https://next.co.uk
Scanned Apr 17, 2026 · 44.8s
Your website score is
Grade
BannerConsent Banner
Yes
Regulatory Compliance
Multi-regulation overview — click any regulation for details
Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.
Tag Leak detected 29 user data leaks before consent on next.co.uk, including GA4, Google Ads, Exponea.
Security Headers
1/6 presentStrict-Transport-Security
Add HSTS header to enforce HTTPS connections and prevent downgrade attacks
Content-Security-Policy
frame-ancestors 'self' iguidewebapp.next-uk.next.loc/ end-duws02.next-uk.next.loc/ end-dpws02.next-uk.next.loc/ studio.mgmt.qa.test/ studio.mgmt.next-uk.next.loc/
X-Frame-Options
Add X-Frame-Options header to prevent clickjacking attacks
X-Content-Type-Options
Set X-Content-Type-Options to 'nosniff' to prevent MIME type sniffing
Referrer-Policy
Set a Referrer-Policy header to control how much referrer information is shared
Permissions-Policy
Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation
Google Consent Mode
V2Consent Parameters
Issues (1)
No default consent call detected — consent mode may not be initialised correctly
Post-Rejection Audit
Reject Button
Found
Post-Rejection Fires
1 vendor
Consent Mode
Advanced
GTM Load
670ms pre-consent
Google Tag Manager(GTM-KMS4Q5K)
Loaded 670ms after page load — before the consent banner was detected (banner appeared at 8658ms). Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.
Consent Mode V2: Advanced
Advanced Consent Mode — consent update call fires on rejection and tracking stops correctly.
✓ gtag('consent', 'update') call detected on rejection
Vendors firing after rejection (1)
| Vendor | Category | Timing | URL |
|---|---|---|---|
| Google — GA4 | analytics | 26581ms | region1.google-analytics.com |
Consent Record Audit
Issues detectedConsent record stored after interaction
GDPR Art. 7(1)Found: OptanonConsent (OneTrust)
Record contains timestamp
Art. 7(1)Timestamp field detected
Record contains consent state
Art. 7(1)Accept/reject state detected
Record contains consent categories
Art. 7(1)Consent categories (analytics, marketing, etc.) not found in record
Consent withdrawal mechanism accessible
GDPR Art. 7(3)No way for users to withdraw consent found on page
No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.
Why this matters
Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.
Tracker categories detected
Critical7
Data was transmitted to a third-party or storage was written on the user’s device before consent. This is a GDPR/ePrivacy violation, not just a script load.
GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics
Google Ads2 findingspagead2.googlesyndication.com, ade.googlesyndication.com
pagead2.googlesyndication.com, ade.googlesyndication.com
Google Ads (Google) loaded before consent: Google ad syndication and remarketing
Google Ads (Google) loaded before consent: Google ad syndication and remarketing
Exponea2 findings__exponea_etc__, __exponea_time2__
__exponea_etc__, __exponea_time2__
Exponea cookie "__exponea_etc__" set before consent — Exponea Bloomreach Engagement - This cookie is used to determine which products the visitor has viewed. This information is used to promote related products and optimize ad-efficiency.
Exponea cookie "__exponea_time2__" set before consent — Exponea Bloomreach Engagement - This cookie is used to determine which products the visitor has viewed. This information is used to promote related products and optimize ad-efficiency.
Google — GA4 fires after user rejected consent
No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)
Warnings24
A tag container or script loaded before consent but tags appear correctly gated (e.g. GTM with Consent Mode v2). Not a violation on its own — review to confirm downstream tags stay blocked.
