Stanford

stanford.edu

Compare

https://stanford.edu

Scanned Apr 15, 2026 · 21.9s

Your website score is

0/100
Critical

Grade

F0

Banner

No

Regulatory Compliance

Multi-regulation overview — click any regulation for details

Technical scan only. A passing score does not equal legal compliance. Consult qualified legal counsel for your jurisdiction.

Tag Leak detected 30 user data leaks before consent on stanford.edu, including SiteImprove (Analytics Tracker), Meta Pixel, GA4 and 6 more.

Security Headers

6/6 present

Strict-Transport-Security

max-age=63072000 max-age=300

Content-Security-Policy

upgrade-insecure-requests;

X-Frame-Options

SAMEORIGIN

X-Content-Type-Options

nosniff

Referrer-Policy

strict-origin-when-cross-origin

Permissions-Policy

accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=*, publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=*, usb=(), xr-spatial-tracking=(), gamepad=(), serial=()

Google Consent Mode

Not Detected

Google Consent Mode v2 was not found on this page. GCM v2 allows Google's tags to adjust their behavior based on user consent, and is required for compliant advertising measurement in the EU. Without it, your Google Ads and GA4 conversions may be impacted after consent is declined.

GTM container detected (GTM-T4N2WTT) but no consent mode initialisation found. Add gtag('consent', 'default', ...) before your GTM snippet.

Post-Rejection Audit

Reject Button

Missing

Post-Rejection Fires

0 vendors

Consent Mode

Not Detected

GTM Load

932ms pre-consent

Google Tag Manager(GTM-T4N2WTT)

Loaded 932ms after page load — before the consent banner was detected. Per a 2022 German court ruling, GTM itself transmits the user's IP to Google pre-consent.

Consent Mode V2: Not Detected

Google Consent Mode was not detected on this site.

Consent Record Audit

Issues detected

Consent record stored after interaction

GDPR Art. 7(1)

No consent record written — cannot prove consent was given

No CMP consent cookie or localStorage entry was found after the consent interaction. GDPR requires controllers to demonstrate consent was given.

Consent withdrawal mechanism accessible

GDPR Art. 7(3)

No way for users to withdraw consent found on page

No cookie settings link, footer link, or floating consent button was detected. GDPR requires users to withdraw consent as easily as they gave it.

Why this matters

Under GDPR Article 7, controllers must be able to demonstrate that consent was given (Art. 7(1)) and ensure users can withdraw consent at any time, as easily as giving it (Art. 7(3)). Sites with no consent record or no withdrawal mechanism cannot legally rely on consent as a lawful basis.

Tracker categories detected

Advertising2 vendors
Analytics6 vendors
Marketing1 vendor
Functional2 vendors
Tag Management1 vendor
Critical28
HotJar
HotJar2 findingsID tracked

static.hotjar.com, script.hotjar.com

HotJar
criticalNetworkAnalyticsHotJar

HotJar (Hotjar) loaded before consent: Session recording and heatmap analytics

ID: 6430056Host: static.hotjar.comFired: 1586ms after load
HotJar
criticalNetworkAnalyticsHotJar

HotJar (Hotjar) loaded before consent: Session recording and heatmap analytics

Host: script.hotjar.comFired: 1742ms after load
Meta Pixel
Meta Pixel3 findingsID tracked

www.facebook.com, connect.facebook.net, _fbp

Meta Pixel
criticalNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded before consent: Meta Pixel tracking endpoint

ID: 1199096620574484Host: www.facebook.comFired: 1699ms after load
Meta Pixel
criticalNetworkAdvertisingMeta Pixel

Meta Pixel (Meta) loaded before consent: Sends user data to Meta for ad targeting and conversion tracking

Host: connect.facebook.netFired: 778ms after load
Meta Pixel
criticalCookieAdvertisingMeta Pixel

Meta Pixel cookie "_fbp" set before consent

Cookie: _fbpDomain: .stanford.edu
Google Analytics
Google Analytics8 findingsID tracked

region1.analytics.google.com, region1.google-analytics.com, www.google-analytics.com, _gid, _gat_UA-1860414-1, _ga, _ga_E08J4Q7DG7, _ga_RBCPHN00S7

