https://ford.com
Scanned Apr 15, 2026 · 40.7s
Your website score is
Grade
BannerConsent Banner
Yes
Regulatory Compliance
Multi-regulation overview — click any regulation for details
Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.
Tag Leak detected 106 user data leaks before consent on ford.com, including Adobe (Tracker Tracker), Adobe Analytics, Akamai (Analytics Tracker) and 28 more.
Security Headers
3/6 presentStrict-Transport-Security
max-age=31557600
Content-Security-Policy
Add a Content-Security-Policy header to prevent XSS and code injection attacks
X-Frame-Options
SAMEORIGIN
X-Content-Type-Options
nosniff
Referrer-Policy
Set a Referrer-Policy header to control how much referrer information is shared
Permissions-Policy
Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation
Google Consent Mode
Not DetectedGoogle Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.
Post-Rejection Audit
Reject Button
Found
Post-Rejection Fires
1 vendor
Consent Mode
Not Detected
GTM Load
Not detected
Consent Mode V2: Not Detected
Google Consent Mode was not detected on this site.
Vendors firing after rejection (1)
| Vendor | Category | Timing | URL |
|---|---|---|---|
| TikTok — TikTok Pixel | advertising | 27842ms | analytics.tiktok.com |
Consent Record Audit
PassConsent record stored after interaction
GDPR Art. 7(1)Found: OptanonConsent (OneTrust)
Record contains timestamp
Art. 7(1)Timestamp field detected
Record contains consent state
Art. 7(1)Accept/reject state detected
Record contains consent categories
Art. 7(1)Consent categories (analytics, marketing, etc.) not found in record
Consent withdrawal mechanism accessible
GDPR Art. 7(3)Cookie settings link / floating button found
Tracker categories detected
Critical73
Pinterest Tag (Pinterest) loaded before consent: Pinterest conversion tracking

Meta Pixel (Meta) loaded before consent: Meta Pixel tracking endpoint
TikTok Pixel3 findingsID trackedanalytics.tiktok.com, analytics-ipv6.tiktokw.us, _ttp

analytics.tiktok.com, analytics-ipv6.tiktokw.us, _ttp

TikTok Pixel (TikTok) loaded before consent: Sends event data to TikTok for ad measurement

TikTok Pixel (TikTok) loaded before consent: TikTok Pixel IPv6 enrichment and data collection

TikTok Pixel cookie "_ttp" set before consent
Adobe (Tracker Tracker)6 findingsford.demdex.net, dpm.demdex.net, adobedc.demdex.net, www.everestjs.net, pixel.everesttech.net, cm.everesttech.net

ford.demdex.net, dpm.demdex.net, adobedc.demdex.net, www.everestjs.net, pixel.everesttech.net, cm.everesttech.net

Adobe (tracker) loaded before consent

Adobe (tracker) loaded before consent

Adobe (tracker) loaded before consent

Adobe (tracker) loaded before consent

Adobe (tracker) loaded before consent

Adobe (tracker) loaded before consent
Adobe Analytics4 findingsford.tt.omtrdc.net, s_ecid, AMCV_EFD95E09512D2A8E0A490D4D%40AdobeOrg, s_cc

ford.tt.omtrdc.net, s_ecid, AMCV_EFD95E09512D2A8E0A490D4D%40AdobeOrg, s_cc

Adobe Analytics (Adobe) loaded before consent: Adobe Analytics tracking endpoint

Adobe Analytics cookie "s_ecid" set before consent — This cookie is set by the customer's domain after the AMCV cookie is set by the client. The purpose of this cookie is to allow persistent ID tracking in the 1st-party state and is used as a reference ID if the AMCV cookie has expired.

