Healthline

healthline.com

Compare

https://healthline.com

Scanned Apr 15, 2026 · 39.4s

Your website score is

0/100
Critical

Grade

F0

Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 63 user data leaks before consent on healthline.com, including Advertising Tracker, Google (Tracker Tracker), DoubleVerify (Tracker Tracker) and 13 more.

Security Headers

1/6 present

Strict-Transport-Security

max-age=31536000; includeSubDomains

Content-Security-Policy

Add a Content-Security-Policy header to prevent XSS and code injection attacks

X-Frame-Options

Add X-Frame-Options header to prevent clickjacking attacks

X-Content-Type-Options

Set X-Content-Type-Options to 'nosniff' to prevent MIME type sniffing

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

V2
70/100
GTM Containers:GTM-MB6365D

Consent Parameters

ParameterDefaultUpdated
Ad Storagenot_setgranted
Ad User Datanot_setgranted
Ad Personalizationnot_setgranted
Analytics Storagenot_setgranted
Functionality Storagenot_setgranted
Personalization Storagenot_setgranted
Security Storagenot_setgranted

Issues (1)

No default consent call detected — consent mode may not be initialised correctly

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

9 vendors

Consent Mode

Not Detected

GTM Load

Not detected

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

✓ gtag('consent', 'update') call detected on rejection

Vendors firing after rejection (9)

VendorCategoryTimingURL
OneTrust — OneTrustconsent_management18461mscdn.cookielaw.org
OneTrust — OneTrust CMPconsent_management18661msgeolocation.onetrust.com
Google — Google Tag Managertag_management18803mswww.googletagmanager.com
Sourcepoint — Sourcepoint CMPconsent_management21501msats-wrapper.privacymanager.io
TikTok — TikTok Pixeladvertising27638msanalytics.tiktok.com
Meta — Meta Pixeladvertising27638msconnect.facebook.net
Pinterest — Pinterest Tagadvertising27638mss.pinimg.com
Microsoft — Microsoft Adsadvertising27638msbat.bing.com
Reddit — Reddit Pixeladvertising27710msalb.reddit.com

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

Found: OptanonConsent (OneTrust)

Record contains timestamp

Art. 7(1)

Timestamp field detected

Record contains consent state

Art. 7(1)

Accept/reject state detected

Record contains consent categories

Art. 7(1)

Consent categories (analytics, marketing, etc.) not found in record

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising19 vendors
Analytics2 vendors
Marketing5 vendors
Security5
Functional3 vendors
Tag Management2 vendors
Critical36
Advertising Tracker
Advertising Tracker2 findings

prod.adspsp.com, ingest.make.rvohealth.com

Advertising Tracker
criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at prod.adspsp.com loaded before consent

Host: prod.adspsp.comFired: 1174ms after load
Advertising Tracker
criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at ingest.make.rvohealth.com loaded before consent

Host: ingest.make.rvohealth.comFired: 1913ms after load
Google (Tracker Tracker)
Google (Tracker Tracker)2 findings

securepubads.g.doubleclick.net, ad.doubleclick.net

Google (Tracker Tracker)
criticalNetworkGoogle (Tracker Tracker)

Google (tracker) loaded before consent

Host: securepubads.g.doubleclick.netFired: 1177ms after load
Google (Tracker Tracker)
criticalNetworkGoogle (Tracker Tracker)

Google (tracker) loaded before consent

Host: ad.doubleclick.netFired: 4525ms after load
DoubleVerify (Tracker Tracker)
criticalNetworkDoubleVerify (Tracker Tracker)

DoubleVerify (tracker) loaded before consent

Host: pub.doubleverify.comFired: 1177ms after load
Amazon (Advertising Tracker)
Amazon (Advertising Tracker)3 findings

config.aps.amazon-adsystem.com, client.aps.amazon-adsystem.com, c.amazon-adsystem.com

Amazon (Advertising Tracker)
criticalNetworkAdvertisingAmazon (Advertising Tracker)

Amazon (advertising) loaded before consent

Host: config.aps.amazon-adsystem.comFired: 1178ms after load
Amazon (Advertising Tracker)
criticalNetworkAdvertisingAmazon (Advertising Tracker)

Amazon (advertising) loaded before consent

Host: client.aps.amazon-adsystem.comFired: 1178ms after load
Amazon (Advertising Tracker)
criticalNetworkAdvertisingAmazon (Advertising Tracker)

