https://grubhub.com
Scanned Apr 15, 2026 · 39.4s
Your website score is
Grade
BannerConsent Banner
Yes
Regulatory Compliance
Multi-regulation overview — click any regulation for details
Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.
Tag Leak detected 171 user data leaks before consent on grubhub.com, including DataDog (Analytics Tracker), Tealium (Tracker Tracker), Braze and 41 more.
Security Headers
4/6 presentStrict-Transport-Security
max-age=31536000
Content-Security-Policy
frame-ancestors 'self' default-src 'self' *.grubhub.com grubhub.com *.dine.online *.datadog.hq cdn.contentful.com *.forter.com maps.googleapis.com six.cdn-net.com www.cdn-net.com pinpad.paysecure.acculynk.net; frame-src 'self' *.grubhub.com grubhub.com api.braintree.com *.braintreegateway.com *.braintree-api.com braintreegateway.com apay-us.amazon.com analytics.tiktok.com analytics.twitter.com analytics.churnzero.com apps.rokt.com apps.rokt-api.com apps-demo.rokt.com everestjs.net *.doubleclick.net accounts.google.com checkout.paypal.com googletagmanager.com www.googletagmanager.com insight.adsrvr.org match.adsrvr.org na.account.amazon.com prod.accdab.net six.cdn-net.com www.cdn-net.com https://*.js.stripe.com https://js.stripe.com https://hooks.stripe.com *.amazon-adsystem.com *.facebook.com *.kroger.com *.ispot.tv *.w55c.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: *.payments-amazon.com *.tags.tiqcdn.com redditstatic.com js.adsrvr.org *.grubhub.com grubhub.com api.braintree.com *.braintreegateway.com *.braintree-api.com braintreegateway.com apay-us.amazon.com *.forter.com *.rokt.com *.rokt-api.com *.cookielaw.org *.everestjs.net six.cdn-net.com www.cdn-net.com https://cdn.prod.uidapi.com https://*.js.stripe.com https://js.stripe.com https://maps.googleapis.com; script-src-elem 'self' 'unsafe-inline' *.grubhub.com grubhub.com api.braintree.com *.braintreegateway.com *.braintree-api.com braintreegateway.com apay-us.amazon.com analytics.churnzero.net analytics.tiktok.com analytics.twitter.com tags.tiqcdn.com www.google-analytics.com google-analytics.com *.forter.com *.cookielaw.org *.payments-amazon.com platform.twitter.com static.ads-twitter.com www.googletagmanager.com *.cdn-net.com apps.rokt.com apps.rokt-api.com apps-demo.rokt.com maps.googleapis.com cdn.branch.io www.googleadservices.com *.mountain.com app.link googleads.g.doubleclick.net connect.facebook.net assets.loginwithamazon.com accounts.google.com apis.google.com analytics.tiktok.com c.amazon-adsystem.com google-analytics.com google.com googleads.g.doubleclick.net googleadservices.com googletagmanager.com gstatic.com prod.accdab.net redditstatic.com s.pinimg.com everestjs.net d.impactradius-event.com tag.havasedge.com pixel.mathtag.com www.gstatic.com bat.bing.com px.airpr.com www.redditstatic.com js.adsrvr.org ext.chtbl.com www.google.com collector-21091.us.tvsquared.com innovid.com www.everestjs.net six.cdn-net.com www.cdn-net.com https://*.js.stripe.com https://js.stripe.com https://maps.googleapis.com analytics.tiktok.com bat.bing.com connect.facebook.net js.adsrvr.org sc-static.net www.redditstatic.com c.amazon-adsystem.com googleads.g.doubleclick.net platform.twitter.com; img-src 'self' *.cloudinary.com *.grubhub.com grubhub.com *.cloudfront.net *.instacart.com *.pinterest.com *.cookielaw.org cm.everesttech.net t.co www.google-analytics.com google-analytics.com analytics.twitter.com *.doubleclick.net maps.gstatic.com *.googleapis.com www.google.com