Adobe Analytics cookie "AMCV_EFD95E09512D2A8E0A490D4D%40AdobeOrg" set before consent

Adobe Analytics cookie "s_cc" set before consent
Akamai (Analytics Tracker)2 findingss.go-mpulse.net, c.go-mpulse.net
s.go-mpulse.net, c.go-mpulse.net
Akamai (analytics) loaded before consent
Akamai (analytics) loaded before consent
Google (Tracker Tracker)5 findingscm.g.doubleclick.net, ad.doubleclick.net, 690327.fls.doubleclick.net, adservice.google.com, 11328183.fls.doubleclick.net
cm.g.doubleclick.net, ad.doubleclick.net, 690327.fls.doubleclick.net, adservice.google.com, 11328183.fls.doubleclick.net
Google (tracker) loaded before consent
Google (tracker) loaded before consent
Google (tracker) loaded before consent
Google (tracker) loaded before consent
Google (tracker) loaded before consent
The Trade Desk (Tracker Tracker)3 findingsmatch.adsrvr.org, insight.adsrvr.org, js.adsrvr.org
match.adsrvr.org, insight.adsrvr.org, js.adsrvr.org
The Trade Desk (tracker) loaded before consent
The Trade Desk (tracker) loaded before consent
The Trade Desk (tracker) loaded before consent
Medallia (analytics) loaded before consent
mpeasylink.com (analytics) loaded before consent

Optimizely (Optimizely) loaded before consent: Optimizely experimentation and A/B testing
Simpli.fi (advertising) loaded before consent
Magnite (advertising) loaded before consent
Amazon (advertising) loaded before consent
ContentSquare (Analytics Tracker)4 findingst.contentsquare.net, c.az.contentsquare.net, k-us1.az.contentsquare.net, srm.af.contentsquare.net
t.contentsquare.net, c.az.contentsquare.net, k-us1.az.contentsquare.net, srm.af.contentsquare.net
ContentSquare (analytics) loaded before consent
ContentSquare (analytics) loaded before consent
ContentSquare (analytics) loaded before consent
ContentSquare (analytics) loaded before consent

GA4 (Google) loaded before consent: Google Analytics gtag.js library
Google Ads5 findingswww.google.com, googleads.g.doubleclick.net, www.googleadservices.com, _gcl_au, _gcl_ls

www.google.com, googleads.g.doubleclick.net, www.googleadservices.com, _gcl_au, _gcl_ls

Google Ads (Google) loaded before consent: Google Consent Mode data collection for ad measurement

Google Ads (Google) loaded before consent: Sends conversion data to Google Ads

Google Ads (Google) loaded before consent: Google Ads conversion tracking

Google Ads cookie "_gcl_au" set before consent

Google Ads (Google) wrote "_gcl_ls" to localStorage before consent
TransUnion (Advertising Tracker)2 findingsaa.agkn.com, d.agkn.com
aa.agkn.com, d.agkn.com
TransUnion (advertising) loaded before consent
TransUnion (advertising) loaded before consent

Microsoft Ads (Microsoft) loaded before consent: Microsoft Ads (Bing) UET conversion tracking
advertising tracker at bat.bing.net loaded before consent
Adobe Audience Manager5 findingsdemdex, AMCVS_EFD95E09512D2A8E0A490D4D%40AdobeOrg, dpm, mbox, dextp

demdex, AMCVS_EFD95E09512D2A8E0A490D4D%40AdobeOrg, dpm, mbox, dextp

Adobe Audience Manager cookie "demdex" set before consent — Unique value with which Audience Manager can identify a user. Used, among others, for identification, segmentation, modeling and reporting purposes.

Adobe Audience Manager cookie "AMCVS_EFD95E09512D2A8E0A490D4D%40AdobeOrg" set before consent — The AMCVS cookie serves as a flag indicating that the session has been initialized. Its value is always 1 and discontinues when the session has ended.

Adobe Audience Manager cookie "dpm" set before consent — DPM is an abbreviation for Data Provider Match. It tells internal, Adobe systems that a call from Audience Manager or the Adobe Experience Cloud ID Service is passing in customer data for synchronization or requesting an ID.

Adobe Audience Manager cookie "mbox" set before consent — Adobe Target uses cookies to give website operators the ability to test which online content and offers are more relevant to visitors.