Amazon (advertising) loaded before consent

Host: c.amazon-adsystem.comFired: 1710ms after load
Confiant (Advertising Tracker)
criticalNetworkAdvertisingConfiant (Advertising Tracker)

Confiant (advertising) loaded before consent

Host: cdn.confiant-integrations.netFired: 4171ms after load
AdDelivery (Advertising Tracker)
criticalNetworkAdvertisingAdDelivery (Advertising Tracker)

AdDelivery (advertising) loaded before consent

Host: ad-delivery.netFired: 4525ms after load
IndexExchange (Advertising Tracker)
criticalNetworkAdvertisingIndexExchange (Advertising Tracker)

IndexExchange (advertising) loaded before consent

Host: js-sec.indexww.comFired: 5170ms after load
The Trade Desk (Tracker Tracker)
criticalNetworkThe Trade Desk (Tracker Tracker)

The Trade Desk (tracker) loaded before consent

Host: match.adsrvr.orgFired: 5275ms after load
LiveRamp (Advertising Tracker)
criticalNetworkAdvertisingLiveRamp (Advertising Tracker)

LiveRamp (advertising) loaded before consent

Host: api.rlcdn.comFired: 5277ms after load
33Across (Advertising Tracker)
criticalNetworkAdvertising33Across (Advertising Tracker)

33Across (advertising) loaded before consent

Host: lexicon.33across.comFired: 5349ms after load
Yahoo! (Analytics Tracker)
criticalNetworkAnalyticsYahoo! (Analytics Tracker)

Yahoo! (analytics) loaded before consent

Host: ups.analytics.yahoo.comFired: 5349ms after load
ID5 (Advertising Tracker)
ID5 (Advertising Tracker)5 findings

id5-sync.com, lb.eu-1-id5-sync.com, cdn.id5-sync.com, api.id5-sync.com, lbs.eu-1-id5-sync.com

ID5 (Advertising Tracker)
criticalNetworkAdvertisingID5 (Advertising Tracker)

ID5 (advertising) loaded before consent

Host: id5-sync.comFired: 5349ms after load
ID5 (Advertising Tracker)
criticalNetworkAdvertisingID5 (Advertising Tracker)

ID5 (advertising) loaded before consent

Host: lb.eu-1-id5-sync.comFired: 5421ms after load
ID5 (Advertising Tracker)
criticalNetworkAdvertisingID5 (Advertising Tracker)

ID5 (advertising) loaded before consent

Host: cdn.id5-sync.comFired: 5535ms after load
ID5 (Advertising Tracker)
criticalNetworkAdvertisingID5 (Advertising Tracker)

ID5 (advertising) loaded before consent

Host: api.id5-sync.comFired: 5620ms after load
ID5 (Advertising Tracker)
criticalNetworkAdvertisingID5 (Advertising Tracker)

ID5 (advertising) loaded before consent

Host: lbs.eu-1-id5-sync.comFired: 6129ms after load
Dentsu (Advertising Tracker)
criticalNetworkAdvertisingDentsu (Advertising Tracker)

Dentsu (advertising) loaded before consent

Host: id2.sv.rkdms.comFired: 5352ms after load
PublicisGroupe (Tracker Tracker)
criticalNetworkPublicisGroupe (Tracker Tracker)

PublicisGroupe (tracker) loaded before consent

Host: secure.cdn.fastclick.netFired: 5535ms after load
Youtube
Youtube3 findings

__Secure-ROLLOUT_TOKEN, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA

Youtube
criticalCookieMarketingYoutube

Youtube cookie "__Secure-ROLLOUT_TOKEN" set before consent — Registers a unique ID to keep statistics of what videos from YouTube the user has seen.

Cookie: __Secure-ROLLOUT_TOKENDomain: .youtube.comRetention: 180 days
Youtube
criticalCookieMarketingYoutube

Youtube cookie "VISITOR_INFO1_LIVE" set before consent — Tries to estimate the users' bandwidth on pages with integrated YouTube videos. Also used for marketing

Cookie: VISITOR_INFO1_LIVEDomain: .youtube.comRetention: 179 days
Youtube
criticalCookieMarketingYoutube

Youtube cookie "VISITOR_PRIVACY_METADATA" set before consent — Youtube visitor privacy metadata cookie

Cookie: VISITOR_PRIVACY_METADATADomain: .youtube.comRetention: 180 days
criticalCookieMarketingID5

ID5 cookie "id5" set before consent — Sets a unique ID for the visitor, that allows third party advertisers to target the visitor with relevant advertisement. This pairing service is provided by third party advertisement hubs, which facilitates real-time bidding for advertisers.

