Mercari Cookie Compliance Report

Mercari

mercari.com

Compare

https://mercari.com

Scanned Apr 15, 2026 · 33.0s

Your website score is

0/100

Critical

Grade

BannerConsent Banner

Yes

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 56 user data leaks before consent on mercari.com, including TrustARC (Tracker Tracker), Microsoft Ads, Meta Pixel and 6 more.

Security Headers

3/6 present

Strict-Transport-Security

max-age=31536000

Content-Security-Policy

Add a Content-Security-Policy header to prevent XSS and code injection attacks

X-Frame-Options

SAMEORIGIN

X-Content-Type-Options

Set X-Content-Type-Options to 'nosniff' to prevent MIME type sniffing

Referrer-Policy

no-referrer

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation

Google Consent Mode

55/100

GTM Containers:GTM-MSDTXHX

Consent Parameters

ParameterDefaultUpdated

Ad Storagenot_setnot_set

Ad User Datanot_setnot_set

Ad Personalizationnot_setnot_set

Analytics Storagenot_setnot_set

Functionality Storagenot_setnot_set

Personalization Storagenot_setnot_set

Security Storagenot_setnot_set

Issues (2)

No default consent call detected — consent mode may not be initialised correctly

Google Consent Mode v1 detected — upgrade to v2 (requires ad_user_data and ad_personalization parameters)

Post-Rejection Audit

Reject Button

Missing

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

1002ms pre-consent

Google Tag Manager(GTM-MSDTXHX)

Loaded 1002ms after page load — before the consent banner was detected (banner appeared at 8401ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

No consent record written — cannot prove consent was given

No CMP consent cookie or localStorage entry was found after the consent interaction. GDPR requires controllers to demonstrate consent was given.

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

Cookie settings link / floating button found

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising4 vendors

Analytics6 vendors

Marketing1 vendor

Security3

Functional3 vendors

Tag Management1 vendor

Critical19

Google Analytics3 findingsID tracked

region1.google-analytics.com, _ga_DJ5N7E6D07, _ga

criticalNetworkAnalyticsGA4

GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics

ID: G-DJ5N7E6D07Host: region1.google-analytics.comFired: 3620ms after load

criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_DJ5N7E6D07" set before consent

Cookie: _ga_DJ5N7E6D07Domain: .mercari.com

criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga" set before consent

Cookie: _gaDomain: .mercari.com

Meta Pixel3 findingsID tracked

www.facebook.com, connect.facebook.net, _fbp

criticalNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded before consent: Meta Pixel tracking endpoint

ID: 332253387150322Host: www.facebook.comFired: 5230ms after load

criticalNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded before consent: Sends user data to Meta for ad targeting and conversion tracking

Host: connect.facebook.netFired: 1257ms after load

criticalCookieAdvertisingMeta Pixel

Meta Pixel cookie "_fbp" set before consent

Cookie: _fbpDomain: .mercari.com

criticalNetworkTrustARC (Tracker Tracker)

TrustARC (tracker) loaded before consent

Host: consent.trustarc.comFired: 814ms after load

criticalNetworkAdvertisingMicrosoft Ads

Microsoft Ads (Microsoft) loaded before consent: Microsoft Ads (Bing) UET conversion tracking

Host: bat.bing.comFired: 1257ms after load

Google Ads3 findings

www.google.com, _gcl_au, _gcl_ls

criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google Consent Mode data collection for ad measurement

Host: www.google.comFired: 1257ms after load

criticalCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set before consent

Cookie: _gcl_auDomain: .mercari.com

criticalStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage before consent

Key: _gcl_lsType: localStorageFired: 1164ms after load

criticalNetworkZip (Tracker Tracker)

Zip (tracker) loaded before consent

Host: cdn.quadpay.comFired: 2195ms after load

Advertising Tracker2 findings

bat.bing.net, privacy-policy.truste.com

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at bat.bing.net loaded before consent

Host: bat.bing.netFired: 4113ms after load

criticalNetworkAdvertisingAdvertising Tracker

advertising tracker at privacy-policy.truste.com loaded before consent

Host: privacy-policy.truste.comFired: 4653ms after load

Braze3 findings

sdk.iad-01.braze.com, ab.storage.deviceId.10e16a16-356e-4541-bbc2-4440b8ba6c7a, ab.storage.sessionId.10e16a16-356e-4541-bbc2-4440b8ba6c7a

criticalNetworkMarketingBraze

Braze (Braze) loaded before consent: Braze customer engagement and marketing automation

Host: sdk.iad-01.braze.comFired: 4379ms after load

criticalCookieAnalyticsBraze

Braze cookie "ab.storage.deviceId.10e16a16-356e-4541-bbc2-4440b8ba6c7a" set before consent — Randomly-generated string used to identify anonymous users, and to differentiate users’ devices and enables device-based messaging.

