Lululemon

lululemon.com

Compare

Geo-redirect detected

https://lululemon.com redirected to https://shop.lululemon.com/.

https://lululemon.com

Scanned Apr 17, 2026 · 41.4s

Your website score is

0/100
Critical

Grade

F0

Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 110 user data leaks before consent on lululemon.com, including Kameleoon (Advertising Tracker), DataDog (Analytics Tracker), Adobe (Tracker Tracker) and 21 more.

Security Headers

4/6 present

Strict-Transport-Security

max-age=31536000

Content-Security-Policy

default-src 'self' blob: data: 'unsafe-inline' 'unsafe-eval' https://analytics-ipv6.tiktokw.us https://1ed92c59f6b0.6a312f71.us-east-1.captcha.awswaf.com https://1ed92c59f6b0.6a312f71.us-east-1.token.awswaf.com https://1ed92c59f6b0.us-east-1.captcha-sdk.awswaf.com https://unq3b64663bf52f407fb93ae5c5d0ccd-crm.omnichannelengagementhub.com https://api.cash.app https://cash.app https://emperia.digital https://reporting.findmine.com https://api.findmine.com https://lit.findmine.com https://pdimg-prod-fmv3.findmine.com https://js.findmine.com https://google.com https://shopstylecollective.com https://collectivevoice.com https://d2hrivdxn8ekm8.cloudfront.net https://d1lu3pmaz2ilpx.cloudfront.net https://dvqigh9b7wa32.cloudfront.net https://d330aiyvva2oww.cloudfront.net https://geolocation.onetrust.com https://view.seekxr.com https://lantern.roeye.com https://cdn.cookielaw.org https://app.collectivevoice.com https://lantern.roeyecdn.com https://tr6.snapchat.com https://www.awin1.com https://www.zenaps.com https://the.sciencebehindecommerce.com https://lululemoncanada.us-4.evergage.com https://www.dwin1.com https://region1.google-analytics.com https://region1.analytics.google.com https://tr.snapchat.com https://cdn.evgnet.com https://*.truefitcorp.com https://privacyportal.onetrust.com https://analytics-sg.tiktok.com https://oc-cdn-ocprod.azureedge.net https://cdn.jsdelivr.net https://offers.sheerid.com https://insight.adsrvr.org https://sc-static.net https://romeo.liveclicker.com https://analytics.tiktok.com https://seal.digicert.com https://www.pinterest.com https://*.romeo.liveclicker.com https://*.doubleclick.net https://pubads.g.doubleclick.net https://h.online-metrix.net https://s7mbrstream.scene7.com https://socialladder.rkiapps.com https://us-central1-adaptive-growth.cloudfunctions.net https://p11.techlab-cdn.com https://www.onelink-edge.com https://cdn.pdst.fm https://js.afterpay.com https://klarna-payments-na.klarna.com https://cdn.honey.io https://ws1.postescanada-canadapost.ca https://js.klarna.com https://na.klarnaevt.com https://x.klarnacdn.net https://na-library.klarnaservices.com https://static.quiq-cdn.com https://lululemon.quiq-api.com https://portal.afterpay.com https://static-us.afterpay.com https://static.afterpay.com https://graphql.contentful.com https://*.medallia.com https://cdn.contentful.com https://preview.contentful.com https://www.shopstylecollective.com/ https://tracking.shopstylecollective.com/ https://beta.shopstylecollective.com/ https://test.shopstylecollective.com/ https://optimize.google.com https://*.kampyle.com https://functions62d2bb65.azurewebsites.net https://omny.fm https://*.braintreegateway.com https://*.braintree-api.com https://cdnjs.cloudflare.com https://*.btttag.com https://*.demdex.net https://*.sentry.io https://sentry.io https://*.lululemon.com https://adobedtm.com https://assets.adobedtm.com https://scripts.agileone.com https://cx.atdmt.com https://static.atgsvcs.com https://rules.atgsvcs.com https://bat.bing.com https://lululemonspna.btttag.com https://d.btttag.com https://cache-ssl.celtra.com https://celtraidentity.com https://custhelp.com https://widget.custhelp.com https://lululemon.custhelp.com https://lululemonfr.custhelp.com https://lululemon.widget.custhelp.com https://www.facebook.com https://connect.facebook.net https://clientstream.launchdarkly.com https://app.launchdarkly.com https://*.lllapps.com https://*.lllapi.com https://www.googletagmanager.com https://www.google-analytics.com https://www.googleadservices.com https://www.google.com https://maps.gstatic.com https://fonts.gstatic.com https://www.gstatic.com https://adservice.google.com https://adservice.google.ca https://www.google.ca https://fonts.googleapis.com https://maps.googleapis.com https://googleads.g.doubleclick.net https://cdn.ravenjs.com https://*.bazaarvoice.com https://*.akamaihd.net https://cm.everesttech.net https://cm.g.doubleclick.net https://stats.g.doubleclick.net https://bid.g.doubleclick.net https://ads.celtra.com https://scripts.agilone.com https://vsvipmw01.rightnowtech.com https://*.quantummetric.com https://ad.doubleclick.net https://events.launchdarkly.com https://track.celtra.com https://ads-twitter.com https://www.youtube.com https://*.paypal.com https://www.paypalobjects.com https://rlcdn.com https://di.rlcdn.com https://s.pinimg.com https://yimg.com https://analytics.yahoo.com https://static.ads-twitter.com https://analytics.twitter.com https://t.co https://ct.pinterest.com https://beacon.lynx.cognitivlabs.com https://scene7.com https://s.ytimg.com https://s.yimg.com https://prf.hn https://ln-rules.rewardstyle.com https://*.curalate.com https://d28m5bx785ox17.cloudfront.net https://d2i1u3dt4wjv23.cloudfront.net https://sp.analytics.yahoo.com https://analytics.google.com https://mpsnare.iesnare.com https://shopstylecollective.com https://flex.cybersource.com https://*.browser-intake-datadoghq.com https://www.datadoghq-browser-agent.com https://browser-intake-datadoghq.com https://lululemon.my.site.com https://lululemon.my.salesforce-scrt.com https://login.klarna.com https://mgln.ai https://cdn.mgln.ai https://us.mgln.ai https://eu.mgln.ai https://lululemon-com.dlp.retail.adeptmind.net https://raven.adeptmind.ai https://pixel.tapad.com https://www.redditstatic.com https://alb.reddit.com https://pixel-config.reddit.com https://ade.googlesyndication.com https://pagead2.googlesyndication.com https://dwin1.com https://awin1.com https://zenaps.com https://www.wepowerconnections.com https://rts.persado.com https://cdn.persa.do https://cdn.persado.com https://web.btncdn.com https://api.usebutton.com https://web.usebutton.com https://*.kameleoon.com https://*.kameleoon.io https://*.kameleoon.eu https://ecommwidget.trurating.com https://fonts.googleapis.com https://ecommapi.trurating.com https://fonts.gstatic.com https://amazon-adsystem.com https://*.amazon-adsystem.com https://paa-reporting-advertising.amazon https://*.paa-reporting-advertising.amazon https://m.media-amazon.com https://fls-na.amazon.com https://us.engage.app https://eu.engage.app https://talkative-cdn.com https://sockjs-us2.pusher.com https://pixel.byspotify.com https://pixels.spotify.com https://sockjs-eu.pusher.com https://*.daily.co https://osm.klarnaservices.com https://onelinksmartscript.appsflyer.com https://impressions.onelink.me https://lululemon.onelink.me https://static.experimentation.dev https://sdk-config.experimentation.dev https://eu-data.experiment.dev wss://ws-us2.pusher.com wss://ws-eu.pusher.com wss://*.wss.daily.co; base-uri 'self'; frame-ancestors 'self'; object-src 'none'; block-all-mixed-content;