Adobe Audience Manager cookie "dextp" set before consent — Registers the date plus time (timestamp) on which a data synchronization was last performed by the Audience Manager.
Dynatrace5 findingsdtCookie, rxVisitor, dtSa, rxvt, dtPC
dtCookie, rxVisitor, dtSa, rxvt, dtPC
Dynatrace cookie "dtCookie" set before consent — This cookie is used by RUM API, Dynatrace Real User Monitoring (RUM) gives you the power to know your customers by providing performance analysis in real time.
Dynatrace cookie "rxVisitor" set before consent — This cookie is used by RUM API, Dynatrace Real User Monitoring (RUM) gives you the power to know your customers by providing performance analysis in real time.
Dynatrace cookie "dtSa" set before consent — This cookie is used by RUM API, Dynatrace Real User Monitoring (RUM) gives you the power to know your customers by providing performance analysis in real time.
Dynatrace cookie "rxvt" set before consent — This cookie is used by RUM API, Dynatrace Real User Monitoring (RUM) gives you the power to know your customers by providing performance analysis in real time.
Dynatrace cookie "dtPC" set before consent — This cookie is used by RUM API, Dynatrace Real User Monitoring (RUM) gives you the power to know your customers by providing performance analysis in real time.
DoubleClick/Google Marketing2 findingsIDE, ar_debug

IDE, ar_debug

DoubleClick/Google Marketing cookie "IDE" set before consent — This cookie is used for targeting, analyzing and optimisation of ad campaigns in DoubleClick/Google Marketing Suite

DoubleClick/Google Marketing cookie "ar_debug" set before consent — Store and track conversions
Bing / Microsoft2 findingsMUID, MR

MUID, MR

Bing / Microsoft cookie "MUID" set before consent — Identifies unique web browsers visiting Microsoft sites. These cookies are used for advertising, site analytics, and other operational purposes.

Bing / Microsoft cookie "MR" set before consent — Used to collect information for analytics purposes.
Amazon2 findingsad-id, ad-privacy
ad-id, ad-privacy
Amazon cookie "ad-id" set before consent — Clickthroughs to Amazon websites: Noting how the user got to Amazon via this website
Amazon cookie "ad-privacy" set before consent — Provided by amazon-adsystem.com for tracking user actions on other websites to provide targeted content to the users.
ContentSquare4 findings_cs_mk_aa, _cs_c, _cs_id, _cs_s
_cs_mk_aa, _cs_c, _cs_id, _cs_s
ContentSquare cookie "_cs_mk_aa" set before consent — Ensures Adobe dimensions and eVars are set only once every 30 minutes. Stores the value of the csMatchingKey which is a random number plus timestamp in milliseconds.
ContentSquare cookie "_cs_c" set before consent — Consent state: digit between 0 and 3. Used for capturing analytics on web pages
ContentSquare cookie "_cs_id" set before consent — Contains: user ID, timestamp (in seconds) of user creation, number of visits for this user
ContentSquare cookie "_cs_s" set before consent — Number of page views for the current session, and the recording state
Neustar cookie "ab" set before consent — This cookie is used by the website’s operator in context with multi-variate testing. This is a tool used to combine or change content on the website. This allows the website to find the best variation/edition of the site.
Totvs cookie "u" set before consent — This cookie is Used for audience segmentation for advertising
Pinterest cookie "_pinterest_ct_ua" set before consent — This cookieis a third party cookie which groups actions for users who cannot be identified by Pinterest.
Adobe Advertising3 findingseverest_g_v2, everest_session_v2, ev_sync_ax

everest_g_v2, everest_session_v2, ev_sync_ax

Adobe Advertising cookie "everest_g_v2" set before consent — This cookie stores the browser and surfer ID.Created after a user initially clicks a client's ad, and used to map the current and subsequent clicks with other events on the client's website

Adobe Advertising cookie "everest_session_v2" set before consent — This cookie stores the session ID