GA4
criticalNetworkAnalyticsGA4

GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics

ID: G-RBCPHN00S7Host: region1.analytics.google.comFired: 1847ms after load
GA4
criticalNetworkAnalyticsGA4

GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics

ID: G-E08J4Q7DG7Host: region1.google-analytics.comFired: 2009ms after load
GA4
criticalNetworkAnalyticsGA4

GA4 (Google) loaded before consent: Sends pageview and event data to Google Analytics

Host: www.google-analytics.comFired: 1586ms after load
Google Analytics
criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_gid" set before consent

Cookie: _gidDomain: .stanford.edu
Google Analytics
criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_gat_UA-1860414-1" set before consent

Cookie: _gat_UA-1860414-1Domain: .stanford.edu
Google Analytics
criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga" set before consent

Cookie: _gaDomain: .stanford.edu
Google Analytics
criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_E08J4Q7DG7" set before consent

Cookie: _ga_E08J4Q7DG7Domain: .stanford.edu
Google Analytics
criticalCookieAnalyticsGoogle Analytics

Google Analytics cookie "_ga_RBCPHN00S7" set before consent

Cookie: _ga_RBCPHN00S7Domain: .stanford.edu
Google (Tracker Tracker)
criticalNetworkGoogle (Tracker Tracker)

Google (tracker) loaded before consent

ID: G-RBCPHN00S7Host: stats.g.doubleclick.netFired: 1847ms after load
SiteImprove (Analytics Tracker)
SiteImprove (Analytics Tracker)3 findings

siteimproveanalytics.com, 80352.global.siteimproveanalytics.io, 6343745.global.r2.siteimproveanalytics.io

SiteImprove (Analytics Tracker)
criticalNetworkAnalyticsSiteImprove (Analytics Tracker)

SiteImprove (analytics) loaded before consent

Host: siteimproveanalytics.comFired: 778ms after load
SiteImprove (Analytics Tracker)
criticalNetworkAnalyticsSiteImprove (Analytics Tracker)

SiteImprove (analytics) loaded before consent

Host: 80352.global.siteimproveanalytics.ioFired: 1410ms after load
SiteImprove (Analytics Tracker)
criticalNetworkAnalyticsSiteImprove (Analytics Tracker)

SiteImprove (analytics) loaded before consent

Host: 6343745.global.r2.siteimproveanalytics.ioFired: 1411ms after load
Google Ads
Google Ads3 findings

www.google.com, _gcl_au, _gcl_ls

Google Ads
criticalNetworkAdvertisingGoogle Ads

Google Ads (Google) loaded before consent: Google Consent Mode data collection for ad measurement

Host: www.google.comFired: 1587ms after load
Google Ads
criticalCookieAdvertisingGoogle Ads

Google Ads cookie "_gcl_au" set before consent

Cookie: _gcl_auDomain: .stanford.edu
Google Ads
criticalStorageAdvertisingGoogle Ads

Google Ads (Google) wrote "_gcl_ls" to localStorage before consent

Key: _gcl_lsType: localStorageFired: 1543ms after load
criticalCookieAnalyticsSiteimprove

Siteimprove cookie "nmstat" set before consent — This cookie is used to help record the visitor's use of the website. It is used to collect statistics about site usage such as when the visitor last visited the site. This information is then used to improve the user experience on the website. This Siteimprove Analytics cookie contains a randomly generated ID used to recognize the browser when a visitor reads a page. The cookie contains no personal information and is used only for web analytics. It is also used to track the sequence of pages a visitor looks at during a visit to the site. This information can be used to reduce user journeys, and enable visitors to find relevant information quicker.

Cookie: nmstatDomain: .stanford.eduRetention: 3 years
Youtube
Youtube3 findings

__Secure-ROLLOUT_TOKEN, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA

Youtube
criticalCookieMarketingYoutube

Youtube cookie "__Secure-ROLLOUT_TOKEN" set before consent — Registers a unique ID to keep statistics of what videos from YouTube the user has seen.

