https://nexusmods.com
Scanned Apr 15, 2026 · 42.0s
Your website score is
Grade
BannerConsent Banner
Yes
Regulatory Compliance
Multi-regulation overview — click any regulation for details
Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.
Tag Leak detected 49 user data leaks before consent on nexusmods.com, including Wunderkind (Advertising Tracker), Wunderkind (Tracker Tracker), Playwire (Advertising Tracker) and 2 more.
Security Headers
4/6 presentStrict-Transport-Security
Add HSTS header to enforce HTTPS connections and prevent downgrade attacks
Content-Security-Policy
default-src 'self' https:; font-src 'self' https: data:; img-src 'self' https: data: blob:; object-src 'none'; media-src 'self' https: data: blob:; frame-src 'self' https:; worker-src 'self' blob:; child-src 'self' blob:; script-src 'self' https: 'unsafe-inline' 'unsafe-eval'; style-src 'self' https: 'unsafe-inline';
X-Frame-Options
SAMEORIGIN
X-Content-Type-Options
nosniff
Referrer-Policy
strict-origin-when-cross-origin
Permissions-Policy
Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation
Google Consent Mode
V2Consent Parameters
Issues (2)
No default consent call detected — consent mode may not be initialised correctly
No GTM container detected — consent mode works best with Google Tag Manager
Post-Rejection Audit
Reject Button
Found
Post-Rejection Fires
3 vendors
Consent Mode
Not Detected
GTM Load
Not detected
Consent Mode V2: Not Detected
Google Consent Mode was not detected on this site.
✓ gtag('consent', 'update') call detected on rejection
Vendors firing after rejection (3)
| Vendor | Category | Timing | URL |
|---|---|---|---|
| Cookiebot — Cookiebot CMP | consent_management | 20833ms | consentcdn.cookiebot.com |
| Reddit — Reddit Pixel | advertising | 21446ms | alb.reddit.com |
| Google — Google Ads | advertising | 24093ms | pagead2.googlesyndication.com |
Consent Record Audit
Issues detectedConsent record stored after interaction
GDPR Art. 7(1)Found: CookieConsent (Cookiebot)
Record contains timestamp
Art. 7(1)Timestamp field detected
Record contains consent state
Art. 7(1)Accept/reject state detected
Record contains consent categories
Art. 7(1)Consent categories detected
Consent withdrawal mechanism accessible
GDPR Art. 7(3)No way for users to withdraw consent found on page
No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.
Why this matters
Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.
Tracker categories detected
Critical9
Wunderkind (advertising) loaded before consent
Wunderkind (tracker) loaded before consent
Playwire (advertising) loaded before consent
advertising tracker at public.profitwell.com loaded before consent
Google (tracker) loaded before consent
Cookiebot — Cookiebot CMP fires after user rejected consent
Reddit — Reddit Pixel fires after user rejected consent