Cookie: id5Domain: .id5-sync.comRetention: 1 day
OneTrust — OneTrust
criticalPost-RejectionConsent MgmtOneTrust — OneTrust

OneTrust — OneTrust fires after user rejected consent

Fired: 18461ms after load
OneTrust — OneTrust CMP
criticalPost-RejectionConsent MgmtOneTrust — OneTrust CMP

OneTrust — OneTrust CMP fires after user rejected consent

Fired: 18661ms after load
Google — Google Tag Manager
criticalPost-RejectionTag ManagementGoogle — Google Tag Manager

Google — Google Tag Manager fires after user rejected consent

Fired: 18803ms after load
criticalPost-RejectionConsent MgmtSourcepoint — Sourcepoint CMP

Sourcepoint — Sourcepoint CMP fires after user rejected consent

Fired: 21501ms after load
TikTok — TikTok Pixel
criticalPost-RejectionAdvertisingTikTok — TikTok Pixel

TikTok — TikTok Pixel fires after user rejected consent

Fired: 27638ms after load
Meta — Meta Pixel
criticalPost-RejectionAdvertisingMeta — Meta Pixel

Meta — Meta Pixel fires after user rejected consent

Fired: 27638ms after load
Pinterest — Pinterest Tag
criticalPost-RejectionAdvertisingPinterest — Pinterest Tag

Pinterest — Pinterest Tag fires after user rejected consent

Fired: 27638ms after load
Microsoft — Microsoft Ads
criticalPost-RejectionAdvertisingMicrosoft — Microsoft Ads

Microsoft — Microsoft Ads fires after user rejected consent

Fired: 27638ms after load
Reddit — Reddit Pixel
criticalPost-RejectionAdvertisingReddit — Reddit Pixel

Reddit — Reddit Pixel fires after user rejected consent

Fired: 27710ms after load
criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings37
Google Tag Manager
warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager loads before consent — this is expected and required for GCM v2 to initialise consent defaults before any tags fire

ID: GTM-MB6365DHost: www.googletagmanager.comFired: 2290ms after load
Analytics proxy
warningNetworkAnalytics proxy

Possible server-side tag proxy at gtm-server.healthline.com — analytics data may be forwarded to third parties before consent. Browser scanning cannot verify downstream recipients; audit your GTM Server-side or CNAME configuration.

Host: gtm-server.healthline.comFired: 945ms after load
vendor logo
warningNetwork

Unknown third-party request to media.post.rvohealth.io before consent

Host: media.post.rvohealth.ioFired: 893ms after load
vendor logo
warningNetwork

Unknown third-party request to cdn.rvohealth.com before consent

Host: cdn.rvohealth.comFired: 1914ms after load
vendor logo
warningNetwork

Unknown third-party request to assets.medicalnewstoday.com before consent

Host: assets.medicalnewstoday.comFired: 2917ms after load
vendor logo
warningNetwork

Unknown third-party request to cdn.btmessage.com before consent

Host: cdn.btmessage.comFired: 3915ms after load
vendor logo
warningNetwork

Unknown third-party request to api.btmessage.com before consent

Host: api.btmessage.comFired: 4519ms after load
warningStorage

sessionStorage key "tglr_hash_id" written before consent

Key: tglr_hash_idType: sessionStorageFired: 1848ms after load
warningStorage

localStorage key "lsTest" written before consent

Key: lsTestType: localStorageFired: 1894ms after load
warningStorage

localStorage key "pmp_dcsn_cache" written before consent

Key: pmp_dcsn_cacheType: localStorageFired: 2988ms after load
warningStorage

localStorage key "adb_u" written before consent

Key: adb_uType: localStorageFired: 3865ms after load
warningStorage

sessionStorage key "adb_s" written before consent

Key: adb_sType: sessionStorageFired: 3866ms after load
warningStorage

sessionStorage key "BT_sid" written before consent

Key: BT_sidType: sessionStorageFired: 3983ms after load
warningStorage

localStorage key "test" written before consent

Key: testType: localStorageFired: 5263ms after load
warningStorage

localStorage key "prebid.cookieTest" written before consent

Key: prebid.cookieTestType: localStorageFired: 5293ms after load
warningStorage

localStorage key "_sharedID_exp" written before consent

Key: _sharedID_expType: localStorageFired: 5311ms after load
warningStorage

localStorage key "_sharedID_cst" written before consent

Key: _sharedID_cstType: localStorageFired: 5313ms after load
warningStorage

localStorage key "_sharedID" written before consent

Key: _sharedIDType: localStorageFired: 5315ms after load
warningStorage

localStorage key "IXWRAPPERLiveRampIp" written before consent

Key: IXWRAPPERLiveRampIpType: localStorageFired: 5340ms after load
warningStorage