data: www.facebook.com trkn.us event.havasedge.com grubhubimages-dev.s3.amazonaws.com tags.w55c.net data.adxcel-ec2.com b.videoamp.com ext.chtbl.com bat.bing.com px.airpr.com redditstatic.com js.adsrvr.org adservice.google.com alb.reddit.com b.videoamp.com www.googletagmanager.com insight.adsrvr.org s3.amazonaws.com collector-21091.us.tvsquared.com innovid.com analytics.tiktok.com pt.ispot.tv; style-src-elem 'self' 'unsafe-inline' *.grubhub.com grubhub.com fonts.googleapis.com accounts.google.com pixel.mathtag.com; style-src 'self' 'unsafe-inline' *.grubhub.com grubhub.com fonts.googleapis.com six.cdn-net.com www.cdn-net.com; font-src 'self' 'unsafe-inline' *.grubhub.com grubhub.com fonts.gstatic.com static.rakuten.com; connect-src 'self' *.grubhub.com grubhub.com browser-intake-datadoghq.com *.px-cloud.net preview.connectful.com *.braze.com *.google-analytics.com www.google.com google.com google-analytics.com *.rokt.com *.rokt-api.com *.cookielaw.org *.forter.com wss://cdn0.forter.com analytics.tiktok.com geolocation.onetrust.com preview.contentful.com stats.g.doubleclick.net privacyportal.onetrust.com *.googleapis.com sentry.io api2.branch.io *.facebook.com facebook.com bat.bing.com api.braintree.com *.braintreegateway.com *.braintree-api.com braintreegateway.com apay-us.amazon.com www.gstatic.com maps.gstatic.com data: cdn.contentful.com collect.tealiumiq.com b.px-cdn.net 44.238.122.172 100.20.58.101 35.85.84.151 44.228.85.26 34.215.155.61 35.160.46.251 52.71.121.170 18.210.229.244 44.212.189.233 3.212.39.155 52.22.50.55 54.156.2.105 prod.accdab.net trkn.us seamless.dcm9zy.net s3.amazonaws.com conversions-config.reddit.com pixel-config.reddit.com www.redditstatic.com web.chtbl.com grubhub.vdcy.net insight.adsrvr.org collector-21091.us.tvsquared.com innovid.com six.cdn-net.com www.cdn-net.com https://*.prod.uidapi.com https://prod.uidapi.com https://api.stripe.com https://maps.googleapis.com https://pinpad.paysecure.acculynk.net *.devcycle.com siteperformancetest.net *.doubleclick.net *.cloudfront.net ad.doubleclick.net;
X-Frame-Options
SAMEORIGIN
X-Content-Type-Options
nosniff
Referrer-Policy
Set a Referrer-Policy header to control how much referrer information is shared
Permissions-Policy
Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation
Google Consent Mode
Not DetectedGoogle Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.
Post-Rejection Audit
Reject Button
Found
Post-Rejection Fires
2 vendors
Consent Mode
Basic
GTM Load
Not detected
Consent Mode V2: Basic
Basic Consent Mode — anonymised pings still fire after rejection. Permitted by Google but legally contested under PECR.
Vendors firing after rejection (2)
| Vendor | Category | Timing | URL |
|---|---|---|---|
| Google — GA4 | Basic CM ping | 21971ms | region1.google-analytics.com |
| TikTok — TikTok Pixel | advertising | 25004ms | analytics.tiktok.com |
Consent Record Audit
Issues detectedConsent record stored after interaction
GDPR Art. 7(1)Found: OptanonConsent (OneTrust)
Record contains timestamp
Art. 7(1)Timestamp field detected
Record contains consent state
Art. 7(1)Accept/reject state detected
Record contains consent categories
Art. 7(1)Consent categories (analytics, marketing, etc.) not found in record
Consent withdrawal mechanism accessible
GDPR Art. 7(3)No way for users to withdraw consent found on page
No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.
Why this matters
Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.