Google — Google Ads fires after user rejected consent
No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)
Warnings44
Unknown third-party request to cdn.paddle.com before consent
Unknown third-party request to fundingchoicesmessages.google.com before consent
localStorage key "test" written before consent
localStorage key "PageOS_Session" written before consent
sessionStorage key "_pwLogger:PAGEOS_GDPR" written before consent
sessionStorage key "_pwLogger:PAGEOS_KINESIS" written before consent
sessionStorage key "_pwLogger:PAGEOS_PREBID" written before consent
sessionStorage key "_pwLogger:PAGEOS_USERDATA" written before consent
sessionStorage key "_pwLogger:PAGEOS_TYCHE" written before consent
sessionStorage key "_pwLogger:PAGEOS_VIDEO" written before consent
sessionStorage key "_pwLogger:PAGEOS_BENCHMARKS" written before consent
sessionStorage key "_pwLogger:PAGEOS_UID2" written before consent
sessionStorage key "_pwLogger:PAGEOS_DMP" written before consent
sessionStorage key "_pwLogger:PAGEOS_LOTAME" written before consent
sessionStorage key "_pwLogger:PAGEOS_METRICS" written before consent
sessionStorage key "_pwLogger:PAGEOS_AMAZON" written before consent
sessionStorage key "_pwLogger:PAGEOS_PERFORMANCE" written before consent
sessionStorage key "_pwLogger:PAGEOS_REPORTING_OBSERVER" written before consent
sessionStorage key "_pwLogger:PAGEOS_TELEMETRY" written before consent
sessionStorage key "_pwLogger:PAGEOS_DEBUG" written before consent
sessionStorage key "_pwLogger:TYCHE_AB_TEST" written before consent
sessionStorage key "_pwLogger:TYCHE_PREBID" written before consent
sessionStorage key "_pwLogger:TYCHE_GDPR" written before consent
sessionStorage key "_pwLogger:TYCHE_AD_UNIT" written before consent
sessionStorage key "_pwLogger:TYCHE_AD_REQUEST" written before consent
sessionStorage key "_pwLogger:TYCHE_AD_RESPONSE" written before consent
sessionStorage key "_pwLogger:TYCHE_AD_EVENT" written before consent
sessionStorage key "_pwLogger:TYCHE_KINESIS" written before consent
sessionStorage key "_pwLogger:TYCHE_STICKY_VIDEO" written before consent
sessionStorage key "_pwLogger:TYCHE_TRENDI_SLIDESHOW" written before consent
sessionStorage key "_pwLogger:TYCHE_RELEVANT_ARTICLE" written before consent
sessionStorage key "_pwLogger:TYCHE_PASSIVE_MODE" written before consent
sessionStorage key "_pwLogger:TYCHE_ADLIGHTNING" written before consent
sessionStorage key "_pwLogger:TYCHE_COPPA" written before consent
sessionStorage key "_pwLogger:TYCHE_REFRESH_TYPE" written before consent
sessionStorage key "_pwLogger:TYCHE_HB_TIMING" written before consent
sessionStorage key "_pwLogger:TYCHE_DISPLAY_VIDEO" written before consent
sessionStorage key "_pwLogger:TYCHE_CORNER_AD_VIDEO" written before consent
sessionStorage key "_pwLogger:TYCHE_PRECONTENT_AD_VIDEO" written before consent
sessionStorage key "_pwLogger:TYCHE_TRUSTED_INTERSTITIAL" written before consent
sessionStorage key "_pwLogger:TYCHE_REWARDED_AD_VIDEO" written before consent
sessionStorage key "_pwLogger:TYCHE_SKIP_GAM" written before consent
sessionStorage key "_pwLogger:TYCHE_COMPANION_AD" written before consent
sessionStorage key "_pwLogger:TYCHE_DEBUG" written before consent
Info5
Cookiebot (Cookiebot) loaded before consent: Cookiebot consent management platform
Cookiebot CMP (Cookiebot) loaded before consent: Cookiebot consent management platform

Cloudflare cookie "__cflb" set before consent — When enabling session affinity with Cloudflare Load Balancer, Cloudflare sets a __cflb cookie with a unique value on the first response to the requesting client. Cloudflare routes future requests to the same origin, optimizing network resource usage. In the event of a failover, Cloudflare sets a new __cflb cookie to direct future requests to the failover pool.
Cloudflare challenge clearance — necessary for site access
Cloudflare bot management — necessary for site operation
Compliant101
Google3 findingsFCCDCF, FCNEC, receive-cookie-deprecation
FCCDCF, FCNEC, receive-cookie-deprecation
Google cookie "FCCDCF" set correctly after consent
Google cookie "FCNEC" set correctly after consent
Google cookie "receive-cookie-deprecation" set correctly after consent
Cookiebot cookie "CookieConsent" set correctly after consent
Mixpanel3 findingsmp_3f01fd6fe87f03fe7a053413929d76b7_mixpanel, mp_tab_id_mixpanel_3f01fd6fe87f03fe7a053413929d76b7, mp_gen_new_tab_id_mixpanel_3f01fd6fe87f03fe7a053413929d76b7
mp_3f01fd6fe87f03fe7a053413929d76b7_mixpanel, mp_tab_id_mixpanel_3f01fd6fe87f03fe7a053413929d76b7, mp_gen_new_tab_id_mixpanel_3f01fd6fe87f03fe7a053413929d76b7
Mixpanel cookie "mp_3f01fd6fe87f03fe7a053413929d76b7_mixpanel" set correctly after consent
Mixpanel (Mixpanel) wrote "mp_tab_id_mixpanel_3f01fd6fe87f03fe7a053413929d76b7" to sessionStorage correctly after consent
Mixpanel (Mixpanel) wrote "mp_gen_new_tab_id_mixpanel_3f01fd6fe87f03fe7a053413929d76b7" to sessionStorage correctly after consent
Reddit Pixel cookie "_rdt_uuid" set correctly after consent
The Tradedesk2 findingsTDID, TDCPM
TDID, TDCPM
The Tradedesk cookie "TDID" set correctly after consent
The Tradedesk cookie "TDCPM" set correctly after consent
Casale Media3 findingsCMID, CMPS, CMPRO
CMID, CMPS, CMPRO
Casale Media cookie "CMID" set correctly after consent
Casale Media cookie "CMPS" set correctly after consent
Casale Media cookie "CMPRO" set correctly after consent
Adform4 findingsuid, C, c, UID