X-Frame-Options

SAMEORIGIN

X-Content-Type-Options

nosniff

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

Not Detected

Google Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.

GTM container detected (GTM-PKLTKG52) but no consent mode initialisation found. Add gtag('consent', 'default', ...) before your GTM snippet.

Post-Rejection Audit

Reject Button

Found

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

1651ms pre-consent

Google Tag Manager(GTM-PKLTKG52)

Loaded 1651ms after page load — before the consent banner was detected (banner appeared at 9464ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

No tracking vendors detected firing after rejection

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

Found: OptanonConsent (OneTrust)

Record contains timestamp

Art. 7(1)

Timestamp field detected

Record contains consent state

Art. 7(1)

Accept/reject state detected

Record contains consent categories

Art. 7(1)

Consent categories (analytics, marketing, etc.) not found in record

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising11 vendors
Analytics9 vendors
Marketing8 vendors
Security2
Functional3 vendors
Tag Management1 vendor
Critical42

Data was transmitted to a third-party or storage was written on the user’s device before consent. This is a GDPR/ePrivacy violation, not just a script load.

Google (Tracker Tracker)
Google (Tracker Tracker)2 findingsID tracked

stats.g.doubleclick.net, cm.g.doubleclick.net

Google (Tracker Tracker)
criticalNetworkGoogle (Tracker Tracker)

Google (tracker) loaded before consent

ID: G-4ZRJ21056FHost: stats.g.doubleclick.netFired: 3343ms after load
Google (Tracker Tracker)
criticalNetworkGoogle (Tracker Tracker)

Google (tracker) loaded before consent

Host: cm.g.doubleclick.netFired: 3547ms after load
Google Analytics
Google Analytics3 findingsID tracked

region1.analytics.google.com, _ga_4ZRJ21056F, _ga

GA4
criticalNetworkAnalyticsGA4

GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics

ID: G-4ZRJ21056FHost: region1.analytics.google.comFired: 3345ms after load
Google Analytics
criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_4ZRJ21056F" set before consent

Cookie: _ga_4ZRJ21056FDomain: .lululemon.com
Google Analytics
criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga" set before consent