Tracker categories detected
Critical80
TikTok Pixel6 findingsID trackedanalytics.tiktok.com, _ttp, _tt_enable_cookie, tt_sessionId, tt_appInfo, tt_pixel_session_index
analytics.tiktok.com, _ttp, _tt_enable_cookie, tt_sessionId, tt_appInfo, tt_pixel_session_index
TikTok Pixel (TikTok) loaded before consent: Sends event data to TikTok for ad measurement
TikTok Pixel cookie "_ttp" set before consent
TikTok Pixel cookie "_tt_enable_cookie" set before consent
TikTok Pixel (TikTok) wrote "tt_sessionId" to sessionStorage before consent
TikTok Pixel (TikTok) wrote "tt_appInfo" to sessionStorage before consent
TikTok Pixel (TikTok) wrote "tt_pixel_session_index" to sessionStorage before consent
Pinterest Tag (Pinterest) loaded before consent: Pinterest conversion tracking
Twitter/X Pixel2 findingsID trackedt.co, static.ads-twitter.com
t.co, static.ads-twitter.com
Twitter/X Pixel (X (Twitter)) loaded before consent: Twitter/X ad conversion tracking endpoint
Twitter/X Pixel (X (Twitter)) loaded before consent: Loads Twitter/X conversion tracking script
Meta Pixel3 findingsID trackedwww.facebook.com, connect.facebook.net, _fbp
www.facebook.com, connect.facebook.net, _fbp
Meta Pixel (Meta) loaded before consent: Meta Pixel tracking endpoint
Meta Pixel (Meta) loaded before consent: Sends user data to Meta for ad targeting and conversion tracking
Meta Pixel cookie "_fbp" set before consent
Google Analytics7 findingsID trackedregion1.google-analytics.com, www.google-analytics.com, www.googletagmanager.com, _ga, _gid, _gat_teal_grubhublabs_UniversalproductionStandard, _ga_S9CDL49TEQ
region1.google-analytics.com, www.google-analytics.com, www.googletagmanager.com, _ga, _gid, _gat_teal_grubhublabs_UniversalproductionStandard, _ga_S9CDL49TEQ
GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics
GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics
GA4 (Google) loaded before consent: Google Analytics gtag.js library
Google Analytics cookie "_ga" set before consent
Google Analytics cookie "_gid" set before consent
Google Analytics cookie "_gat_teal_grubhublabs_UniversalproductionStandard" set before consent
Google Analytics cookie "_ga_S9CDL49TEQ" set before consent
DataDog (analytics) loaded before consent
Tealium (tracker) loaded before consent
Braze (Braze) loaded before consent: Braze customer engagement and marketing automation
HumanSecurity (Tracker Tracker)2 findingstzm.px-cloud.net, b.px-cdn.net
tzm.px-cloud.net, b.px-cdn.net
HumanSecurity (tracker) loaded before consent
HumanSecurity (tracker) loaded before consent
Microsoft Ads (Microsoft) loaded before consent: Microsoft Ads (Bing) UET conversion tracking
Innovid (advertising) loaded before consent
Branch (Branch) loaded before consent: Branch deep linking and attribution
STG (advertising) loaded before consent
Infillion (tracker) loaded before consent
Advertising Tracker7 findingstag.havasedge.com, dx.mountain.com, pt.ispot.tv, staging-pt.ispot.tv, bat.bing.net, event.havasedge.com, px.mountain.com
tag.havasedge.com, dx.mountain.com, pt.ispot.tv, staging-pt.ispot.tv, bat.bing.net, event.havasedge.com, px.mountain.com
advertising tracker at tag.havasedge.com loaded before consent
advertising tracker at dx.mountain.com loaded before consent
advertising tracker at pt.ispot.tv loaded before consent
advertising tracker at staging-pt.ispot.tv loaded before consent
advertising tracker at bat.bing.net loaded before consent
advertising tracker at event.havasedge.com loaded before consent
advertising tracker at px.mountain.com loaded before consent
reddit (advertising) loaded before consent