Cookie: ab.storage.deviceId.10e16a16-356e-4541-bbc2-4440b8ba6c7aDomain: .mercari.comRetention: Unknown

criticalCookieAnalyticsBraze

Braze cookie "ab.storage.sessionId.10e16a16-356e-4541-bbc2-4440b8ba6c7a" set before consent — Randomly-generated string used to determine whether the user is starting a new or existing session to sync messages and calculate session analytics.

Cookie: ab.storage.sessionId.10e16a16-356e-4541-bbc2-4440b8ba6c7aDomain: .mercari.comRetention: Session

criticalConsent

No "reject all" option found — users cannot refuse non-essential cookies (ICO guidance requires this)

criticalConsent Record

No recognizable consent cookie or storage entry detected after interaction — GDPR Article 7(1) requires controllers to demonstrate consent was given (server-side storage cannot be verified)

Warnings39

Google Tag Manager2 findingsID tracked

www.googletagmanager.com

warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager (Google) loaded before consent: Loads the GTM container which may trigger other tags

ID: GTM-MSDTXHXHost: www.googletagmanager.comFired: 859ms after load

warningGTMTag ManagementGoogle Tag Manager

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-MSDTXHX)

warningConsentTrustArc

TrustArc was clicked but no consent storage was written — tags may continue firing as if consent was never given

warningNetwork

Unknown third-party request to u-web-assets.mercdn.net before consent

Host: u-web-assets.mercdn.netFired: 813ms after load

warningNetwork

Unknown third-party request to www.google.com before consent

Host: www.google.comFired: 2203ms after load

warningNetwork

Unknown third-party request to appleid.cdn-apple.com before consent

Host: appleid.cdn-apple.comFired: 2203ms after load

warningNetwork

Unknown third-party request to accounts.google.com before consent

Host: accounts.google.comFired: 2203ms after load

warningNetwork

Unknown third-party request to google.com before consent

Host: google.comFired: 3978ms after load

warningNetwork

Unknown third-party request to u-mercari-images.mercdn.net before consent

Host: u-mercari-images.mercdn.netFired: 5777ms after load

warningNetwork

Unknown third-party request to ingestion.dv.socure.io before consent

Host: ingestion.dv.socure.ioFired: 7050ms after load

warningNetwork

Unknown third-party request to gateway.us.zip.co before consent

Host: gateway.us.zip.coFired: 7141ms after load

warningNetwork

Unknown third-party request to use.fontawesome.com before consent

Host: use.fontawesome.comFired: 7854ms after load

warningStorage

sessionStorage key "__next" written before consent

Key: __nextType: sessionStorageFired: 1556ms after load

warningStorage

sessionStorage key "sentryReplaySession" written before consent

Key: sentryReplaySessionType: sessionStorageFired: 1662ms after load

warningStorage

sessionStorage key "mercari.serverSideRouting" written before consent

Key: mercari.serverSideRoutingType: sessionStorageFired: 2116ms after load

warningStorage

sessionStorage key "mercari.source.URLs" written before consent

Key: mercari.source.URLsType: sessionStorageFired: 2711ms after load

warningStorage

localStorage key "mercari.track.session" written before consent

Key: mercari.track.sessionType: localStorageFired: 3157ms after load

warningStorage

sessionStorage key "__sak" written before consent

Key: __sakType: sessionStorageFired: 3959ms after load

warningStorage

localStorage key "ab.test" written before consent

Key: ab.testType: localStorageFired: 4340ms after load

warningStorage

localStorage key "ab.storage.events.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.events.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 4348ms after load

warningStorage

localStorage key "ab.storage.sessionId.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.sessionId.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 4348ms after load