Cookie: __Secure-ROLLOUT_TOKENDomain: .youtube.comRetention: 180 days
Youtube
criticalCookieMarketingYoutube

Youtube cookie "VISITOR_INFO1_LIVE" set before consent — Tries to estimate the users' bandwidth on pages with integrated YouTube videos. Also used for marketing

Cookie: VISITOR_INFO1_LIVEDomain: .youtube.comRetention: 179 days
Youtube
criticalCookieMarketingYoutube

Youtube cookie "VISITOR_PRIVACY_METADATA" set before consent — Youtube visitor privacy metadata cookie

Cookie: VISITOR_PRIVACY_METADATADomain: .youtube.comRetention: 180 days
criticalNetwork

No consent banner detected — all cookies and tags fire without user consent

criticalConsent

No "reject all" option found — users cannot refuse non-essential cookies (ICO guidance requires this)

criticalConsent Record

No recognizable consent cookie or storage entry detected after interaction — GDPR Article 7(1) requires controllers to demonstrate consent was given (server-side storage cannot be verified)

criticalConsent Record

No recognizable consent withdrawal mechanism detected — GDPR Article 7(3) requires users can withdraw consent as easily as giving it (cookie settings link or floating button expected)

Warnings5
Google Tag Manager
Google Tag Manager2 findingsID tracked

www.googletagmanager.com

Google Tag Manager
warningNetworkTag ManagementGoogle Tag Manager

Google Tag Manager (Google) loaded before consent: Loads the GTM container which may trigger other tags

ID: GTM-T4N2WTTHost: www.googletagmanager.comFired: 778ms after load
Google Tag Manager
warningGTMTag ManagementGoogle Tag Manager

GTM loaded before consent banner — IP address transmitted to Google pre-consent (container: GTM-T4N2WTT)

vendor logo
warningNetwork

Unknown third-party request to localist-images.azureedge.net before consent

Host: localist-images.azureedge.netFired: 1213ms after load
warningStorage

localStorage key "lastExternalReferrer" written before consent

Key: lastExternalReferrerType: localStorageFired: 1645ms after load
warningStorage

localStorage key "NRBA_SESSION" written before consent

Key: NRBA_SESSIONType: localStorageFired: 2322ms after load
Info8
Google (Cdn)
Google (Cdn)4 findingsID tracked

www.google.nl, fonts.googleapis.com, fonts.gstatic.com, www.youtube.com

Google (Cdn)
infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

ID: G-RBCPHN00S7Host: www.google.nlFired: 1848ms after load
Google (Cdn)
infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: fonts.googleapis.comFired: 649ms after load
Google (Cdn)
infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: fonts.gstatic.comFired: 912ms after load
Google (Cdn)
infoNetworkGoogle (Cdn)

Google (cdn) loaded before consent

Host: www.youtube.comFired: 1586ms after load
New Relic
New Relic2 findings

js-agent.newrelic.com, bam.nr-data.net

New Relic
infoNetworkAnalyticsNew Relic

New Relic (New Relic) loaded before consent: New Relic browser monitoring agent

Host: js-agent.newrelic.comFired: 2279ms after load
New Relic
infoNetworkAnalyticsNew Relic

New Relic (New Relic) loaded before consent: New Relic browser data collection endpoint

Host: bam.nr-data.netFired: 2343ms after load
Google
infoCookieFunctionalGoogle

Google cookie "__Secure-YNID" set before consent — It's a YouTube cookie used to enhance user experience by storing video player preferences and aiding in secure log-ins and spam detectio

Cookie: __Secure-YNIDDomain: .youtube.comRetention: 180 days
Youtube
infoCookieFunctionalYoutube

Youtube cookie "YSC" set before consent — Registers a unique ID to keep statistics of what videos from YouTube the user has seen.

Cookie: YSCDomain: .youtube.comRetention: Session

Is this your site?

Run a full multi-page scan with monitoring and get detailed remediation steps

Scan stanford.edu →

This audit is based on publicly observable website behavior. To request removal from the index, email support@tagleak.com