localStorage key "IXWRAPPERAdserverOrgIp" written before consent

Key: IXWRAPPERAdserverOrgIpType: localStorageFired: 5393ms after load
warningStorage

localStorage key "connectid_exp" written before consent

Key: connectid_expType: localStorageFired: 5457ms after load
warningStorage

localStorage key "connectid_cst" written before consent

Key: connectid_cstType: localStorageFired: 5458ms after load
warningStorage

localStorage key "connectid" written before consent

Key: connectidType: localStorageFired: 5458ms after load
warningStorage

localStorage key "id5id_exp" written before consent

Key: id5id_expType: localStorageFired: 5493ms after load
warningStorage

localStorage key "id5id_cst" written before consent

Key: id5id_cstType: localStorageFired: 5493ms after load
warningStorage

localStorage key "id5id" written before consent

Key: id5idType: localStorageFired: 5493ms after load
warningStorage

localStorage key "id5id_last" written before consent

Key: id5id_lastType: localStorageFired: 5493ms after load
warningStorage

localStorage key "__localStorage_test__" written before consent

Key: __localStorage_test__Type: localStorageFired: 5589ms after load
warningStorage

localStorage key "_pubcid_exp" written before consent

Key: _pubcid_expType: localStorageFired: 5591ms after load
warningStorage

localStorage key "_pubcid" written before consent

Key: _pubcidType: localStorageFired: 5591ms after load
warningStorage

localStorage key "id5id_cached_consent_data_exp" written before consent

Key: id5id_cached_consent_data_expType: localStorageFired: 6118ms after load
warningStorage

localStorage key "id5id_cached_consent_data" written before consent

Key: id5id_cached_consent_dataType: localStorageFired: 6119ms after load
warningStorage

localStorage key "__id5test" written before consent

Key: __id5testType: localStorageFired: 6119ms after load
warningStorage

localStorage key "id5id_extensions" written before consent

Key: id5id_extensionsType: localStorageFired: 6193ms after load
warningStorage

localStorage key "id5id_privacy_exp" written before consent

Key: id5id_privacy_expType: localStorageFired: 6222ms after load
warningStorage

localStorage key "id5id_privacy" written before consent

Key: id5id_privacyType: localStorageFired: 6223ms after load
warningStorage

localStorage key "id5id_v2_6731402884891114" written before consent

Key: id5id_v2_6731402884891114Type: localStorageFired: 6223ms after load
Info8
OneTrust
OneTrust2 findings

cdn.cookielaw.org, OptanonConsent

OneTrust
infoNetworkConsent MgmtOneTrust

OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management

Host: cdn.cookielaw.orgFired: 862ms after load
OneTrust
infoCookieConsent MgmtOneTrust

OneTrust cookie "OptanonConsent" set before consent

Cookie: OptanonConsentDomain: .healthline.com
OneTrust CMP
infoNetworkConsent MgmtOneTrust CMP

OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location

Host: geolocation.onetrust.comFired: 1076ms after load
Sourcepoint CMP
Sourcepoint CMP2 findings

ats-wrapper.privacymanager.io, geo.privacymanager.io

Sourcepoint CMP
infoNetworkConsent MgmtSourcepoint CMP

Sourcepoint CMP (Sourcepoint) loaded before consent: Sourcepoint consent management platform

Host: ats-wrapper.privacymanager.ioFired: 4173ms after load
Sourcepoint CMP
infoNetworkConsent MgmtSourcepoint CMP

Sourcepoint CMP (Sourcepoint) loaded before consent: Sourcepoint consent management platform

Host: geo.privacymanager.ioFired: 4818ms after load
Google (Cdn)
infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: www.youtube.comFired: 4633ms after load
infoCookieFunctionalPrivacyPillar

PrivacyPillar cookie "usprivacy" set before consent — This cookie stores the US privacy string.

