarfeel

Marfeel cookie "_swb" set before consent — This cookie is used to store for temporary session

Cookie: _swbDomain: .forbes.comRetention: Session

criticalCookieAnalyticsMarfeel

Marfeel cookie "_swb_consent_" set before consent — This cookie is used to store for temporary session

Cookie: _swb_consent_Domain: .forbes.comRetention: Session

criticalConsent Record

No recognizable consent cookie or storage entry detected after interaction — GDPR Article 7(1) requires controllers to demonstrate consent was given (server-side storage cannot be verified)

criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings11

warningConsentUnknown

Unknown was clicked but no consent storage was written — tags may continue firing as if consent was never given

warningNetwork

Unknown third-party request to cdn.ketchjs.com before consent

Host: cdn.ketchjs.comFired: 82ms after load

warningNetwork

Unknown third-party request to global.ketchcdn.com before consent

Host: global.ketchcdn.comFired: 84ms after load

warningNetwork

Unknown third-party request to i.forbesimg.com before consent

Host: i.forbesimg.comFired: 86ms after load

warningStorage

localStorage key "notifications_read_ids" written before consent

Key: notifications_read_idsType: localStorageFired: 738ms after load

warningStorage

localStorage key "contactID" written before consent

Key: contactIDType: localStorageFired: 1365ms after load

warningStorage

localStorage key "_swb_consent__metadata" written before consent

Key: _swb_consent__metadataType: localStorageFired: 2063ms after load

warningStorage

localStorage key "_swb_consent_" written before consent

Key: _swb_consent_Type: localStorageFired: 2063ms after load

warningStorage

localStorage key "_ketch_consent_v1_" written before consent

Key: _ketch_consent_v1_Type: localStorageFired: 2068ms after load

warningStorage

localStorage key "_ketch_tcf_ping_v1_" written before consent

Key: _ketch_tcf_ping_v1_Type: localStorageFired: 2636ms after load

warningStorage

localStorage key "_ketch_tcf_tcdata_v1_" written before consent

Key: _ketch_tcf_tcdata_v1_Type: localStorageFired: 2664ms after load

Info4

infoCookieFunctionalPrivacyPillar

PrivacyPillar cookie "usprivacy" set before consent — This cookie stores the US privacy string.

Cookie: usprivacyDomain: .forbes.comRetention: 1 year

infoCookieFunctional

AWS Application Load Balancer — necessary for infrastructure

Cookie: AWSALBDomain: www.forbes.com

infoCookieFunctional

AWS Application Load Balancer — necessary for infrastructure

Cookie: AWSALBCORSDomain: www.forbes.com

infoCookieFunctional

DataDome bot protection — necessary for site security

Cookie: datadomeDomain: .forbes.com

Compliant112

CompliantNetworkTag ManagementGoogle Tag Manager

Google Tag Manager (Google) loaded correctly after consent

ID: GTM-NMQJM4Host: www.googletagmanager.comFired: 1457ms after load

Twitter/X Pixel2 findingsID tracked

t.co, static.ads-twitter.com

CompliantNetworkAdvertisingTwitter/X Pixel

Twitter/X Pixel (X (Twitter)) loaded correctly after consent

ID: twHost: t.coFired: 3712ms after load

CompliantNetworkAdvertisingTwitter/X Pixel

Twitter/X Pixel (X (Twitter)) loaded correctly after consent

Host: static.ads-twitter.comFired: 3089ms after load

Criteo2 findings

static.criteo.net, cto_bundle

CompliantNetworkAdvertisingCriteo

Criteo (Criteo) loaded correctly after consent

Host: static.criteo.netFired: 1285ms after load

CompliantCookieAdvertisingCriteo

Criteo cookie "cto_bundle" set correctly after consent

Cookie: cto_bundleDomain: .criteo.com

Quantcast4 findings

secure.quantserve.com, pixel.quantserve.com, mc, __qca

CompliantNetworkAdvertisingQuantcast

Quantcast (Quantcast) loaded correctly after consent

Host: secure.quantserve.comFired: 3015ms after load

CompliantNetworkAdvertisingQuantcast

Quantcast (Quantcast) loaded correctly after consent

Host: pixel.quantserve.comFired: 3395ms after load

CompliantCookieMarketingQuantcast

Quantcast cookie "mc" set correctly after consent

Cookie: mcDomain: .quantserve.comRetention: 13 months

CompliantCookieAdvertisingQuantcast

Quantcast cookie "__qca" set correctly after consent

Cookie: __qcaDomain: .forbes.com

Meta Pixel2 findings

connect.facebook.net, _fbp

CompliantNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded correctly after consent