Adobe Advertising cookie "ev_sync_ax" set before consent — This cookie stores The date when synchronization is performed, in the format yyyymmdd. A third-party, ad exchange-specific cookie that syncs the Adobe Advertising surfer ID with the partner ad exchange. It's created for new surfers and sends a synchronization request when it's expired.
HotJar cookie "_hjHasCachedUserAttributes" set before consent

TikTok — TikTok Pixel fires after user rejected consent
Warnings34
Possible server-side tag proxy at smetrics.ford.com — analytics data may be forwarded to third parties before consent. Browser scanning cannot verify downstream recipients; audit your GTM Server-side or CNAME configuration.
Unknown third-party request to assets.adobedtm.com before consent
Unknown third-party request to creativesham.blob.core.windows.net before consent
Unknown third-party request to flaticons.net before consent
Unknown third-party request to www.google.com before consent
sessionStorage key "com.adobe.reactor.core.visitorTracking.landingPage" written before consent
sessionStorage key "com.adobe.reactor.core.visitorTracking.trafficSource" written before consent
sessionStorage key "rxVisitor" written before consent
sessionStorage key "rxvisitid" written before consent
sessionStorage key "rxvt" written before consent
sessionStorage key "dtSa" written before consent
localStorage key "globalCacheRegistry" written before consent
localStorage key "PostalCodesCacheRegistry" written before consent
localStorage key "DealersCacheRegistry" written before consent
localStorage key "CompetitiveCompareCacheRegistry" written before consent
localStorage key "campaignsCacheRegistry" written before consent
localStorage key "incentivesAndOffersCacheRegistry" written before consent
localStorage key "_boomr_clss" written before consent
localStorage key "dummy" written before consent
localStorage key "ak_a" written before consent
localStorage key "__akfp_storage_test__" written before consent
sessionStorage key "fgx-pricing-trims-Escape-2025-48120" written before consent
sessionStorage key "fgx-pricing-trims-Explorer-2026-48120" written before consent
sessionStorage key "fgx-pricing-trims-Bronco-2025-48120" written before consent
sessionStorage key "fgx-pricing-trims-F-150 F-150-2026-48120" written before consent
sessionStorage key "fgx-pricing-trims-Ranger-2025-48120" written before consent
localStorage key "FPS_Cache__AnonymousRef__ECID__www.ford.com" written before consent
localStorage key "opt_uid" written before consent
localStorage key "PostalCodesCache_PostalCodes:48120:en_us" written before consent
localStorage key "FPS_Cache__FPICookie" written before consent
localStorage key "FPS_Cache__VOIAggregateNameplate" written before consent
localStorage key "DealersCache_Dealers:Ford:50:3:10:48120::true:en_us" written before consent
sessionStorage key "com.adobe.alloy.EFD95E09512D2A8E0A490D4D@AdobeOrgclickData" written before consent
localStorage key "_hjUserAttributes" written before consent
Info11
OneTrust2 findingscdn.cookielaw.org, OptanonConsent

cdn.cookielaw.org, OptanonConsent

OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management

OneTrust cookie "OptanonConsent" set before consent
Salesforce (cdn) loaded before consent

Microsoft (cdn) loaded before consent

OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location
Akamai cookie "AKA_A2" set before consent — Used for Akamai's Advanced Acceleration feature, intended to improve web performance

Adobe Audience Manager cookie "at_check" set before consent — A simple test value used to determine if a visitor supports cookies. Set each time a visitor requests a page.
Tripadvisor cookie "RT" set before consent — This cookie is used to identify the visitor through an application. This allows the visitor to login to a website through their LinkedIn application for example.
Akamai bot manager — necessary for site protection
Akamai bot management session — necessary for site protection
Akamai bot management — necessary for site protection
Compliant2

OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent

Adobe Analytics cookie "s_fid" set correctly after consent
Is this your site?
Run a full multi-page scan with monitoring and get detailed remediation steps
Scan ford.com →This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com