The Trade Desk (Tracker Tracker)3 findingsjs.adsrvr.org, insight.adsrvr.org, match.adsrvr.org
js.adsrvr.org, insight.adsrvr.org, match.adsrvr.org
The Trade Desk (tracker) loaded before consent
The Trade Desk (tracker) loaded before consent
The Trade Desk (tracker) loaded before consent
Tealium (analytics) loaded before consent
Snapchat Pixel4 findingssc-static.net, tr.snapchat.com, _scid, _scid_r
sc-static.net, tr.snapchat.com, _scid, _scid_r
Snapchat Pixel (Snapchat) loaded before consent: Loads Snapchat conversion tracking script
Snapchat Pixel (Snapchat) loaded before consent: Snapchat pixel tracking endpoint
Snapchat Pixel cookie "_scid" set before consent
Snapchat Pixel cookie "_scid_r" set before consent
Google (Tracker Tracker)3 findingspubads.g.doubleclick.net, ad.doubleclick.net, stats.g.doubleclick.net
pubads.g.doubleclick.net, ad.doubleclick.net, stats.g.doubleclick.net
Google (tracker) loaded before consent
Google (tracker) loaded before consent
Google (tracker) loaded before consent
Claritas (advertising) loaded before consent
Roku (advertising) loaded before consent
ArtsAI (advertising) loaded before consent
VideoAmp (advertising) loaded before consent
Reddit Pixel2 findingsalb.reddit.com, _rdt_uuid
alb.reddit.com, _rdt_uuid
Reddit Pixel (Reddit) loaded before consent: Reddit conversion tracking pixel
Reddit Pixel cookie "_rdt_uuid" set before consent
Impact (Impact) loaded before consent: Impact affiliate and partnership tracking
Amazon (Advertising Tracker)2 findingsc.amazon-adsystem.com, s.amazon-adsystem.com
c.amazon-adsystem.com, s.amazon-adsystem.com
Amazon (advertising) loaded before consent
Amazon (advertising) loaded before consent
Branch (Advertising Tracker)2 findingsapp.link, api2.branch.io
app.link, api2.branch.io
Branch (advertising) loaded before consent
Branch (advertising) loaded before consent
Rokt (advertising) loaded before consent
Impact (advertising) loaded before consent
Stripe (tracker) loaded before consent
MNTN (advertising) loaded before consent
Aniview cookie "version" set before consent — This cookie is used by the website's operator in context with multi-variate testing. This is a tool used to combine or change content on the website. This allows the website to find the best variation/edition of the site.
DoubleClick/Google Marketing cookie "ar_debug" set before consent — Store and track conversions
Pinterest cookie "_pinterest_ct_ua" set before consent — This cookieis a third party cookie which groups actions for users who cannot be identified by Pinterest.
Claritas cookie "barometric[cuid]" set before consent — This cookie is used to identify users for Veritone/Barometric Podcast Conversion.
Roku cookie "wfivefivec" set before consent — Collects data on the user's visits to the website, such as what pages have been loaded. The registered data is used for targeted ads.
X2 findingspersonalization_id, muc_ads
personalization_id, muc_ads
X cookie "personalization_id" set before consent — Unique value with which users can be identified by X. Collected information is used to be personalize X services, including X trends, stories, ads and suggestions.
X cookie "muc_ads" set before consent — These cookies are placed when you come to our website via X. A cookie from X is also placed on our website, with which we can later show a relevant offer on X
LinkedIn2 findingsbrwsr, irld
brwsr, irld
LinkedIn cookie "brwsr" set before consent — This cookie is used to Affiliate Marketing Cookie for LinkedIn
LinkedIn cookie "irld" set before consent — This cookie is used for Affiliate Marketing Cookie for LinkedIn
Shopify cookie "_s" set before consent — Shopify analytics.
