https://metlife.com
Scanned Apr 15, 2026 · 34.8s
Your website score is
Grade
BannerConsent Banner
Yes
Regulatory Compliance
Multi-regulation overview — click any regulation for details
Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.
Tag Leak detected 11 user data leaks before consent on metlife.com, including Osano (Tracker Tracker), Adobe (Tracker Tracker), Adobe Audience Manager and 1 more.
Security Headers
5/6 presentStrict-Transport-Security
max-age=63172000; includeSubdomains;
Content-Security-Policy
frame-ancestors 'self' metlife.pathfactory.com qa.dentalprovider.metlife.com dentalprovider.metlife.com; upgrade-insecure-requests
X-Frame-Options
SAMEORIGIN
X-Content-Type-Options
nosniff
Referrer-Policy
no-referrer-when-downgrade
Permissions-Policy
Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation
Google Consent Mode
V2Consent Parameters
Issues (2)
functionality_storage defaults to "granted" — consider defaulting to "denied"
No GTM container detected — consent mode works best with Google Tag Manager
Post-Rejection Audit
Reject Button
Missing
Post-Rejection Fires
0 vendors
Consent Mode
Not Detected
GTM Load
Not detected
Consent Mode V2: Not Detected
Google Consent Mode was not detected on this site.
Consent Record Audit
Issues detectedConsent record stored after interaction
GDPR Art. 7(1)Found: localStorage:osano_consentmanager_tattles
Record contains timestamp
Art. 7(1)No timestamp found in consent record
Record contains consent state
Art. 7(1)Consent state (accepted/rejected) not found in record
Record contains consent categories
Art. 7(1)Consent categories (analytics, marketing, etc.) not found in record
Consent withdrawal mechanism accessible
GDPR Art. 7(3)No way for users to withdraw consent found on page
No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.
Why this matters
Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.
Tracker categories detected
Critical7
Osano (tracker) loaded before consent
Adobe (tracker) loaded before consent
Adobe Audience Manager2 findingsdemdex, mbox
demdex, mbox
Adobe Audience Manager cookie "demdex" set before consent — Unique value with which Audience Manager can identify a user. Used, among others, for identification, segmentation, modeling and reporting purposes.
Adobe Audience Manager cookie "mbox" set before consent — Adobe Target uses cookies to give website operators the ability to test which online content and offers are more relevant to visitors.
Adobe Analytics cookie "AMCV_DD8D65EC5717A8FA7F000101%40AdobeOrg" set before consent
No "reject all" option found — users cannot refuse non-essential cookies (ICO guidance requires this)
No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)
Warnings6
Unknown third-party request to assets.adobedtm.com before consent
sessionStorage key "mlSessionUUID" written before consent
sessionStorage key "com.adobe.reactor.core.visitorTracking.landingPage" written before consent
sessionStorage key "com.adobe.reactor.core.visitorTracking.trafficSource" written before consent
localStorage key "_1776282798195" written before consent
sessionStorage key "__sak" written before consent
Info2
Google (Cdn)2 findingsmaps.googleapis.com, maps.gstatic.com
maps.googleapis.com, maps.gstatic.com
Google (cdn) loaded before consent
Google (cdn) loaded before consent
Compliant13
Adobe Analytics (Adobe) loaded correctly after consent
Marketo2 findingsmunchkin.marketo.net, _mkto_trk
munchkin.marketo.net, _mkto_trk
Marketo (Adobe) loaded correctly after consent
Marketo cookie "_mkto_trk" set correctly after consent
GA4 (Google) loaded correctly after consent
Google Ads3 findingswww.google.com, _gcl_au, _gcl_ls
www.google.com, _gcl_au, _gcl_ls
Google Ads (Google) loaded correctly after consent
Google Ads cookie "_gcl_au" set correctly after consent
Google Ads (Google) wrote "_gcl_ls" to localStorage correctly after consent
Osano2 findingsosano_consentmanager_uuid, osano_consentmanager
osano_consentmanager_uuid, osano_consentmanager
Osano cookie "osano_consentmanager_uuid" set correctly after consent
Osano cookie "osano_consentmanager" set correctly after consent
DoubleClick/Google Marketing2 findingstest_cookie, IDE
test_cookie, IDE
DoubleClick/Google Marketing cookie "test_cookie" set correctly after consent
DoubleClick/Google Marketing cookie "IDE" set correctly after consent
LinkedIn cookie "vid" set correctly after consent
LiveIntent cookie "lidid" set correctly after consent
Is this your site?
Run a full multi-page scan with monitoring and get detailed remediation steps
Scan metlife.com →This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com