uid, C, c, UID

Adform cookie "uid" set correctly after consent

Adform cookie "C" set correctly after consent

Adform cookie "c" set correctly after consent

Adform cookie "UID" set correctly after consent
openx.net2 findingsi, pd
i, pd
openx.net cookie "i" set correctly after consent
openx.net cookie "pd" set correctly after consent
Magnite4 findingskhaos, khaos_p, audit_p, audit
khaos, khaos_p, audit_p, audit
Magnite cookie "khaos" set correctly after consent
Magnite cookie "khaos_p" set correctly after consent
Magnite cookie "audit_p" set correctly after consent
Magnite cookie "audit" set correctly after consent

DoubleClick/Google Marketing cookie "IDE" set correctly after consent
PubMatic25 findingsKADUSERCOOKIE, KRTBCOOKIE_188, KRTBCOOKIE_22, KRTBCOOKIE_153, KRTBCOOKIE_80, KRTBCOOKIE_740, KRTBCOOKIE_1323, KRTBCOOKIE_32, KRTBCOOKIE_391, KRTBCOOKIE_632, KRTBCOOKIE_860, KRTBCOOKIE_466, KRTBCOOKIE_279, KRTBCOOKIE_452, KRTBCOOKIE_377, chkChromeAb67Sec, pi, DPSync4, SyncRTB4, KRTBCOOKIE_57, KRTBCOOKIE_945, KRTBCOOKIE_1513, PugT, KRTBCOOKIE_27, SPugT
KADUSERCOOKIE, KRTBCOOKIE_188, KRTBCOOKIE_22, KRTBCOOKIE_153, KRTBCOOKIE_80, KRTBCOOKIE_740, KRTBCOOKIE_1323, KRTBCOOKIE_32, KRTBCOOKIE_391, KRTBCOOKIE_632, KRTBCOOKIE_860, KRTBCOOKIE_466, KRTBCOOKIE_279, KRTBCOOKIE_452, KRTBCOOKIE_377, chkChromeAb67Sec, pi, DPSync4, SyncRTB4, KRTBCOOKIE_57, KRTBCOOKIE_945, KRTBCOOKIE_1513, PugT, KRTBCOOKIE_27, SPugT
PubMatic cookie "KADUSERCOOKIE" set correctly after consent
PubMatic cookie "KRTBCOOKIE_188" set correctly after consent
PubMatic cookie "KRTBCOOKIE_22" set correctly after consent
PubMatic cookie "KRTBCOOKIE_153" set correctly after consent
PubMatic cookie "KRTBCOOKIE_80" set correctly after consent
PubMatic cookie "KRTBCOOKIE_740" set correctly after consent
PubMatic cookie "KRTBCOOKIE_1323" set correctly after consent
PubMatic cookie "KRTBCOOKIE_32" set correctly after consent
PubMatic cookie "KRTBCOOKIE_391" set correctly after consent
PubMatic cookie "KRTBCOOKIE_632" set correctly after consent
PubMatic cookie "KRTBCOOKIE_860" set correctly after consent
PubMatic cookie "KRTBCOOKIE_466" set correctly after consent
PubMatic cookie "KRTBCOOKIE_279" set correctly after consent
PubMatic cookie "KRTBCOOKIE_452" set correctly after consent
PubMatic cookie "KRTBCOOKIE_377" set correctly after consent
PubMatic cookie "chkChromeAb67Sec" set correctly after consent
PubMatic cookie "pi" set correctly after consent
PubMatic cookie "DPSync4" set correctly after consent
PubMatic cookie "SyncRTB4" set correctly after consent
PubMatic cookie "KRTBCOOKIE_57" set correctly after consent
PubMatic cookie "KRTBCOOKIE_945" set correctly after consent
PubMatic cookie "KRTBCOOKIE_1513" set correctly after consent
PubMatic cookie "PugT" set correctly after consent
PubMatic cookie "KRTBCOOKIE_27" set correctly after consent
PubMatic cookie "SPugT" set correctly after consent
Yahoo2 findingsA3, IDSYNC
A3, IDSYNC
Yahoo cookie "A3" set correctly after consent
Yahoo cookie "IDSYNC" set correctly after consent
Outbrain cookie "obuid" set correctly after consent
Rapleaf2 findingsrlas3, pxrc
rlas3, pxrc
Rapleaf cookie "rlas3" set correctly after consent
Rapleaf cookie "pxrc" set correctly after consent
LinkedIn3 findingsbcookie, li_gc, lidc
bcookie, li_gc, lidc
LinkedIn cookie "bcookie" set correctly after consent
LinkedIn cookie "li_gc" set correctly after consent
LinkedIn cookie "lidc" set correctly after consent
Beeswax2 findingsbito, bitoIsSecure
bito, bitoIsSecure
Beeswax cookie "bito" set correctly after consent
Beeswax cookie "bitoIsSecure" set correctly after consent
Lotame4 findings_cc_dc, _cc_id, _cc_cc, _cc_aud
_cc_dc, _cc_id, _cc_cc, _cc_aud
Lotame cookie "_cc_dc" set correctly after consent
Lotame cookie "_cc_id" set correctly after consent
Lotame cookie "_cc_cc" set correctly after consent
Lotame cookie "_cc_aud" set correctly after consent
Amazon2 findingsad-id, ad-privacy
ad-id, ad-privacy
Amazon cookie "ad-id" set correctly after consent
Amazon cookie "ad-privacy" set correctly after consent
Marfeel cookie "_ssuma" set correctly after consent
PayPal cookie "ts" set correctly after consent
CreativeCDN cookie "g" set correctly after consent
Platform161 cookie "tuuid" set correctly after consent
bidswitch.net cookie "tuuid_lu" set correctly after consent
Admatic cookie "uids" set correctly after consent

