https://ml.com
Scanned Apr 15, 2026 · 36.2s
Your website score is
Grade
BannerConsent Banner
Yes
Regulatory Compliance
Multi-regulation overview — click any regulation for details
Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.
Tag Leak detected 45 user data leaks before consent on ml.com, including Tealium (Tracker Tracker), Advertising Tracker, GA4 and 8 more.
Security Headers
2/6 presentStrict-Transport-Security
max-age=31536000;includeSubDomains
Content-Security-Policy
default-src 'self' *.ml.com *.bankofamerica.com *.bofa.com *.bac-assets.com 1359940.fls.doubleclick.net ad.doubleclick.net adservice.google.com www.glancecdn.net storage.glancecdn.net www.glance.net bofa-prod-presence-1.glance.net bofa-prod-presence-2.glance.net bofa-prod-presence-3.glance.net bofa-prod-presence-4.glance.net bofa-prod-presence-5.glance.net bofa-prod-presence-6.glance.net bofa-prod-presence-7.glance.net bofa-prod-presence-8.glance.net bofa-prod-presence-9.glance.net cobrowse-location.glance.net session-a-1.glance.net session-a-2.glance.net session-a-3.glance.net session-a-4.glance.net session-a-5.glance.net session-a-6.glance.net session-a-7.glance.net session-a-8.glance.net session-a-9.glance.net visitor-cam-aws.glance.net lb-video.glance.net prod-video-a-1.glance.net prod-video-a-2.glance.net prod-video-a-3.glance.net prod-video-a-4.glance.net prod-video-a-5.glance.net prod-video-a-6.glance.net prod-video-a-7.glance.net prod-video-a-8.glance.net prod-video-a-9.glance.net cfvod.kaltura.com d.agkn.com geolocation.onetrust.com platform.linkedin.com platform.twitter.com privacyportal-bofa.my.onetrust.com px.marchex.io snc.marchex.io stats.g.doubleclick.net td.doubleclick.net testdata.coremetrics.com units.knotch.it www.dianomi.com www.google.co.in www.google.com www.googleadservices.com www.googletagmanager.com www.knotch-cdn.com beplic.epsilon.com ct.pinterest.com s.pinimg.com www.redditstatic.com pixel-config.reddit.com alb.reddit.com conversions-config.reddit.com tr.snapchat.com data: blob: wss: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' *.ml.com *.bankofamerica.com *.bofa.com *.bac-assets.com www.googletagmanager.com www.knotch-cdn.com beplic.epsilon.com glance.net beta.glancecdn.net storage.glancecdn.net www.glancecdn.net glancecdn.net cdnstorage.myglance.net cdn-bofa.myglance.net analytics.kaltura.com cdn.cookielaw.org cdnapisec.kaltura.com rw.marchex.io tags.tiqcdn.com www.google-analytics.com www.googleapis.com ct.pinterest.com s.pinimg.com www.redditstatic.com pixel-config.reddit.com alb.reddit.com conversions-config.reddit.com tr.snapchat.com blob: wss: 'unsafe-inline' 'unsafe-eval'; style-src 'self' *.ml.com *.bankofamerica.com *.bofa.com *.bac-assets.com www.googletagmanager.com www.knotch-cdn.com beplic.epsilon.com glance.net beta.glancecdn.net storage.glancecdn.net www.glancecdn.net glancecdn.net cdnstorage.myglance.net cdn-bofa.myglance.net www.redditstatic.com pixel-config.reddit.com alb.reddit.com conversions-config.reddit.com tr.snapchat.com 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' *.ml.com *.bac-assets.com *.bankofamerica.com www.glance.net ; worker-src 'self' blob:;
X-Frame-Options
Add X-Frame-Options header to prevent clickjacking attacks
X-Content-Type-Options
Set X-Content-Type-Options to 'nosniff' to prevent MIME type sniffing
Referrer-Policy
Set a Referrer-Policy header to control how much referrer information is shared
Permissions-Policy
Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation
Google Consent Mode
Not DetectedGoogle Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.
Post-Rejection Audit
Reject Button
Found
Post-Rejection Fires
0 vendors
Consent Mode
Not Detected
GTM Load
Not detected
Consent Mode V2: Not Detected
Google Consent Mode was not detected on this site.
Consent Record Audit
Issues detectedConsent record stored after interaction
GDPR Art. 7(1)Found: OptanonConsent (OneTrust)
Record contains timestamp
Art. 7(1)Timestamp field detected
Record contains consent state
Art. 7(1)Accept/reject state detected
Record contains consent categories
Art. 7(1)Consent categories (analytics, marketing, etc.) not found in record
Consent withdrawal mechanism accessible
GDPR Art. 7(3)No way for users to withdraw consent found on page
No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.
Why this matters
Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.
Tracker categories detected
Critical24
Google Analytics6 findingsID trackedregion1.google-analytics.com, www.google-analytics.com, www.googletagmanager.com, _ga_YKQNXHD8CB, _ga, FPID
region1.google-analytics.com, www.google-analytics.com, www.googletagmanager.com, _ga_YKQNXHD8CB, _ga, FPID
GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics
GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics
GA4 (Google) loaded before consent: Google Analytics gtag.js library
Google Analytics cookie "_ga_YKQNXHD8CB" set before consent
Google Analytics cookie "_ga" set before consent
Google Analytics cookie "FPID" set before consent — Registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator.