Cookie: _gaDomain: .lululemon.com
TikTok Pixel
TikTok Pixel2 findingsID tracked

analytics.tiktok.com, _ttp

TikTok Pixel
criticalNetworkAdvertisingTikTok Pixel

TikTok Pixel (TikTok) loaded before consent: Sends event data to TikTok for ad measurement

ID: C65BFLPR48GN82KJE2E0Host: analytics.tiktok.comFired: 5576ms after load
TikTok Pixel
criticalCookieAdvertisingTikTok Pixel

TikTok Pixel cookie "_ttp" set before consent

Cookie: _ttpDomain: shop.lululemon.com
Pinterest Tag
criticalNetworkAdvertisingPinterest Tag

Pinterest Tag (Pinterest) loaded before consent: Pinterest conversion tracking

ID: 2618544343479Host: ct.pinterest.comFired: 5688ms after load
Meta Pixel
Meta Pixel2 findingsID tracked

www.facebook.com, _fbp

Meta Pixel
criticalNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded before consent: Meta Pixel tracking endpoint

ID: 101066786912261Host: www.facebook.comFired: 5696ms after load
Meta Pixel
criticalCookieAdvertisingMeta Pixel

Meta Pixel cookie "_fbp" set before consent

Cookie: _fbpDomain: shop.lululemon.com
Kameleoon (Advertising Tracker)
Kameleoon (Advertising Tracker)2 findings

sdkwhd4nja.kameleoon.io, na-data.kameleoon.io

Kameleoon (Advertising Tracker)
criticalNetworkAdvertisingKameleoon (Advertising Tracker)

Kameleoon (advertising) loaded before consent

Host: sdkwhd4nja.kameleoon.ioFired: 323ms after load
Kameleoon (Advertising Tracker)
criticalNetworkAdvertisingKameleoon (Advertising Tracker)

Kameleoon (advertising) loaded before consent

Host: na-data.kameleoon.ioFired: 3573ms after load
DataDog (Analytics Tracker)
DataDog (Analytics Tracker)2 findings

www.datadoghq-browser-agent.com, browser-intake-datadoghq.com

DataDog (Analytics Tracker)
criticalNetworkAnalyticsDataDog (Analytics Tracker)

DataDog (analytics) loaded before consent

Host: www.datadoghq-browser-agent.comFired: 345ms after load
DataDog (Analytics Tracker)
criticalNetworkAnalyticsDataDog (Analytics Tracker)

DataDog (analytics) loaded before consent

Host: browser-intake-datadoghq.comFired: 6658ms after load
Adobe (Tracker Tracker)
Adobe (Tracker Tracker)3 findings

dpm.demdex.net, lululemonathleticacanadainc.demdex.net, cm.everesttech.net

Adobe (Tracker Tracker)
criticalNetworkAdobe (Tracker Tracker)

Adobe (tracker) loaded before consent

Host: dpm.demdex.netFired: 2552ms after load
Adobe (Tracker Tracker)
criticalNetworkAdobe (Tracker Tracker)

Adobe (tracker) loaded before consent

Host: lululemonathleticacanadainc.demdex.netFired: 3357ms after load
Adobe (Tracker Tracker)
criticalNetworkAdobe (Tracker Tracker)

Adobe (tracker) loaded before consent

Host: cm.everesttech.netFired: 3372ms after load
Dstillery (Advertising Tracker)
criticalNetworkAdvertisingDstillery (Advertising Tracker)

Dstillery (advertising) loaded before consent

Host: idpix.media6degrees.comFired: 3673ms after load
Awin (Tracker Tracker)
criticalNetworkAwin (Tracker Tracker)

Awin (tracker) loaded before consent

Host: www.dwin1.comFired: 4448ms after load
Advertising Tracker
Advertising Tracker2 findings

web.btncdn.com, lantern.roeye.com

Advertising Tracker
criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at web.btncdn.com loaded before consent

Host: web.btncdn.comFired: 4448ms after load
Advertising Tracker
criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at lantern.roeye.com loaded before consent

Host: lantern.roeye.comFired: 4745ms after load
Acceleration Partners (Analytics Tracker)
criticalNetworkAnalyticsAcceleration Partners (Analytics Tracker)

Acceleration Partners (analytics) loaded before consent

Host: lantern.roeyecdn.comFired: 4657ms after load
Button (Advertising Tracker)
criticalNetworkAdvertisingButton (Advertising Tracker)

Button (advertising) loaded before consent

Host: web.usebutton.comFired: 5284ms after load
Snapchat Pixel
Snapchat Pixel2 findings

tr.snapchat.com, _scid

Snapchat Pixel
criticalNetworkAdvertisingSnapchat Pixel

Snapchat Pixel (Snapchat) loaded before consent: Snapchat pixel tracking endpoint

Host: tr.snapchat.comFired: 5592ms after load
Snapchat Pixel
criticalCookieAdvertisingSnapchat Pixel

Snapchat Pixel cookie "_scid" set before consent

Cookie: _scidDomain: shop.lululemon.com
BlueTriangle (Analytics Tracker)
criticalNetworkAnalyticsBlueTriangle (Analytics Tracker)

BlueTriangle (analytics) loaded before consent

Host: lululemon.btttag.comFired: 6658ms after load
Adobe Audience Manager
Adobe Audience Manager4 findings

demdex, AMCVS_A92B3BC75245B1030A490D4D%40AdobeOrg, dpm, dextp

Adobe Audience Manager
criticalCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "demdex" set before consent — Unique value with which Audience Manager can identify a user. Used, among others, for identification, segmentation, modeling and reporting purposes.