Quantcast cookie "mc" set correctly after consent

Adobe Advertising cookie "everest_g_v2" set correctly after consent
OnAudience cookie "done_redirects271" set correctly after consent
Snowplow cookie "sp" set correctly after consent
Tapad3 findingsTapAd_TS, TapAd_DID, TapAd_3WAY_SYNCS
TapAd_TS, TapAd_DID, TapAd_3WAY_SYNCS
Tapad cookie "TapAd_TS" set correctly after consent
Tapad cookie "TapAd_DID" set correctly after consent
Tapad cookie "TapAd_3WAY_SYNCS" set correctly after consent
Adobe Audience Manager2 findingsdemdex, dpm

demdex, dpm

Adobe Audience Manager cookie "demdex" set correctly after consent

Adobe Audience Manager cookie "dpm" set correctly after consent
Xandr3 findingsXANDR_PANID, uuid2, anj
XANDR_PANID, uuid2, anj
Xandr cookie "XANDR_PANID" set correctly after consent
Xandr cookie "uuid2" set correctly after consent
Xandr cookie "anj" set correctly after consent
ID53 findingsgdpr, id5, 3pi
gdpr, id5, 3pi
ID5 cookie "gdpr" set correctly after consent
ID5 cookie "id5" set correctly after consent
ID5 cookie "3pi" set correctly after consent
NGINX Ingresss cookie "INGRESSCOOKIE" set correctly after consent
ComScore cookie "pid" set correctly after consent
Smartadserver2 findingsTestIfCookieP, csync
TestIfCookieP, csync
Smartadserver cookie "TestIfCookieP" set correctly after consent
Smartadserver cookie "csync" set correctly after consent
csync.loopme.me cookie "viewer_token" set correctly after consent
Adkernel2 findingsSSPZ, ADKUID
SSPZ, ADKUID
Adkernel cookie "SSPZ" set correctly after consent
Adkernel cookie "ADKUID" set correctly after consent
semasio.net cookie "SEUNCY" set correctly after consent
Neustar cookie "ab" set correctly after consent
Improve Digital2 findingsum, umeh
um, umeh
Improve Digital cookie "um" set correctly after consent
Improve Digital cookie "umeh" set correctly after consent
1rx.io cookie "_rxuuid" set correctly after consent
ShareThis2 findings__stid, __stidv
__stid, __stidv
ShareThis cookie "__stid" set correctly after consent
ShareThis cookie "__stidv" set correctly after consent

Criteo cookie "cto_bundle" set correctly after consent
Is this your site?
Run a full multi-page scan with monitoring and get detailed remediation steps
Scan nexusmods.com →This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com