Tealium (tracker) loaded before consent
Advertising Tracker6 findingswww.knotch-cdn.com, glassbox-hlx-igw.bankofamerica.com, tilt.bankofamerica.com, td.doubleclick.net, smetrics.bankofamerica.com, units.knotch.it
www.knotch-cdn.com, glassbox-hlx-igw.bankofamerica.com, tilt.bankofamerica.com, td.doubleclick.net, smetrics.bankofamerica.com, units.knotch.it
advertising tracker at www.knotch-cdn.com loaded before consent
advertising tracker at glassbox-hlx-igw.bankofamerica.com loaded before consent
advertising tracker at tilt.bankofamerica.com loaded before consent
advertising tracker at td.doubleclick.net loaded before consent
advertising tracker at smetrics.bankofamerica.com loaded before consent
advertising tracker at units.knotch.it loaded before consent
Google (Tracker Tracker)2 findings1359940.fls.doubleclick.net, ad.doubleclick.net
1359940.fls.doubleclick.net, ad.doubleclick.net
Google (tracker) loaded before consent
Google (tracker) loaded before consent
Adobe (tracker) loaded before consent
Google cookie "SID" set before consent — Download certain Google Tools and save certain preferences, for example the number of search results per page or activation of the SafeSearch Filter. Adjusts the ads that appear in Google Search.
Google Ads cookie "_gcl_au" set before consent
DoubleClick/Google Marketing2 findingsar_debug, IDE
ar_debug, IDE
DoubleClick/Google Marketing cookie "ar_debug" set before consent — Store and track conversions
DoubleClick/Google Marketing cookie "IDE" set before consent — This cookie is used for targeting, analyzing and optimisation of ad campaigns in DoubleClick/Google Marketing Suite
Adobe Audience Manager2 findingsdemdex, mbox
demdex, mbox
Adobe Audience Manager cookie "demdex" set before consent — Unique value with which Audience Manager can identify a user. Used, among others, for identification, segmentation, modeling and reporting purposes.
Adobe Audience Manager cookie "mbox" set before consent — Adobe Target uses cookies to give website operators the ability to test which online content and offers are more relevant to visitors.
Adobe Analytics cookie "AMCV_A9893BC75245B1D70A490D4D%40AdobeOrg" set before consent
No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)
Warnings22
Unknown third-party request to www.ml.bac-assets.com before consent
Unknown third-party request to scripts-olui2.fs.ml.bac-assets.com before consent
Unknown third-party request to secure.bankofamerica.com before consent
Unknown third-party request to storage.glancecdn.net before consent
Unknown third-party request to www.google.com before consent
sessionStorage key "celebruslogLevel" written before consent
sessionStorage key "c701b1a320c3fa2d4ff295bf1637ebb0test" written before consent
sessionStorage key "celebrusssllastQueuePointer" written before consent
sessionStorage key "celebrusssllastProcessPointer" written before consent
sessionStorage key "celebrusssleventQueueOwnerID" written before consent
sessionStorage key "celebrusssleventQueueOwnerLastActivityTimestampMillis" written before consent
sessionStorage key "celebrussslcelebrusP3PImplicit" written before consent
sessionStorage key "celebrussslcelebrussST" written before consent
sessionStorage key "celebrususeCors" written before consent
sessionStorage key "celebrusssl0" written before consent
sessionStorage key "celebrussslcurrentSent" written before consent
sessionStorage key "celebrussslcurrentStartTime" written before consent
sessionStorage key "celebrussslawaitingResponse" written before consent
sessionStorage key "celebrusssleventsInPacketCounter" written before consent
localStorage key "_cc_ck" written before consent
localStorage key "_cid_cc_ck" written before consent
sessionStorage key "celebrusssl1" written before consent
Info11
OneTrust2 findingscdn.cookielaw.org, OptanonConsent
cdn.cookielaw.org, OptanonConsent
OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management
OneTrust cookie "OptanonConsent" set before consent
OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location
Wix.com8 findingsTS01a5753c, TS013ab25a, TS01d8cd03, TS01b34b54, TS0151340d, TS01422b66, TS0178dddf, TS01454e7f
TS01a5753c, TS013ab25a, TS01d8cd03, TS01b34b54, TS0151340d, TS01422b66, TS0178dddf, TS01454e7f
Wix.com cookie "TS01a5753c" set before consent — Used for security and anti-fraud reasons
Wix.com cookie "TS013ab25a" set before consent — Used for security and anti-fraud reasons
Wix.com cookie "TS01d8cd03" set before consent — Used for security and anti-fraud reasons
Wix.com cookie "TS01b34b54" set before consent — Used for security and anti-fraud reasons
Wix.com cookie "TS0151340d" set before consent — Used for security and anti-fraud reasons
Wix.com cookie "TS01422b66" set before consent — Used for security and anti-fraud reasons
Wix.com cookie "TS0178dddf" set before consent — Used for security and anti-fraud reasons
Wix.com cookie "TS01454e7f" set before consent — Used for security and anti-fraud reasons
Compliant1
OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent
Is this your site?
Run a full multi-page scan with monitoring and get detailed remediation steps
Scan ml.com →This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com