Cookie: demdexDomain: .demdex.netRetention: 180 days after last activity or 10 years when opting out
Adobe Audience Manager
criticalCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "AMCVS_A92B3BC75245B1030A490D4D%40AdobeOrg" set before consent — The AMCVS cookie serves as a flag indicating that the session has been initialized. Its value is always 1 and discontinues when the session has ended.

Cookie: AMCVS_A92B3BC75245B1030A490D4D%40AdobeOrgDomain: .lululemon.comRetention: Session
Adobe Audience Manager
criticalCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "dpm" set before consent — DPM is an abbreviation for Data Provider Match. It tells internal, Adobe systems that a call from Audience Manager or the Adobe Experience Cloud ID Service is passing in customer data for synchronization or requesting an ID.

Cookie: dpmDomain: .dpm.demdex.netRetention: 180 days
Adobe Audience Manager
criticalCookieMarketingAdobe Audience Manager

Adobe Audience Manager cookie "dextp" set before consent — Registers the date plus time (timestamp) on which a data synchronization was last performed by the Audience Manager.

Cookie: dextpDomain: .demdex.netRetention: 180 days after last activity
Adobe Advertising
criticalCookieMarketingAdobe Advertising

Adobe Advertising cookie "everest_g_v2" set before consent — This cookie stores the browser and surfer ID.Created after a user initially clicks a client's ad, and used to map the current and subsequent clicks with other events on the client's website

Cookie: everest_g_v2Domain: .everesttech.netRetention: 2 years
DoubleClick/Google Marketing
DoubleClick/Google Marketing2 findings

IDE, ar_debug

DoubleClick/Google Marketing
criticalCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "IDE" set before consent — This cookie is used for targeting, analyzing and optimisation of ad campaigns in DoubleClick/Google Marketing Suite

Cookie: IDEDomain: .doubleclick.netRetention: 2 years
DoubleClick/Google Marketing
criticalCookieMarketingDoubleClick/Google Marketing

DoubleClick/Google Marketing cookie "ar_debug" set before consent — Store and track conversions

Cookie: ar_debugDomain: .pinterest.comRetention: Persistent
Adobe Analytics
Adobe Analytics2 findings

AMCV_A92B3BC75245B1030A490D4D%40AdobeOrg, s_cc

Adobe Analytics
criticalCookieAnalyticsAdobe Analytics

Adobe Analytics cookie "AMCV_A92B3BC75245B1030A490D4D%40AdobeOrg" set before consent

Cookie: AMCV_A92B3BC75245B1030A490D4D%40AdobeOrgDomain: .lululemon.com
Adobe Analytics
criticalCookieAnalyticsAdobe Analytics

Adobe Analytics cookie "s_cc" set before consent

Cookie: s_ccDomain: .lululemon.com
criticalCookieMarketingAwin

Awin cookie "lantern" set before consent — This cookie is used by the affiliate marketing platform AWIN to store a reference to a visit to attribute a sale to marketing channels.

Cookie: lanternDomain: .lululemon.comRetention: Awin
Segment
Segment3 findings

ajs_anonymous_id, ajs_user_id

Segment
criticalCookieAnalyticsSegment

Segment cookie "ajs_anonymous_id" set before consent

Cookie: ajs_anonymous_idDomain: .lululemon.com
Segment
criticalStorageAnalyticsSegment

Segment (Twilio) wrote "ajs_anonymous_id" to localStorage before consent

Key: ajs_anonymous_idType: localStorageFired: 5381ms after load
Segment
criticalStorageAnalyticsSegment

Segment (Twilio) wrote "ajs_user_id" to localStorage before consent

Key: ajs_user_idType: localStorageFired: 5385ms after load
Pinterest
criticalCookieMarketingPinterest

Pinterest cookie "_pinterest_ct_ua" set before consent — This cookieis a third party cookie which groups actions for users who cannot be identified by Pinterest.

Cookie: _pinterest_ct_uaDomain: .ct.pinterest.comRetention: session
Google Ads
criticalStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage before consent

Key: _gcl_lsType: localStorageFired: 3418ms after load
criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings69

A tag container or script loaded before consent but tags appear correctly gated (e.g. GTM with Consent Mode v2). Not a violation on its own — review to confirm downstream tags stay blocked.