warningStorage

localStorage key "ab.storage.messagingSessionStart.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.messagingSessionStart.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 4348ms after load

warningStorage

localStorage key "ab.storage.userId.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.userId.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 4355ms after load

warningStorage

localStorage key "ab.storage.deviceId.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.deviceId.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 4361ms after load

warningStorage

localStorage key "ab.storage.lastSdkReq.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.lastSdkReq.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 4367ms after load

warningStorage

localStorage key "ab.storage.lastReqToEndpoint.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.lastReqToEndpoint.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 4367ms after load

warningStorage

localStorage key "lastExternalReferrer" written before consent

Key: lastExternalReferrerType: localStorageFired: 5133ms after load

warningStorage

localStorage key "ab.storage.serverConfig.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.serverConfig.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 5280ms after load

warningStorage

localStorage key "ab.storage.device.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.device.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 5280ms after load

warningStorage

localStorage key "ab.storage.sdk_metadata.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.sdk_metadata.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 5280ms after load

warningStorage

localStorage key "ab.storage.session_id_for_cached_metadata.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.session_id_for_cached_metadata.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 5280ms after load

warningStorage

localStorage key "ab.storage.triggers.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.triggers.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 5283ms after load

warningStorage

localStorage key "ab.storage.triggers.ts.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.triggers.ts.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 5283ms after load

warningStorage

localStorage key "ab.storage.requestAttempts.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.requestAttempts.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 5283ms after load

warningStorage

localStorage key "ab.storage.brazeSyncRetryCount.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.brazeSyncRetryCount.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 7490ms after load

warningStorage

localStorage key "ab.storage.globalRateLimitCurrentTokenCount.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.globalRateLimitCurrentTokenCount.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 7503ms after load

warningStorage

localStorage key "ab.storage.triggerFireInstancesById.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.triggerFireInstancesById.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 7824ms after load

warningStorage

localStorage key "ab.storage.lastDisplayedTriggerTime.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.lastDisplayedTriggerTime.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 7922ms after load

warningStorage

localStorage key "ab.storage.lastDisplayedTriggerTimesById.10e16a16-356e-4541-bbc2-4440b8ba6c7a" written before consent

Key: ab.storage.lastDisplayedTriggerTimesById.10e16a16-356e-4541-bbc2-4440b8ba6c7aType: localStorageFired: 7922ms after load

Info9

infoNetworkAnalyticsCloudflare Web Analytics

Cloudflare Web Analytics (Cloudflare) loaded before consent: Cloudflare Web Analytics beacon — privacy-focused, no cookies

Host: static.cloudflareinsights.comFired: 815ms after load

infoNetworkAnalyticsSentry

Sentry (Sentry) loaded before consent: Sentry error reporting endpoint

Host: o66889.ingest.sentry.ioFired: 1895ms after load

Google (Cdn)2 findings

www.gstatic.com, fonts.gstatic.com

infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: www.gstatic.comFired: 3805ms after load

infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: fonts.gstatic.comFired: 5026ms after load

infoCookieFunctionalBraze

Braze cookie "ab.storage.userId.10e16a16-356e-4541-bbc2-4440b8ba6c7a" set before consent — Used to determine whether the currently logged-in user has changed and to associate events with the current user.

Cookie: ab.storage.userId.10e16a16-356e-4541-bbc2-4440b8ba6c7aDomain: .mercari.comRetention: Unknown

infoCookieFunctionalPrivacyPillar

PrivacyPillar cookie "usprivacy" set before consent — This cookie stores the US privacy string.

Cookie: usprivacyDomain: .mercari.comRetention: 1 year

infoStorageFunctionallocalStorage availability probe

localStorage availability probe (null) wrote "__storage_test__" to localStorage before consent

Key: __storage_test__Type: localStorageFired: 1503ms after load

infoCookieFunctional

Cloudflare challenge clearance — necessary for site access

Cookie: cf_clearanceDomain: .www.mercari.com

infoCookieFunctional

Cloudflare bot management — necessary for site operation

Cookie: __cf_bmDomain: .www.mercari.com

Compliant1

CompliantCookieAnalyticsMarfeel

Marfeel cookie "_s_did" set correctly after consent

Cookie: _s_didDomain: .mercari.comRetention: Session

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan mercari.com →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com