Google Tag Manager2 findingsID trackedwww.googletagmanager.com
www.googletagmanager.com
Google Tag Manager loads before consent — this is expected and required for GCM v2 to initialise consent defaults before any tags fire
GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-KMS4Q5K)
Google Tag Manager loads before consent — this is expected and required for GCM v2 to initialise consent defaults before any tags fire
Unknown third-party request to static.queue-it.net before consent
Unknown third-party request to assets.queue-it.net before consent
Unknown third-party request to next.queue-it.net before consent
localStorage key "__exponea_storage_test__" written before consent
localStorage key "__exponea_last_session_start_timestamp__" written before consent
localStorage key "__exponea_last_session_ping_timestamp__" written before consent
localStorage key "__storage_test_sample__" written before consent
localStorage key "__tmp_localstoragetest" written before consent
localStorage key "_tmptest" written before consent
localStorage key "dummy" written before consent
localStorage key "ak_a" written before consent
localStorage key "__akfp_storage_test__" written before consent
sessionStorage key "__exponea_tracking_definition__" written before consent
localStorage key "BR:CLARITY_WEBLAYER" written before consent
localStorage key "__clarity_last_session_start_timestamp__" written before consent
sessionStorage key "test" written before consent
localStorage key "favouriteCacheVersion" written before consent
localStorage key "VisitedPages" written before consent
sessionStorage key "RPID" written before consent
sessionStorage key "NextFavourites:HasFavouriteItems" written before consent
sessionStorage key "ak_bm_tab_id" written before consent
Info7
Neutral observations — activity we detected that isn’t a violation but is useful context (e.g. essential cookies, CMP initialisation).
OneTrust2 findingscdn.cookielaw.org, OptanonConsent
cdn.cookielaw.org, OptanonConsent
OneTrust (OneTrust) loaded before consent: OneTrust cookie consent management
OneTrust cookie "OptanonConsent" set before consent
OneTrust CMP (OneTrust) loaded before consent: OneTrust geo-lookup — determines which consent banner to show based on user location
Citrix cookie "NSC_JObpvvqlbx0xcdzbrn3bnhbgejhupbq" set before consent — This cookie name is associated with the Netscaler load balancing service from Citrix. This is a pattern type cookie with the root being NSC_ and the rest of the name being a unique encrypted alpha numeric identifier for the virtual server it originated from. The cookie is used to ensure traffic and user data is routed to the correct locations where a site is hosted on multiple servers, so that the end user has a consistent experience.
Akamai bot manager — necessary for site protection
Akamai bot management session — necessary for site protection
.NET session identifier — necessary for site operation
Compliant56
Tags that fired only after the user gave consent — working as intended.
Microsoft Clarity3 findingsID trackedwww.clarity.ms, scripts.clarity.ms, i.clarity.ms
www.clarity.ms, scripts.clarity.ms, i.clarity.ms
Microsoft Clarity (Microsoft) loaded correctly after consent
Microsoft Clarity (Microsoft) loaded correctly after consent
Microsoft Clarity (Microsoft) loaded correctly after consent
TikTok Pixel6 findingsID trackedanalytics.tiktok.com, _ttp, _tt_enable_cookie, tt_sessionId, tt_appInfo, tt_pixel_session_index
analytics.tiktok.com, _ttp, _tt_enable_cookie, tt_sessionId, tt_appInfo, tt_pixel_session_index
TikTok Pixel (TikTok) loaded correctly after consent
TikTok Pixel cookie "_ttp" set correctly after consent
TikTok Pixel cookie "_tt_enable_cookie" set correctly after consent
TikTok Pixel (TikTok) wrote "tt_sessionId" to sessionStorage correctly after consent
TikTok Pixel (TikTok) wrote "tt_appInfo" to sessionStorage correctly after consent
TikTok Pixel (TikTok) wrote "tt_pixel_session_index" to sessionStorage correctly after consent
Google Analytics3 findingsID trackedregion1.analytics.google.com, _ga_0MCQTK8RLH, _ga
region1.analytics.google.com, _ga_0MCQTK8RLH, _ga