Google Tag Manager
Google Tag Manager2 findingsID tracked

www.googletagmanager.com

Google Tag Manager
warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager (Google) loaded before consent: Loads the GTM container which may trigger other tags

ID: GTM-PKLTKG52Host: www.googletagmanager.comFired: 1495ms after load
Google Tag Manager
warningGTMTag ManagementGoogle Tag Manager

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-PKLTKG52)

LaunchDarkly
warningNetworkAnalyticsLaunchDarkly

LaunchDarkly (LaunchDarkly) loaded before consent: LaunchDarkly feature flag management

Host: app.launchdarkly.comFired: 4471ms after load
vendor logo
warningNetwork

Unknown third-party request to assets.adobedtm.com before consent

Host: assets.adobedtm.comFired: 344ms after load
vendor logo
warningNetwork

Unknown third-party request to mr-proxy.digital-analytics.lllapi.com before consent

Host: mr-proxy.digital-analytics.lllapi.comFired: 5827ms after load
warningStorage

localStorage key "undefined" written before consent

Key: undefinedType: localStorageFired: 1436ms after load
warningStorage

localStorage key "__anon_id" written before consent

Key: __anon_idType: localStorageFired: 1458ms after load
warningStorage

localStorage key "kameleoonAudiencePartition" written before consent

Key: kameleoonAudiencePartitionType: localStorageFired: 1546ms after load
warningStorage

sessionStorage key "lll-kameleoonData" written before consent

Key: lll-kameleoonDataType: sessionStorageFired: 1547ms after load
warningStorage

localStorage key "dummy" written before consent

Key: dummyType: localStorageFired: 2181ms after load
warningStorage

localStorage key "ak_a" written before consent

Key: ak_aType: localStorageFired: 2294ms after load
warningStorage

sessionStorage key "sessionId" written before consent

Key: sessionIdType: sessionStorageFired: 2319ms after load
warningStorage

localStorage key "__user_traits" written before consent

Key: __user_traitsType: localStorageFired: 2331ms after load
warningStorage

localStorage key "com.adobe.reactor.dataElements.geoIpState" written before consent

Key: com.adobe.reactor.dataElements.geoIpStateType: localStorageFired: 2478ms after load
warningStorage

sessionStorage key "com.adobe.reactor.core.visitorTracking.landingPage" written before consent

Key: com.adobe.reactor.core.visitorTracking.landingPageType: sessionStorageFired: 2500ms after load
warningStorage

sessionStorage key "com.adobe.reactor.core.visitorTracking.trafficSource" written before consent

Key: com.adobe.reactor.core.visitorTracking.trafficSourceType: sessionStorageFired: 2500ms after load
warningStorage

localStorage key "analyticsHost" written before consent

Key: analyticsHostType: localStorageFired: 2517ms after load
warningStorage

localStorage key "analyticsPath" written before consent

Key: analyticsPathType: localStorageFired: 2517ms after load
warningStorage

localStorage key "__akfp_storage_test__" written before consent

Key: __akfp_storage_test__Type: localStorageFired: 2631ms after load
warningStorage

localStorage key "alpineRequested" written before consent

Key: alpineRequestedType: localStorageFired: 3418ms after load
warningStorage

sessionStorage key "kameleoonTabId" written before consent

Key: kameleoonTabIdType: sessionStorageFired: 3550ms after load
warningStorage

sessionStorage key "aLaunch_eid" written before consent

Key: aLaunch_eidType: sessionStorageFired: 3552ms after load
warningStorage

sessionStorage key "aLaunch_eidPre" written before consent

Key: aLaunch_eidPreType: sessionStorageFired: 3552ms after load
warningStorage

localStorage key "kameleoonData-sdkwhd4nja" written before consent

Key: kameleoonData-sdkwhd4njaType: localStorageFired: 3556ms after load
warningStorage

localStorage key "kameleoonExperiment-306608" written before consent

Key: kameleoonExperiment-306608Type: localStorageFired: 3556ms after load
warningStorage

localStorage key "kameleoonLegalConsent" written before consent

Key: kameleoonLegalConsentType: localStorageFired: 3564ms after load
warningStorage

localStorage key "kameleoonLiveCampaignsConfiguration" written before consent

Key: kameleoonLiveCampaignsConfigurationType: localStorageFired: 3630ms after load
warningStorage

sessionStorage key "aLaunch_pageInfo" written before consent

Key: aLaunch_pageInfoType: sessionStorageFired: 4404ms after load
warningStorage

localStorage key "okta-test-storage" written before consent

Key: okta-test-storageType: localStorageFired: 4462ms after load
warningStorage

sessionStorage key "lll-nav-history" written before consent

Key: lll-nav-historyType: sessionStorageFired: 4498ms after load
warningStorage

sessionStorage key "btn_js_site_page_view_count" written before consent

Key: btn_js_site_page_view_countType: sessionStorageFired: 4604ms after load
warningStorage

localStorage key "persisted-queue:v1:lululemon_prod:event-queue:lock" written before consent