Cookie: usprivacyDomain: .healthline.comRetention: 1 year
Youtube
infoCookieFunctionalYoutube

Youtube cookie "YSC" set before consent — Registers a unique ID to keep statistics of what videos from YouTube the user has seen.

Cookie: YSCDomain: .youtube.comRetention: Session
Compliant18
OneTrust
CompliantCookieConsent MgmtOneTrust

OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent

Cookie: OptanonAlertBoxClosedDomain: .healthline.com
Reddit Pixel
CompliantCookieAdvertisingReddit Pixel

Reddit Pixel cookie "_rdt_uuid" set correctly after consent

Cookie: _rdt_uuidDomain: .healthline.com
TikTok Pixel
TikTok Pixel5 findings

_ttp, _tt_enable_cookie, tt_sessionId, tt_appInfo, tt_pixel_session_index

TikTok Pixel
CompliantCookieAdvertisingTikTok Pixel

TikTok Pixel cookie "_ttp" set correctly after consent

Cookie: _ttpDomain: .tiktok.com
TikTok Pixel
CompliantCookieAdvertisingTikTok Pixel

TikTok Pixel cookie "_tt_enable_cookie" set correctly after consent

Cookie: _tt_enable_cookieDomain: .healthline.com
TikTok Pixel
CompliantStorageAdvertisingTikTok Pixel

TikTok Pixel (TikTok) wrote "tt_sessionId" to sessionStorage correctly after consent

Key: tt_sessionIdType: sessionStorageFired: -14952ms after load
TikTok Pixel
CompliantStorageAdvertisingTikTok Pixel

TikTok Pixel (TikTok) wrote "tt_appInfo" to sessionStorage correctly after consent

Key: tt_appInfoType: sessionStorageFired: -14938ms after load
TikTok Pixel
CompliantStorageAdvertisingTikTok Pixel

TikTok Pixel (TikTok) wrote "tt_pixel_session_index" to sessionStorage correctly after consent

Key: tt_pixel_session_indexType: sessionStorageFired: -14935ms after load
DoubleClick/Google Marketing
CompliantCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "ar_debug" set correctly after consent

Cookie: ar_debugDomain: .pinterest.comRetention: Persistent
Sailthru3 findings

sailthru_pageviews, sailthru_content, sailthru_visitor

CompliantCookieMarketingSailthru

Sailthru cookie "sailthru_pageviews" set correctly after consent

Cookie: sailthru_pageviewsDomain: www.healthline.comRetention: 30 minutes
CompliantCookieMarketingSailthru

Sailthru cookie "sailthru_content" set correctly after consent

Cookie: sailthru_contentDomain: www.healthline.comRetention: 1 year
CompliantCookieMarketingSailthru

Sailthru cookie "sailthru_visitor" set correctly after consent

Cookie: sailthru_visitorDomain: www.healthline.comRetention: 1 year
Pinterest Tag
CompliantCookieAdvertisingPinterest Tag

Pinterest Tag cookie "_pin_unauth" set correctly after consent

Cookie: _pin_unauthDomain: .healthline.com
Marfeel
CompliantCookieAnalyticsMarfeel

Marfeel cookie "_scor_uid" set correctly after consent

Cookie: _scor_uidDomain: .healthline.comRetention: Session
Meta Pixel
CompliantCookieAdvertisingMeta Pixel

Meta Pixel cookie "_fbp" set correctly after consent

Cookie: _fbpDomain: .healthline.com
TikTok
TikTok2 findings

ttcsid, ttcsid_CK4U9VJC77U3KEN5IUUG

TikTok
CompliantCookieMarketingTikTok

TikTok cookie "ttcsid" set correctly after consent

Cookie: ttcsidDomain: .healthline.comRetention: 1 year
TikTok
CompliantCookieMarketingTikTok

TikTok cookie "ttcsid_CK4U9VJC77U3KEN5IUUG" set correctly after consent

Cookie: ttcsid_CK4U9VJC77U3KEN5IUUGDomain: .healthline.comRetention: 1 year
CompliantStorageFunctionallocalStorage availability probe

localStorage availability probe (null) wrote "__storage_test__" to localStorage correctly after consent

Key: __storage_test__Type: localStorageFired: -15120ms after load
Google Ads
CompliantStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage correctly after consent

Key: _gcl_lsType: localStorageFired: 4304ms after load

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan healthline.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com