Amazon2 findingsad-id, ad-privacy
ad-id, ad-privacy
Amazon cookie "ad-id" set before consent — Clickthroughs to Amazon websites: Noting how the user got to Amazon via this website
Amazon cookie "ad-privacy" set before consent — Provided by amazon-adsystem.com for tracking user actions on other websites to provide targeted content to the users.
TikTok2 findingsttcsid, ttcsid_C3NJIPVB3D4L4OG53C80
ttcsid, ttcsid_C3NJIPVB3D4L4OG53C80
TikTok cookie "ttcsid" set before consent — The TikTok cookie ttcsid likely serves as a session identifier, helping to maintain user sessions and track interactions across the platform. Its purpose is probably to manage user authentication or personalize content based on activity, similar to other session-related cookies used by TikTok.
TikTok cookie "ttcsid_C3NJIPVB3D4L4OG53C80" set before consent — The TikTok cookie ttcsid likely serves as a session identifier, helping to maintain user sessions and track interactions across the platform. Its purpose is probably to manage user authentication or personalize content based on activity, similar to other session-related cookies used by TikTok.
Marfeel cookie "_sc_cspv" set before consent — This cookie is used to store for temporary session
TikTok — TikTok Pixel fires after user rejected consent
No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)
Warnings94
Twitter (Social Tracker)2 findingsID trackedanalytics.twitter.com, platform.twitter.com
analytics.twitter.com, platform.twitter.com
Twitter (social) loaded before consent
Twitter (social) loaded before consent
reddit (social) loaded before consent
Possible server-side tag proxy at api-gtm.grubhub.com — analytics data may be forwarded to third parties before consent. Browser scanning cannot verify downstream recipients; audit your GTM Server-side or CNAME configuration.
Google — GA4 ping fires after rejection (Basic Consent Mode — anonymised, legal grey zone)
Unknown third-party request to static-na.payments-amazon.com before consent
Unknown third-party request to sse.devcycle.com before consent
Unknown third-party request to apps.rokt-api.com before consent
Unknown third-party request to ext.chtbl.com before consent
Unknown third-party request to www.google.com before consent
Unknown third-party request to 34.215.155.61 before consent
Unknown third-party request to grubhub.vdcy.net before consent
localStorage key "clickstream2BrowserId" written before consent
sessionStorage key "grub.foundation.localStorage.enabled" written before consent
localStorage key "ngStorage-test" written before consent
localStorage key "ngStorage-storageExpirationDate" written before consent
localStorage key "isIncognito" written before consent
localStorage key "ngStorage-variantsCache" written before consent
localStorage key "ngStorage-session-blitz_header_operation_id" written before consent
localStorage key "__ghsdk_data-sdk.settings" written before consent
localStorage key "grub-api:anonymousSessionPersisted" written before consent
localStorage key "grub-api:authenticatedSessionPersisted" written before consent
localStorage key "ab.test" written before consent
localStorage key "ab.storage.events.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.sessionId.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.messagingSessionStart.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.deviceId.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.lastSdkReq.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.lastReqToEndpoint.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.brazeSyncRetryCount.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.globalRateLimitCurrentTokenCount.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.serverConfig.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.device.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.sdk_metadata.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.session_id_for_cached_metadata.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.requestAttempts.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "dvc:identified_config.a3523e93-4e41-4836-9157-dbe8eba260a6" written before consent
localStorage key "dvc:identified_config.a3523e93-4e41-4836-9157-dbe8eba260a6.expiry_date" written before consent
sessionStorage key "grub.cs.tabId" written before consent
localStorage key "grub.cs.f4c171c5-75f1-416a-a66f-478c096d1157.default.standard.destinationInfo" written before consent
localStorage key "grub.cs.sessionMutex.mutexA" written before consent
localStorage key "grub.cs.sessionMutex.mutexB" written before consent
sessionStorage key "grub.cs.sessionReported" written before consent
localStorage key "grub.cs.sessionCount" written before consent
localStorage key "grub.cs.session" written before consent