Key: persisted-queue:v1:lululemon_prod:event-queue:lockType: localStorageFired: 5204ms after load
warningStorage

localStorage key "persisted-queue:v1:dest-meta.io:lock" written before consent

Key: persisted-queue:v1:dest-meta.io:lockType: localStorageFired: 5350ms after load
warningStorage

sessionStorage key "btn_js_sms_campaign" written before consent

Key: btn_js_sms_campaignType: sessionStorageFired: 5716ms after load
warningStorage

sessionStorage key "lastLocale" written before consent

Key: lastLocaleType: sessionStorageFired: 5781ms after load
warningStorage

localStorage key "okta-token-storage" written before consent

Key: okta-token-storageType: localStorageFired: 6624ms after load
warningStorage

localStorage key "lll-auth-state" written before consent

Key: lll-auth-stateType: localStorageFired: 6626ms after load
warningStorage

localStorage key "lululemon-campSource" written before consent

Key: lululemon-campSourceType: localStorageFired: 6899ms after load
warningStorage

localStorage key "lululemon-campMedium" written before consent

Key: lululemon-campMediumType: localStorageFired: 6900ms after load
warningStorage

localStorage key "BTT_X0siD" written before consent

Key: BTT_X0siDType: localStorageFired: 6909ms after load
warningStorage

localStorage key "BTT_Collect" written before consent

Key: BTT_CollectType: localStorageFired: 6909ms after load
warningStorage

localStorage key "lululemon-campaign" written before consent

Key: lululemon-campaignType: localStorageFired: 6913ms after load
warningStorage

localStorage key "BTT_WCD_Collect" written before consent

Key: BTT_WCD_CollectType: localStorageFired: 6915ms after load
warningStorage

localStorage key "BTT_ERR_COLLECT" written before consent

Key: BTT_ERR_COLLECTType: localStorageFired: 6915ms after load
warningStorage

localStorage key "lll-isSessionRefreshing" written before consent

Key: lll-isSessionRefreshingType: localStorageFired: 6956ms after load
warningStorage

sessionStorage key "aLaunch_lam" written before consent

Key: aLaunch_lamType: sessionStorageFired: 6998ms after load
warningStorage

sessionStorage key "ak_bm_tab_id" written before consent

Key: ak_bm_tab_idType: sessionStorageFired: 7029ms after load
warningStorage

sessionStorage key "_A4LOnload" written before consent

Key: _A4LOnloadType: sessionStorageFired: 7232ms after load
warningStorage

localStorage key "okta-refresh-cookie-inspected" written before consent

Key: okta-refresh-cookie-inspectedType: localStorageFired: 7368ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.isBuyNowFlow" written before consent

Key: com.adobe.reactor.dataElements.isBuyNowFlowType: sessionStorageFired: 7373ms after load
warningStorage

sessionStorage key "aLaunch_pageInfo_previous" written before consent

Key: aLaunch_pageInfo_previousType: sessionStorageFired: 7373ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.privacyIsDoNotTarget" written before consent

Key: com.adobe.reactor.dataElements.privacyIsDoNotTargetType: sessionStorageFired: 7845ms after load
warningStorage

localStorage key "aLaunch_userData" written before consent

Key: aLaunch_userDataType: localStorageFired: 7850ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.searchResultsCount" written before consent

Key: com.adobe.reactor.dataElements.searchResultsCountType: sessionStorageFired: 7850ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.searchID" written before consent

Key: com.adobe.reactor.dataElements.searchIDType: sessionStorageFired: 7851ms after load
warningStorage

localStorage key "com.adobe.reactor.dataElements.userHashedEmail" written before consent

Key: com.adobe.reactor.dataElements.userHashedEmailType: localStorageFired: 7851ms after load
warningStorage

localStorage key "com.adobe.reactor.dataElements.userID" written before consent

Key: com.adobe.reactor.dataElements.userIDType: localStorageFired: 7851ms after load
warningStorage

localStorage key "com.adobe.reactor.dataElements.vendorSFMCID" written before consent

Key: com.adobe.reactor.dataElements.vendorSFMCIDType: localStorageFired: 7851ms after load
warningStorage

sessionStorage key "aLaunch_adobeSessionId" written before consent

Key: aLaunch_adobeSessionIdType: sessionStorageFired: 7856ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.adobeSessionId" written before consent

Key: com.adobe.reactor.dataElements.adobeSessionIdType: sessionStorageFired: 7856ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.weatherInfo" written before consent

Key: com.adobe.reactor.dataElements.weatherInfoType: sessionStorageFired: 7895ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.vendorOneTrustConsentId" written before consent

Key: com.adobe.reactor.dataElements.vendorOneTrustConsentIdType: sessionStorageFired: 7895ms after load
warningStorage

sessionStorage key "aLaunch_previousPageURL" written before consent

Key: aLaunch_previousPageURLType: sessionStorageFired: 7959ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.privacyIsDoNotSell" written before consent

Key: com.adobe.reactor.dataElements.privacyIsDoNotSellType: sessionStorageFired: 8046ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.vendorGoogleClientID" written before consent

Key: com.adobe.reactor.dataElements.vendorGoogleClientIDType: sessionStorageFired: 8048ms after load
warningStorage

sessionStorage key "com.adobe.reactor.dataElements.entryPageReferringURL" written before consent

Key: com.adobe.reactor.dataElements.entryPageReferringURLType: sessionStorageFired: 8049ms after load
warningStorage

localStorage key "kameleoonExperiment-334250" written before consent

Key: kameleoonExperiment-334250Type: localStorageFired: 8062ms after load
warningStorage

sessionStorage key "lll-welcome-offer-session" written before consent

Key: lll-welcome-offer-sessionType: sessionStorageFired: 9060ms after load
warningStorage

localStorage key "lll-welcome-offer-sessions" written before consent

Key: lll-welcome-offer-sessionsType: localStorageFired: 9060ms after load
Info10

Neutral observations — activity we detected that isn’t a violation but is useful context (e.g. essential cookies, CMP initialisation).