GA4 (Google) loaded correctly after consent
Google Analytics cookie "_ga_0MCQTK8RLH" set correctly after consent
Google Analytics cookie "_ga" set correctly after consent
Pinterest Tag3 findingsID trackedct.pinterest.com, s.pinimg.com, _pin_unauth
ct.pinterest.com, s.pinimg.com, _pin_unauth
Pinterest Tag (Pinterest) loaded correctly after consent
Pinterest Tag (Pinterest) loaded correctly after consent
Pinterest Tag cookie "_pin_unauth" set correctly after consent
Google Ads5 findingswww.google.com, googleads.g.doubleclick.net, pagead2.googlesyndication.com, _gcl_au, _gcl_ls
www.google.com, googleads.g.doubleclick.net, pagead2.googlesyndication.com, _gcl_au, _gcl_ls
Google Ads (Google) loaded correctly after consent
Google Ads (Google) loaded correctly after consent
Google Ads (Google) loaded correctly after consent
Google Ads cookie "_gcl_au" set correctly after consent
Google Ads (Google) wrote "_gcl_ls" to localStorage correctly after consent
Meta Pixel2 findingsconnect.facebook.net, _fbp
connect.facebook.net, _fbp
Meta Pixel (Meta) loaded correctly after consent
Meta Pixel cookie "_fbp" set correctly after consent
Snapchat Pixel4 findingssc-static.net, tr.snapchat.com, _scid, _scid_r
sc-static.net, tr.snapchat.com, _scid, _scid_r
Snapchat Pixel (Snapchat) loaded correctly after consent
Snapchat Pixel (Snapchat) loaded correctly after consent
Snapchat Pixel cookie "_scid" set correctly after consent
Snapchat Pixel cookie "_scid_r" set correctly after consent
Taboola5 findingscdn.taboola.com, trc.taboola.com, taboola_session_id, t_gid, t_pt_gid
cdn.taboola.com, trc.taboola.com, taboola_session_id, t_gid, t_pt_gid
Taboola (Taboola) loaded correctly after consent
Taboola (Taboola) loaded correctly after consent
Taboola cookie "taboola_session_id" set correctly after consent
Taboola cookie "t_gid" set correctly after consent
Taboola cookie "t_pt_gid" set correctly after consent
Snapchat2 findingsX-AB, sc_at
X-AB, sc_at
Snapchat cookie "X-AB" set correctly after consent
Snapchat cookie "sc_at" set correctly after consent
OneTrust cookie "OptanonAlertBoxClosed" set correctly after consent
Dynatrace5 findingsrxVisitor, dtSa, dtCookie, dtPC, rxvt
rxVisitor, dtSa, dtCookie, dtPC, rxvt
Dynatrace cookie "rxVisitor" set correctly after consent
Dynatrace cookie "dtSa" set correctly after consent
Dynatrace cookie "dtCookie" set correctly after consent
Dynatrace cookie "dtPC" set correctly after consent
Dynatrace cookie "rxvt" set correctly after consent
Adalyser.com4 findings__adal_ses, __adal_id, __adal_ca, __adal_cw
__adal_ses, __adal_id, __adal_ca, __adal_cw
Adalyser.com cookie "__adal_ses" set correctly after consent
Adalyser.com cookie "__adal_id" set correctly after consent
Adalyser.com cookie "__adal_ca" set correctly after consent
Adalyser.com cookie "__adal_cw" set correctly after consent
Shopify cookie "_s" set correctly after consent
Amazon2 findingsad-id, ad-privacy
ad-id, ad-privacy
Amazon cookie "ad-id" set correctly after consent
Amazon cookie "ad-privacy" set correctly after consent
The Tradedesk2 findingsTDID, TDCPM
TDID, TDCPM
The Tradedesk cookie "TDID" set correctly after consent
The Tradedesk cookie "TDCPM" set correctly after consent
DoubleClick/Google Marketing2 findingsar_debug, IDE
ar_debug, IDE
DoubleClick/Google Marketing cookie "ar_debug" set correctly after consent
DoubleClick/Google Marketing cookie "IDE" set correctly after consent
Bing / Microsoft cookie "MUID" set correctly after consent
Pinterest cookie "_pinterest_ct_ua" set correctly after consent
Microsoft Ads2 findings_uetsid, _uetvid
_uetsid, _uetvid
Microsoft Ads cookie "_uetsid" set correctly after consent
Microsoft Ads cookie "_uetvid" set correctly after consent
TikTok2 findingsttcsid, ttcsid_C0VO58H5A0R73RNS8PEG
ttcsid, ttcsid_C0VO58H5A0R73RNS8PEG
TikTok cookie "ttcsid" set correctly after consent
TikTok cookie "ttcsid_C0VO58H5A0R73RNS8PEG" set correctly after consent
Is this your site?
Run a full multi-page scan with monitoring and get detailed remediation steps
Scan next.co.uk →This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com