Host: connect.facebook.netFired: 3089ms after load

CompliantCookieAdvertisingMeta Pixel

Meta Pixel cookie "_fbp" set correctly after consent

Cookie: _fbpDomain: .forbes.com

Google Ads3 findings

www.google.com, _gcl_au, _gcl_ls

CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: www.google.comFired: 3911ms after load

CompliantCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set correctly after consent

Cookie: _gcl_auDomain: .forbes.com

CompliantStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage correctly after consent

Key: _gcl_lsType: localStorageFired: -16760ms after load

Reddit Pixel2 findings

alb.reddit.com, _rdt_uuid

CompliantNetworkAdvertisingReddit Pixel

Reddit Pixel (Reddit) loaded correctly after consent

Host: alb.reddit.comFired: 4036ms after load

CompliantCookieAdvertisingReddit Pixel

Reddit Pixel cookie "_rdt_uuid" set correctly after consent

Cookie: _rdt_uuidDomain: .forbes.com

CompliantCookieMarketingBlueconic.com

Blueconic.com cookie "BCSessionID" set correctly after consent

Cookie: BCSessionIDDomain: forbes.blueconic.netRetention: 1 year

CompliantCookieFunctionalGoogle reCAPTCHA

Google reCAPTCHA cookie "_GRECAPTCHA" set correctly after consent

Cookie: _GRECAPTCHADomain: www.google.comRetention: 179 days

TripleLift2 findings

sync, tluid

CompliantCookieMarketingTripleLift

TripleLift cookie "sync" set correctly after consent

Cookie: syncDomain: .3lift.comRetention: 3 months

CompliantCookieMarketingTripleLift

TripleLift cookie "tluid" set correctly after consent

Cookie: tluidDomain: .3lift.comRetention: 3 months

Adform5 findings

uid, cto_bidid, UID, C, c

CompliantCookieMarketingAdform

Adform cookie "uid" set correctly after consent

Cookie: uidDomain: .criteo.comRetention: 60 days

CompliantCookieMarketingAdform

Adform cookie "cto_bidid" set correctly after consent

Cookie: cto_bididDomain: .forbes.comRetention: 1 hour

CompliantCookieMarketingAdform

Adform cookie "UID" set correctly after consent

Cookie: UIDDomain: .scorecardresearch.comRetention: 60 days

CompliantCookieMarketingAdform

Adform cookie "C" set correctly after consent

Cookie: CDomain: .adform.netRetention: 60 days till 3650 days

CompliantCookieMarketingAdform

Adform cookie "c" set correctly after consent

Cookie: cDomain: .bidswitch.netRetention: 60 days till 3650 days

CompliantCookieFunctionalCloudflare

Cloudflare cookie "__cf_bm" set correctly after consent

Cookie: __cf_bmDomain: .d.email.forbes.comRetention: session

CompliantCookieFunctionalGoogle

Google cookie "receive-cookie-deprecation" set correctly after consent

Cookie: receive-cookie-deprecationDomain: .casalemedia.comRetention: 180 days

Yahoo2 findings

A3, IDSYNC

CompliantCookieMarketingYahoo

Yahoo cookie "A3" set correctly after consent

Cookie: A3Domain: .yahoo.comRetention: 1 year

CompliantCookieMarketingYahoo

Yahoo cookie "IDSYNC" set correctly after consent

Cookie: IDSYNCDomain: .analytics.yahoo.comRetention: 1 year

Lotame4 findings

_cc_dc, _cc_id, panoramaId_expiry, panoramaId

CompliantCookieMarketingLotame

Lotame cookie "_cc_dc" set correctly after consent

Cookie: _cc_dcDomain: .crwdcntrl.netRetention: session

CompliantCookieMarketingLotame

Lotame cookie "_cc_id" set correctly after consent

Cookie: _cc_idDomain: .crwdcntrl.netRetention: 269 days

CompliantCookieMarketingLotame

Lotame cookie "panoramaId_expiry" set correctly after consent

Cookie: panoramaId_expiryDomain: .forbes.comRetention: session

CompliantCookieMarketingLotame

Lotame cookie "panoramaId" set correctly after consent

Cookie: panoramaIdDomain: .forbes.comRetention: session

DoubleClick/Google Marketing2 findings

IDE, __gads

CompliantCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "IDE" set correctly after consent

Cookie: IDEDomain: .doubleclick.netRetention: 2 years

CompliantCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "__gads" set correctly after consent

Cookie: __gadsDomain: .forbes.comRetention: various

PubMatic16 findings

pi, KRTBCOOKIE_153, KADUSERCOOKIE, KRTBCOOKIE_80, KRTBCOOKIE_377, KRTBCOOKIE_860, KRTBCOOKIE_452, KRTBCOOKIE_188, KRTBCOOKIE_279, chkChromeAb67Sec, DPSync4, SyncRTB4, PugT, KRTBCOOKIE_32, KRTBCOOKIE_22, SPugT