Google (Cdn)
infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

ID: G-4ZRJ21056FHost: www.google.nlFired: 3345ms after load
OneTrust
OneTrust2 findings

cdn.cookielaw.org, OptanonConsent

OneTrust
infoNetworkConsent MgmtOneTrust

OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management

Host: cdn.cookielaw.orgFired: 345ms after load
OneTrust
infoCookieConsent MgmtOneTrust

OneTrust cookie "OptanonConsent" set before consent

Cookie: OptanonConsentDomain: .lululemon.com
OneTrust CMP
infoNetworkConsent MgmtOneTrust CMP

OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location

Host: geolocation.onetrust.comFired: 2935ms after load
Microsoft (Cdn)
infoNetworkMicrosoft (Cdn)

Microsoft (cdn) loaded before consent

Host: c.bing.comFired: 5624ms after load
Adobe (Cdn)
infoNetworkAdobe (Cdn)

Adobe (cdn) loaded before consent

Host: s7mbrstream.scene7.comFired: 6942ms after load
Adobe Analytics
infoCookieFunctionalAdobe Analytics

Adobe Analytics cookie "sat_track" set before consent — The sat_track cookie is a part of Adobe Analytics. It controls the enabling and disabling of cookies and whether they are loaded onto the site.

Cookie: sat_trackDomain: shop.lululemon.comRetention: 90 days
infoCookieFunctional

Akamai bot manager — necessary for site protection

Cookie: _abckDomain: .lululemon.com
infoCookieFunctional

Akamai bot management session — necessary for site protection

Cookie: ak_bmscDomain: .lululemon.com
infoCookieFunctional

Akamai bot management — necessary for site protection

Cookie: bm_svDomain: .lululemon.com
Compliant34

Tags that fired only after the user gave consent — working as intended.

TikTok Pixel
TikTok Pixel7 findingsID tracked

analytics.tiktok.com, analytics-ipv6.tiktokw.us, _ttp, _tt_enable_cookie, tt_sessionId, tt_appInfo, tt_pixel_session_index

TikTok Pixel
CompliantNetworkAdvertisingTikTok Pixel

TikTok Pixel (TikTok) loaded correctly after consent

ID: C65BFLPR48GN82KJE2E0Host: analytics.tiktok.comFired: 2626ms after load
TikTok Pixel
CompliantNetworkAdvertisingTikTok Pixel

TikTok Pixel (TikTok) loaded correctly after consent

Host: analytics-ipv6.tiktokw.usFired: 4709ms after load
TikTok Pixel
CompliantCookieAdvertisingTikTok Pixel

TikTok Pixel cookie "_ttp" set correctly after consent

Cookie: _ttpDomain: .lululemon.com
TikTok Pixel
CompliantCookieAdvertisingTikTok Pixel

TikTok Pixel cookie "_tt_enable_cookie" set correctly after consent

Cookie: _tt_enable_cookieDomain: .lululemon.com
TikTok Pixel
CompliantStorageAdvertisingTikTok Pixel

TikTok Pixel (TikTok) wrote "tt_sessionId" to sessionStorage correctly after consent

Key: tt_sessionIdType: sessionStorageFired: 4515ms after load
TikTok Pixel
CompliantStorageAdvertisingTikTok Pixel

TikTok Pixel (TikTok) wrote "tt_appInfo" to sessionStorage correctly after consent

Key: tt_appInfoType: sessionStorageFired: 4524ms after load
TikTok Pixel
CompliantStorageAdvertisingTikTok Pixel

TikTok Pixel (TikTok) wrote "tt_pixel_session_index" to sessionStorage correctly after consent

Key: tt_pixel_session_indexType: sessionStorageFired: 4525ms after load
Pinterest Tag
Pinterest Tag3 findingsID tracked

ct.pinterest.com, s.pinimg.com, _pin_unauth

Pinterest Tag
CompliantNetworkAdvertisingPinterest Tag

Pinterest Tag (Pinterest) loaded correctly after consent

ID: 2618544343479Host: ct.pinterest.comFired: 4346ms after load
Pinterest Tag
CompliantNetworkAdvertisingPinterest Tag

Pinterest Tag (Pinterest) loaded correctly after consent

Host: s.pinimg.comFired: 2629ms after load
Pinterest Tag
CompliantCookieAdvertisingPinterest Tag

Pinterest Tag cookie "_pin_unauth" set correctly after consent

Cookie: _pin_unauthDomain: .shop.lululemon.com
Meta Pixel
Meta Pixel2 findings

connect.facebook.net, _fbp

Meta Pixel
CompliantNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded correctly after consent