localStorage key "ab.storage.triggers.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.triggers.ts.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "grub.cs.sessionIdentifiers.mutexA" written before consent
localStorage key "grub.cs.sessionIdentifiers.mutexB" written before consent
localStorage key "grub.cs.browserId" written before consent
localStorage key "grub.cs.appInstance" written before consent
sessionStorage key "grub.cs.appInstance.default" written before consent
localStorage key "grub.cs.f4c171c5-75f1-416a-a66f-478c096d1157.default.standard" written before consent
localStorage key "ngStorage-session-pageHistory" written before consent
localStorage key "ngStorage-sQ_Obs" written before consent
localStorage key "ab.storage.sdkVersion.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.ccClicks.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.ccImpressions.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.ccDismissals.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.cc.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.ccLastFullSync.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "ab.storage.ccLastCardUpdated.456f6687-7c17-4725-a9f3-7a851ca4b0b0" written before consent
localStorage key "marketing_segmentationgrouping" written before consent
localStorage key "grub.cs.activeLoggers.mutexA" written before consent
localStorage key "grub.cs.activeLoggers.mutexB" written before consent
localStorage key "grub.cs.activeLoggers" written before consent
sessionStorage key "grub.cs.f4c171c5-75f1-416a-a66f-478c096d1157.default.reclaimedLoggers" written before consent
sessionStorage key "grub-api:anonymousSessionRecordTime" written before consent
localStorage key "tk_1776286330642" written before consent
localStorage key "PXO97ybH4J_px-ff" written before consent
sessionStorage key "pxsid" written before consent
localStorage key "PXO97ybH4J_px_hvd" written before consent
sessionStorage key "px_tk_1776286330914" written before consent
sessionStorage key "px_tk_1776286330915" written before consent
sessionStorage key "px_cd277742" written before consent
localStorage key "tealium_timing" written before consent
localStorage key "px_22j9f8hlau2f5" written before consent
localStorage key "px_33df3rmnerrf5" written before consent
localStorage key "mparticle" written before consent
localStorage key "mprtcl-v4_A58C8D9E-id-cache" written before consent
localStorage key "mprtcl-v4_A58C8D9E" written before consent
localStorage key "mprtcl-tos-A58C8D9E" written before consent
localStorage key "storage_test" written before consent
sessionStorage key "test" written before consent
localStorage key "lastExternalReferrer" written before consent
localStorage key "u_sclid" written before consent
sessionStorage key "u_scsid" written before consent
localStorage key "u_sclid_r" written before consent
sessionStorage key "u_scsid_r" written before consent
sessionStorage key "mprtcl-v4_A58C8D9E-events" written before consent
localStorage key "RoktDualSendBucket" written before consent
localStorage key "RoktRecogniser" written before consent
sessionStorage key "branch_session" written before consent
localStorage key "branch_session_first" written before consent
Info9
OneTrust2 findingscdn.cookielaw.org, OptanonConsent
cdn.cookielaw.org, OptanonConsent
OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management
OneTrust cookie "OptanonConsent" set before consent
Stripe (cdn) loaded before consent
OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location
Contentful (cdn) loaded before consent
Snapchat cookie "X-AB" set before consent — This cookie is used by the website’s operator in context with multi-variate testing. This is a tool used to combine or change content on the website. This allows the website to find the best variation/edition of the site.
DoubleClick/Google Marketing cookie "test_cookie" set before consent — This cookie is set by DoubleClick (which is owned by Google) to determine if the website visitor's browser supports cookies.
Tripadvisor cookie "rt" set before consent — This cookie is used to identify the visitor through an application. This allows the visitor to login to a website through their LinkedIn application for example.
AWS Application Load Balancer — necessary for infrastructure
Compliant3
Google Ads2 findingswww.google.com, _gcl_ls
www.google.com, _gcl_ls
Google Ads (Google) loaded correctly after consent
Google Ads (Google) wrote "_gcl_ls" to localStorage correctly after consent
OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent
Is this your site?
Run a full multi-page scan with monitoring and get detailed remediation steps
Scan grubhub.com →This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com