Host: connect.facebook.netFired: 2626ms after load
Meta Pixel
CompliantCookieAdvertisingMeta Pixel

Meta Pixel cookie "_fbp" set correctly after consent

Cookie: _fbpDomain: .lululemon.com
Microsoft Ads
Microsoft Ads3 findings

bat.bing.com, _uetvid, _uetsid

Microsoft Ads
CompliantNetworkAdvertisingMicrosoft Ads

Microsoft Ads (Microsoft) loaded correctly after consent

Host: bat.bing.comFired: 2629ms after load
Microsoft Ads
CompliantCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetvid" set correctly after consent

Cookie: _uetvidDomain: .lululemon.com
Microsoft Ads
CompliantCookieAdvertisingMicrosoft Ads

Microsoft Ads cookie "_uetsid" set correctly after consent

Cookie: _uetsidDomain: .lululemon.com
Snapchat Pixel
Snapchat Pixel4 findings

sc-static.net, tr.snapchat.com, _scid, _scid_r

Snapchat Pixel
CompliantNetworkAdvertisingSnapchat Pixel

Snapchat Pixel (Snapchat) loaded correctly after consent

Host: sc-static.netFired: 2629ms after load
Snapchat Pixel
CompliantNetworkAdvertisingSnapchat Pixel

Snapchat Pixel (Snapchat) loaded correctly after consent

Host: tr.snapchat.comFired: 4297ms after load
Snapchat Pixel
CompliantCookieAdvertisingSnapchat Pixel

Snapchat Pixel cookie "_scid" set correctly after consent

Cookie: _scidDomain: .lululemon.com
Snapchat Pixel
CompliantCookieAdvertisingSnapchat Pixel

Snapchat Pixel cookie "_scid_r" set correctly after consent

Cookie: _scid_rDomain: .lululemon.com
Google Ads
Google Ads4 findings

www.google.com, www.googleadservices.com, googleads.g.doubleclick.net, _gcl_au

Google Ads
CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: www.google.comFired: 2638ms after load
Google Ads
CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: www.googleadservices.comFired: 3959ms after load
Google Ads
CompliantNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded correctly after consent

Host: googleads.g.doubleclick.netFired: 4306ms after load
Google Ads
CompliantCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set correctly after consent

Cookie: _gcl_auDomain: .lululemon.com
Reddit Pixel
Reddit Pixel2 findings

alb.reddit.com, _rdt_uuid

Reddit Pixel
CompliantNetworkAdvertisingReddit Pixel

Reddit Pixel (Reddit) loaded correctly after consent

Host: alb.reddit.comFired: 3828ms after load
Reddit Pixel
CompliantCookieAdvertisingReddit Pixel

Reddit Pixel cookie "_rdt_uuid" set correctly after consent

Cookie: _rdt_uuidDomain: .lululemon.com
Adobe Analytics
CompliantCookieAnalyticsAdobe Analytics

Adobe Analytics cookie "s_sq" set correctly after consent

Cookie: s_sqDomain: .lululemon.com
Snapchat
CompliantCookieFunctionalSnapchat

Snapchat cookie "X-AB" set correctly after consent

Cookie: X-ABDomain: sc-static.netRetention: 1 day
Marfeel
CompliantCookieAnalyticsMarfeel

Marfeel cookie "_sfid_cc29" set correctly after consent

Cookie: _sfid_cc29Domain: .shop.lululemon.comRetention: Session
Bing / Microsoft
CompliantCookieMarketingBing / Microsoft

Bing / Microsoft cookie "MUID" set correctly after consent

Cookie: MUIDDomain: .bing.comRetention: 1 year
Amazon
Amazon2 findings

ad-id, ad-privacy

Amazon
CompliantCookieMarketingAmazon

Amazon cookie "ad-id" set correctly after consent

Cookie: ad-idDomain: .amazon-adsystem.comRetention: 190 days
Amazon
CompliantCookieMarketingAmazon

Amazon cookie "ad-privacy" set correctly after consent

Cookie: ad-privacyDomain: .amazon-adsystem.comRetention: 5 years
TikTok
TikTok2 findings

ttcsid_C65BFLPR48GN82KJE2E0, ttcsid

TikTok
CompliantCookieMarketingTikTok

TikTok cookie "ttcsid_C65BFLPR48GN82KJE2E0" set correctly after consent

Cookie: ttcsid_C65BFLPR48GN82KJE2E0Domain: .lululemon.comRetention: 1 year
TikTok
CompliantCookieMarketingTikTok

TikTok cookie "ttcsid" set correctly after consent

Cookie: ttcsidDomain: .lululemon.comRetention: 1 year
Amazon Web Services
CompliantCookieFunctionalAmazon Web Services

Amazon Web Services cookie "AWSALBTGCORS" set correctly after consent

Cookie: AWSALBTGCORSDomain: lululemoncanada.us-4.evergage.comRetention: Session

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan lululemon.com

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com